RE: cflowdmux not collecting data, with no error messages

From: Luong Tang (LTang@splitrock.net)
Date: Tue Nov 21 2000 - 14:50:02 PST

  • Next message: Luong Tang: "RE: cflowdmux not collecting data, with no error messages"

    Thanks, Dave. It is not case 1, and truss did not help much. I just redid
    "make install" as root. And it did the trick. Happy Thanksgiving!

    Luong Tang - ltang@splitrock.net

    -----Original Message-----
    From: Dave Plonka [mailto:plonka@doit.wisc.edu]
    Sent: Friday, November 17, 2000 1:33 PM
    To: cflowd@caida.org
    Cc: Luong Tang
    Subject: Re: cflowdmux not collecting data, with no error messages

    On Fri, Nov 17, 2000 at 11:08:26AM -0600, Luong Tang wrote:
    > I have 2 Solaris 2.6 systems. cflowdmux would work on one but not on the
    > other. Not working means just not collecting flows, syslog has no error
    > messages, but the same info messages about it getting started properly,
    > exactly as on the "good" system. "flowwatch all" also outputs nothing
    unlike
    > the "good" system. I ftp'ed cflowd.conf from one system to the other, this
    > is to say they are identical. I snoop port 2055. Definitely have flow
    > traffic from the router to the "bad" system. So obviously there is
    something
    > different on the 2 systems. Where should I look next.

    Are the machines on two different subnets, such that the exporting
    Cisco might use a different one of its local interfaces (and therefore
    IP addresses) as the source of the flow PDUs? You can check this with
    snoop or tcpdump, are the NetFlow packet's source addresses the same
    regardless of which cflowd collecter host they are directed to?

    Perhaps you have not listed all of the exporting router's IP addresses
    in the ADDRESSES directive in the CISCOEXPORTER stanza of the cflowd
    configuration file.

    Alternatively, have you specify which of the router's interfaces should
    be the source? I.e.:

       ip flow-export source Loopback0

    If not, try that and make sure that your CISCOEXPORTER address matches
    the IP of Loopback0.

    > I did "ipcs -a", and
    > "netstat -an". All looks normal to me, i.e. shared mem got allocated,
    > semaphore created, port 2055 opened, again just like on the "good" system.

    The other thing you should have in your toolbox is truss(1)...

       $ ps -fe |grep '[c]flowdmux' # find process id
       ...
       $ truss -vall -p process_id

    That will tell you whether or not cflowdmux is seeing the flow PDUs.
    (I.e. is it blocked in select(2), or is it waking up and calling
    recv(2)/recvfrom(2)?)

    Dave

    -- 
    plonka@doit.wisc.edu  http://net.doit.wisc.edu/~plonka  ARS:N9HZF  Madison,
    WI
    --
    cflowd mailing list
    cflowd@caida.org
    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Tue Nov 21 2000 - 15:08:13 PST