0 Length Raw Files

From: Healy, Terence D (thealy@bnl.gov)
Date: Thu Nov 08 2001 - 11:27:00 PST

  • Next message: Robert Passlow: "Cflowd and Incoming traffic."

    I have spent the last several hours looking through the archives and trying
    most anything that anyone suggested for the problem of zero-length raw
    files. There are a number of threads but none of the few suggestions worked
    for me.

    Running Debian Linux with 2.2.19 Kernel

     I have verified that the packets [Version 5 from Cisco 6509] are entering
    the machine at port 2055 as per tcpdump:

    14:23:33.550564 xxx.yyy.1093 > flow.itd.bnl.gov.2055: udp 1428
    14:23:33.556386 xxx.yyy.1093 > flow.itd.bnl.gov.2055: udp 1428
    14:23:41.546004 xxx.yyy.1093 > flow.itd.bnl.gov.2055: udp 1428

    I'm currently starting with:

    #!/bin/sh
    cd /flow
    ./cflowdmux
    #./cfdcollect cfdcollect.conf
    ./cflowd -s 60 -O 0 -m cflowd.conf
    #/usr/local/arts/sbin/cfdcollect /usr/local/arts/etc/cfdcollect.conf

    Nov 8 13:42:42 flow cflowdmux[28515]: [I] cflowdmux (version cflowd-2-1-b1)
    started.
    Nov 8 13:42:42 flow cflowdmux[28515]: [I] created 2101248 byte packet queue
    shmem segment {CflowdPacketQueue.cc:247}
    Nov 8 13:42:42 flow cflowdmux[28515]: [I] attached to 2101248 byte packet
    queue at 0x401c0000
    Nov 8 13:42:42 flow cflowdmux[28515]: [I] created semaphore: id 0
    Nov 8 13:42:42 flow cflowdmux[28515]: [I] set UDP recv queue to 261040
    bytes for fd 4 (port 2055)
    Nov 8 13:42:42 flow cflowd[28517]: [I] cflowd (version cflowd-2-1-b1)
    started.
    Nov 8 13:42:42 flow cflowd[28517]: [I] got semaphore: id 0
    Nov 8 13:42:42 flow cflowd[28517]: [I] attached to 2101248 byte packet
    queue at 0x40594000

    (I edited the config files to run every 60 secs to check changed more
    quickly.)

    I have reinstalled, recompiled, dump log errors, and tried every config that
    people have recommended. While I'm sure I'm doing something stupid at a very
    basic level, I can't isolate it.

    Any suggestions greatly appreciated.

    Terry

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Thu Nov 08 2001 - 11:52:05 PST