Thanks, Dave. It is not case 1, and truss did not help much. I just redid
"make install" as root. And it did the trick. Happy Thanksgiving!
Luong Tang - ltang@splitrock.net
-----Original Message-----
From: Dave Plonka [mailto:plonka@doit.wisc.edu]
Sent: Friday, November 17, 2000 1:33 PM
To: cflowd@caida.org
Cc: Luong Tang
Subject: Re: cflowdmux not collecting data, with no error messages
On Fri, Nov 17, 2000 at 11:08:26AM -0600, Luong Tang wrote:
> I have 2 Solaris 2.6 systems. cflowdmux would work on one but not on the
> other. Not working means just not collecting flows, syslog has no error
> messages, but the same info messages about it getting started properly,
> exactly as on the "good" system. "flowwatch all" also outputs nothing
unlike
> the "good" system. I ftp'ed cflowd.conf from one system to the other, this
> is to say they are identical. I snoop port 2055. Definitely have flow
> traffic from the router to the "bad" system. So obviously there is
something
> different on the 2 systems. Where should I look next.
Are the machines on two different subnets, such that the exporting
Cisco might use a different one of its local interfaces (and therefore
IP addresses) as the source of the flow PDUs? You can check this with
snoop or tcpdump, are the NetFlow packet's source addresses the same
regardless of which cflowd collecter host they are directed to?
Perhaps you have not listed all of the exporting router's IP addresses
in the ADDRESSES directive in the CISCOEXPORTER stanza of the cflowd
configuration file.
Alternatively, have you specify which of the router's interfaces should
be the source? I.e.:
ip flow-export source Loopback0
If not, try that and make sure that your CISCOEXPORTER address matches
the IP of Loopback0.
> I did "ipcs -a", and
> "netstat -an". All looks normal to me, i.e. shared mem got allocated,
> semaphore created, port 2055 opened, again just like on the "good" system.
The other thing you should have in your toolbox is truss(1)...
$ ps -fe |grep '[c]flowdmux' # find process id
...
$ truss -vall -p process_id
That will tell you whether or not cflowdmux is seeing the flow PDUs.
(I.e. is it blocked in select(2), or is it waking up and calling
recv(2)/recvfrom(2)?)
Dave
-- plonka@doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI -- cflowd mailing list cflowd@caida.org -- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Tue Nov 21 2000 - 15:08:13 PST