Not getting Data from cflowd

From: Dana Watanabe (dwatanab@uci.edu)
Date: Mon Nov 06 2000 - 14:00:22 PST

  • Next message: Todd Caine: "Re: Not getting Data from cflowd"

    I'm running cflowdmux, cflowd and cfdcollect all on:
    SunOS miles 5.7 Generic sun4u sparc SUNW,Ultra-60

    Running the programs seems to not collect any data. I can run Cisco
    NetFlowCollector and its collects data. And i have cflowd running to
    collect data on the same port. But when i turn of NFC and run cflow, it
    doesn't store anything.

    What i've done/noticed...

    I did the shmsys thing in /etc/system

    When i run the three programs, i get no messages in syslog (if i've made
    an error in cflowd.conf, i get error messages, though)

    There is an arts.YYYYMMDD file that gets created in the dataDirectory,
    but it stays at 0 size.

    The flow files in FLOWDIR get created, but i'm pretty sure are untouched
    and only contain null characters.

    When i run cflowdmux, *.9995 shows up in netstat.
    These lines show up in ipcs:
    m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab oac
     1 1052672 3701 3701 13:28:34 no-entry 13:28:34
    s 65536 0x6cd9 --ra-ra-ra- dwatanab oac dwatanab oac
    2 13:28:51 13:28:34

    When i run cflowd, *.2056 shows up in netstat, along with:

    300019be800 stream-ord 30003ead5b8 00000000 /opt/arts/cflowdtable.socket

    Running ipcs changes the memory entry to:
    m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab oac
     2 1052672 3701 3846 13:31:38 no-entry 13:28:34

    When i run cfdcollect, i get the following in netstat:

    127.0.0.1.32856 127.0.0.1.2056 32768 0 32768 0 ESTABLISHED
    127.0.0.1.2056 127.0.0.1.32856 32768 0 32768 0 ESTABLISHED

    and again the line in ipcs has changed:

    m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab
    oac 2
        1052672 3701 4214 13:31:38 13:44:00 13:28:34

    here's the only weird thing i've noticed... process 4214 doesn't exist.
    3701 is cflowdmux and 3846 is cflowd, but when i went to check 4214 it's
    not there. 65536 seems like an odd ID number too...

    I've tried running it as root, running it not as root and all the same results.

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Mon Nov 06 2000 - 14:15:34 PST