<br><font size=2 face="sans-serif">flow-capture logs for me to: /var/log/cflowd.log.
Looks like cacti is intermediate and sending to system messages at /var/log/messages?</font>
<br>
<br><font size=2 face="sans-serif">My typical messages:</font>
<br>
<br><font size=2 face="sans-serif">3076 Apr 20 15:15:17 dbcollect flow-capture[20686]:
remove/2 2009/2009-03/2009-03-29/ft-v07.2009-03-29.234501+0000</font>
<br><font size=2 face="sans-serif">3077 Apr 20 15:16:37 dbcollect flow-capture[20686]:
ftpdu_seq_check(): src_ip=192.168.16.1 dst_ip=172.16.253.32 d_version=7
expecting=3971473012 received=3971473039 lost=27</font>
<br><font size=2 face="sans-serif">3078 Apr 20 15:17:36 dbcollect flow-capture[20662]:
remove/2 ./2009/2009-01/2009-01-07/ft-v01.2009-01-07.153000+0000</font>
<br><font size=2 face="sans-serif">3079 Apr 20 15:18:00 dbcollect flow-capture[20173]:
STAT: now=1240240680 startup=1235616206 src_ip=172.17.100.36 dst_ip=172.16.253.32
d_ver=5 pkts=42903148 flows=1243414628 lost=100678 reset=432 filter_drops=0</font>
<br>
<br><font size=2 face="sans-serif">Your 'remove' messages are flow-capture
doing directory trimming to meet your requirements of 5M total space. It
goes through the motions but there's no need ( .. 0 files) since you're
not close to 5M.</font>
<br>
<br><font size=2 face="sans-serif">Can you try it completely independently
from cacti as a check?</font>
<br><font size=2 face="sans-serif"><br>
Joe</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>"Schultz, Brian"
<Brian.Schultz@AtlasAir.com></b> </font>
<br><font size=1 face="sans-serif">Sent by: flow-tools-bounces@list.splintered.net</font>
<p><font size=1 face="sans-serif">04/18/2009 08:58 AM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">"Craig Weinhold" <craig.weinhold@cdw.com></font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">flow-tools@list.splintered.net</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">RE: [Flow-tools] Empty flow files</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=2>Where can I see the syslog files?<br>
It's not netflow v9, these are older routers<br>
<br>
<br>
-----Original Message-----<br>
From: Craig Weinhold [</font><a href=mailto:craig.weinhold@cdw.com><font size=2 color=blue><u>mailto:craig.weinhold@cdw.com</u></font></a><font size=2>]<br>
Sent: Fri 4/17/2009 9:53 PM<br>
To: Schultz, Brian<br>
Subject: Re: [Flow-tools] Empty flow files<br>
<br>
What does syslog say? flow-tools does a good job of logging errors.<br>
<br>
Could the netflow format be v9 ? flow-tools won't understand it.<br>
<br>
-Craig<br>
<br>
<br>
On Fri, 17 Apr 2009, Schultz, Brian wrote:<br>
<br>
> I?ve been trying to get flow-tools to work for the past couple of
days but I all the flow files seem to be empty. I was using ntop for a
little while to test out flow reporting (and it worked) but I think I?m
going to move over to Cacti so I can get netflow and snmp all in one place.
I?m running this on Ubuntu btw. Any ideas on what I can do?<br>
><br>
> There aren?t any firewall rules to prevent anything<br>
> Chain INPUT (policy ACCEPT)<br>
> target prot opt source
destination<br>
><br>
> Chain FORWARD (policy ACCEPT)<br>
> target prot opt source
destination<br>
><br>
> Chain OUTPUT (policy ACCEPT)<br>
> target prot opt source
destination<br>
><br>
> I can see all of the incoming flows<br>
> tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode<br>
> listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes<br>
> 15:49:23.288138 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:49:34.283227 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 936<br>
> 15:49:48.290208 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:49:55.287958 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:50:02.288658 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:50:03.288547 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:50:04.289581 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:50:07.293188 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
> 15:50:08.325804 IP 192.168.1.6.49866 > 172.19.10.23.2058: UDP,
length 1464<br>
><br>
> I start up flow-capture<br>
> sudo flow-capture -V5 -d7 -E5M -S1 -w /var/flow/ams 0/0/2058<br>
><br>
> I can see that the port is up but it?s not in the listening state
if that makes a difference<br>
> Active Internet connections (only servers)<br>
> Proto Recv-Q Send-Q Local Address
Foreign Address State
PID/Program name<br>
> tcp 0 0 127.0.0.1:3306
0.0.0.0:*
LISTEN 4400/mysqld<br>
> tcp 0 0 0.0.0.0:80
0.0.0.0:*
LISTEN 4579/apache2<br>
> tcp 0 0 0.0.0.0:22
0.0.0.0:*
LISTEN 4887/sshd<br>
> tcp6 0 0 :::22
:::*
LISTEN 4887/sshd<br>
> udp 0 0 0.0.0.0:2058
0.0.0.0:*
5131/flow-capture<br>
> udp 0 0 127.0.0.1:161
0.0.0.0:*
4500/snmpd<br>
> udp 0 0 0.0.0.0:68
0.0.0.0:*
3988/dhclient3<br>
> Active UNIX domain sockets (only servers)<br>
> Proto RefCnt Flags Type
State I-Node PID/Program name
Path<br>
> unix 2 [ ACC ] STREAM
LISTENING 13342 4400/mysqld
/var/run/mysqld/mysqld.sock<br>
> unix 2 [ ACC ] STREAM
LISTENING 13222 4308/dbus-daemon
/var/run/dbus/system_bus_socket<br>
><br>
> I see all of the flow files being created<br>
> Cacti:/var/flow/ams/2009/2009-04/2009-04-17$ ls -l<br>
> total 32<br>
> -rw-r--r-- 1 root root 88 2009-04-17 15:30 ft-v05.2009-04-17.152325-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 15:44 ft-v05.2009-04-17.153001-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 15:53 ft-v05.2009-04-17.155206-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 16:00 ft-v05.2009-04-17.155424-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 16:01 ft-v05.2009-04-17.160001-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 16:15 ft-v05.2009-04-17.160344-0400<br>
> -rw-r--r-- 1 root root 88 2009-04-17 16:30 ft-v05.2009-04-17.161501-0400<br>
> -rw-r--r-- 1 root root 80 2009-04-17 16:30 tmp-v05.2009-04-17.163001-0400<br>
><br>
> But there?s nothing in them<br>
> flow-print < ft-v05.2009-04-17.152325-0400<br>
> srcIP dstIP
prot srcPort dstPort octets
packets<br>
><br>
> not sure what this means but it scrolls by in the message log<br>
> Cacti:~$ tail /var/log/messages<br>
> Apr 17 16:03:52 Cacti flow-capture[5659]: remove/1 0 files<br>
> Apr 17 16:03:52 Cacti flow-capture[5659]: remove/2 0 files<br>
> Apr 17 16:03:53 Cacti flow-capture[5659]: remove/1 0 files<br>
> Apr 17 16:03:53 Cacti flow-capture[5659]: remove/2 0 files<br>
> Apr 17 16:03:54 Cacti flow-capture[5659]: remove/1 0 files<br>
> Apr 17 16:03:54 Cacti flow-capture[5659]: remove/2 0 files<br>
> Apr 17 16:03:55 Cacti flow-capture[5659]: remove/1 0 files<br>
> Apr 17 16:03:55 Cacti flow-capture[5659]: remove/2 0 files<br>
> Apr 17 16:03:56 Cacti flow-capture[5659]: remove/1 0 files<br>
> Apr 17 16:03:56 Cacti flow-capture[5659]: remove/2 0 files<br>
><br>
> I am running the NIC in promiscuous mode because I can?t change the
settings on the routers just yet but they?re pointed at another VM on my
machine. Would this not work because it?s not being pointed at flow-tools?
Ok well I just ran it on the machine that all the flows are pointed to
and it?s not creating the flow files<br>
> eth0 Link encap:Ethernet HWaddr 00:0c:29:72:d8:d9<br>
> inet addr:172.19.10.24 Bcast:172.19.10.255
Mask:255.255.255.0<br>
> inet6 addr: fe80::20c:29ff:fe72:d8d9/64
Scope:Link<br>
> UP BROADCAST RUNNING PROMISC MULTICAST
MTU:1500 Metric:1<br>
> RX packets:22694 errors:0 dropped:0
overruns:0 frame:0<br>
> TX packets:1597 errors:0 dropped:0
overruns:0 carrier:0<br>
> collisions:0 txqueuelen:1000<br>
> RX bytes:6293072 (6.2 MB) TX
bytes:201679 (201.6 KB)<br>
> Interrupt:19 Base address:0x2000<br>
><br>
<br>
</font><font size=2><tt>_______________________________________________<br>
Flow-tools mailing list<br>
flow-tools@splintered.net<br>
http://mailman.splintered.net/mailman/listinfo/flow-tools</tt></font>
<br>