[Cflowd] cflowd core'ing all the time

From: fingers (fingers@fingers.co.za)
Date: Wed Nov 20 2002 - 04:06:45 PST

  • Next message: Derek Fage (lists account): "[Cflowd] Re: [flow-tools] netflow accounting"

    hi there

    i wonder if anyone might have any suggestions for me.

    the box:

    [host] / # uname -a
    SunOS host 5.7 Generic_106541-20 sun4u sparc SUNW,Ultra-Enterprise

    cflowd seems to core constantly. /var/adm/messages doesn't tell me much,
    other than cfdcollect can't connect (connection refused) when cflowd is
    dead (which makes sense).

    the core file starts with:

    <snip>
    CORE
    cflowd
    /usr/local/cflowd/sbin/cflowd -s 300 -O 0 -m
    /usr/local/cflowd/etc/cflowd.conf
    CORE
    SUNW,Ultra-Enterprise
    CORE
    CORE
    CORE
    CORE
    CORE
    cflowd
    /usr/local/cflowd/sbin/cflowd -s 300 -O 0 -m
    /usr/local/cflowd/etc/cflowd.conf
    CORE
    CORE
    SUNW,Ultra-Enterprise
    CORE
    CORE
    CORE
    CORE
    variable, Not Writable
    SNMP: Cannot create variable, Inconsistent Name
    SNMP: Unknown Error Status
    SNMP++: Success
    SNMP++: Operation failed
    SNMP++: Resource unavailable
    SNMP++: Internal error
    SNMP++: Unsupported function
    SNMP++: SNMP request timed out
    SNMP++: Received SNMP Response
    SNMP++: Received SNMP Notification (trap or inform)
    SNMP++: Closing session with outstanding requests
    Unknown error code
    SNMP++: Class not valid
    SNMP++: Invalid Pdu
    SNMP++: Invalid Target
    SNMP++: Invalid (null) Callback Function
    SNMP++: Invalid Request Id
    SNMP++: Invalid Notification Id
    SNMP++: SNMP Operation not supported on specified Target
    SNMP++: Invalid Object Identifier
    SNMP++: Invalid Address
    SNMP++: Agent indicates error in SNMP request
    SNMP++: Transport is not supported
    SNMP++: Transport is in use
    SNMP++: Transport operation failed
    SNMP++: Blocked Mode Shutdown
    snmp message load error !
    4Snmp
    21snmpTrapEnterpriseOid
    12coldStartOid
    12warmStartOid
    11linkDownOid
    9linkUpOid
    24authenticationFailureOid
    18egpNeighborLossOid
    12snmpTrapsOid
    </snip>

    as you can see, it's compiled with the flowscan patch.

    my cflowd.conf looks like this:

    <cflowd.conf>
    OPTIONS {
      LOGFACILITY: local6
      TCPCOLLECTPORT: 2056
      PKTBUFSIZE: 4097152
      TABLESOCKFILE: /usr/local/cflowd/etc/cflowdtable.socket
      FLOWDIR: /data/flows
      FLOWFILELEN: 1000000
      NUMFLOWFILES: 10
      MINLOGMISSED: 1000
    }
    COLLECTOR {
      HOST: 1.1.1.1
      AUTH: none
    }

    CISCOEXPORTER {
      HOST: 1.2.3.4
      ADDRESSES: { 1.2.3.5, 1.2.3.6, 1.2.3.7 }
      CFDATAPORT: 2055
      SNMPCOMM: 'mysnmpcomm'
      LOCALAS: 1234
      COLLECT: { protocol, portmatrix, ifmatrix, nexthop, netmatrix,
                      asmatrix, flows }
    }
    </cflowd.conf>

    my cfdcollect.conf looks like this:

    <cfdcollect.conf>
    system {
      logFacility: local6
      dataDirectory: /data/flows/arts
      filePrefix: arts
      pidFile: /usr/local/cflowd/etc/cfdcollect.pid
    }

    cflowd {
      host: 1.1.1.1
      tcpCollectPort: 2056
      minPollInterval: 300
    }
    </cfdcollect.conf>

    there are about 4 exporters. I've checked and double-checked that the
    snmpcomm is correct. I've checked acl's and see matches on the acl bound
    to the snmp-server on the router (cisco 7200's / 7500's).

    any suggestions would be appreciated.

    Regards

    --Rob

    _______________________________________________
    Cflowd mailing list
    Cflowd@caida.org
    http://login.caida.org/mailman/listinfo/cflowd

    This archive was generated by hypermail 2.1.4 : Wed Nov 20 2002 - 04:19:48 PST