First of all, get syslog working. Use logger(1) to make sure you can receive
syslog messages,
try:
/usr/bin/logger -p local6.debug "This is a test"
Send a sighup to syslogd as root,
try:
sudo kill -1 `ps -ef | grep /usr/sbin/syslogd | awk '{ print $2 }'`
If you can't get it to work then try stopping and restarting syslogd via your rc
scripts under /etc/rc#.d/,
try:
sudo /etc/rc#.d/S##syslogd stop; sudo /etc/rc#.d/S##syslogd start
Now try logger again. Once you get syslog messages working for local6.* or
whatever syslog facility you have configured cflowd to use, then try running them
again and use the archive to troubleshoot.
Regards,
Todd Caine
Dana Watanabe wrote:
> I'm running cflowdmux, cflowd and cfdcollect all on:
> SunOS miles 5.7 Generic sun4u sparc SUNW,Ultra-60
>
> Running the programs seems to not collect any data. I can run Cisco
> NetFlowCollector and its collects data. And i have cflowd running to
> collect data on the same port. But when i turn of NFC and run cflow, it
> doesn't store anything.
>
> What i've done/noticed...
>
> I did the shmsys thing in /etc/system
>
> When i run the three programs, i get no messages in syslog (if i've made
> an error in cflowd.conf, i get error messages, though)
>
> There is an arts.YYYYMMDD file that gets created in the dataDirectory,
> but it stays at 0 size.
>
> The flow files in FLOWDIR get created, but i'm pretty sure are untouched
> and only contain null characters.
>
> When i run cflowdmux, *.9995 shows up in netstat.
> These lines show up in ipcs:
> m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab oac
> 1 1052672 3701 3701 13:28:34 no-entry 13:28:34
> s 65536 0x6cd9 --ra-ra-ra- dwatanab oac dwatanab oac
> 2 13:28:51 13:28:34
>
> When i run cflowd, *.2056 shows up in netstat, along with:
>
> 300019be800 stream-ord 30003ead5b8 00000000 /opt/arts/cflowdtable.socket
>
> Running ipcs changes the memory entry to:
> m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab oac
> 2 1052672 3701 3846 13:31:38 no-entry 13:28:34
>
> When i run cfdcollect, i get the following in netstat:
>
> 127.0.0.1.32856 127.0.0.1.2056 32768 0 32768 0 ESTABLISHED
> 127.0.0.1.2056 127.0.0.1.32856 32768 0 32768 0 ESTABLISHED
>
> and again the line in ipcs has changed:
>
> m 101 0x6cd9 --rw-r--r-- dwatanab oac dwatanab
> oac 2
> 1052672 3701 4214 13:31:38 13:44:00 13:28:34
>
> here's the only weird thing i've noticed... process 4214 doesn't exist.
> 3701 is cflowdmux and 3846 is cflowd, but when i went to check 4214 it's
> not there. 65536 seems like an odd ID number too...
>
> I've tried running it as root, running it not as root and all the same results.
> --
> cflowd mailing list
> cflowd@caida.org
-- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Mon Nov 06 2000 - 15:41:53 PST