Kiss Gabor (Bitman | 1 Sep 2008 11:04
Picon

Re: RRDoffset

Hi Rolf,

> just recently there was the thread 'rrdtool 1.3' which
> solves your problem, including a patch (by Vincent Hoffman):
> 
> --snip--
> 
> --- NfSenRRD.pm.orig    2008-08-05 10:49:34.000000000 +0100
> +++ NfSenRRD.pm 2008-08-05 10:50:13.000000000 +0100
>  <at>  <at>  -73,7 +73,7  <at>  <at> 
>         if ( $rrd_version < 1.1 ) { # it's RRD 1.0.x
>                 $RRDoffset = 77;
>         }
> -       if ( $rrd_version >= 1.2 && $rrd_version < 1.3 ) {
> +       if ( $rrd_version >= 1.2 && $rrd_version <= 1.3 ) {
>                 $RRDoffset = 67;
>         }
> -------------------------------------------------------------------------
> 
> only tested on FreeBSD 7/rrdtool 1.3.0 /nfsen 1.3/nfdump-1.5.7

Thanks for your help.
Actually I had to write "$rrd_version < 1.31" because
I have already 1.3001 version of rrdlib.

> And regarding offset, just quoting Peter:
> 
> "Do no forget to set an appropriate pixel offset, which is the number
> is pixels from the left edge of the picture to the y-axis of the grid.
> You may start with the same value as for 1.2 which can be tuned, if
(Continue reading)

Donnelly, Michael (OFT | 2 Sep 2008 17:28
Picon

Alert Examples To Share?

I was wondering if anyone has any creative or interesting alerts

   they would be willing to share with the list ?

This e-mail, including any attachments, may be confidential, privileged or otherwise legally protected. It is intended only for the addressee. If you received this e-mail in error or from someone who was not authorized to send it to you, do not disseminate, copy or otherwise use this e-mail or its attachments.  Please notify the sender immediately by reply e-mail and delete the e-mail from your system.



-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
Bruno Thomas | 2 Sep 2008 22:48

Starting nfsen

Hello,

Good evening everyone as this is my first post. :-D

I have installed all the prerequisites for Nfsen, installed nfsen.conf, I am
able to receive netflows (at least confirmed for v5),  but when I run
./nfsen start, I get the following:

bash-3.2# ./nfsen start
Starting nfcapd: upstream1[5341] peer1[5344].
Starting nfsendUse of uninitialized value in concatenation (.) or string at
/data/nfsen/bin/nfsend line 90.
Use of uninitialized value in string ne at /data/nfsen/bin/nfsend line 91.
setrgid() not implemented at /data/nfsen/libexec/NfSen.pm line 296.
.
bash-3.2# ./nfsen stop
Shutdown nfcapd: upstream1:[5341]. peer1:[5344]..
Shutdown nfsend:[no pid file found!]
bash-3.2# 

Anyone has seen this?

I am running:
Macos X 10.5

Thanks in advance

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
Alexis Letessier | 3 Sep 2008 12:00
Picon
Gravatar

Nfsen profiles and channels creation via command line

Hello,

Is it possible to create profiles and channels via the command line?

We have profiles with more than 30 channels and would like to automate their creation.

Regards,

Alexis
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
Jose Manuel Agudo Cuesta | 4 Sep 2008 11:37
Picon
Favicon

Re: Alert Examples To Share?

We have a very simple alert for SSH Scans:

Filter: dst port 22
Conditions based on total flow summary:  Total flows > 500

Can be improved but works ;-).

El Tuesday 02 September 2008 17:28:00 Donnelly, Michael (OFT) escribió:
> I was wondering if anyone has any creative or interesting alerts
>
>    they would be willing to share with the list ?
> --------------------------------------------------------
> This e-mail, including any attachments, may be confidential, privileged or
> otherwise legally protected. It is intended only for the addressee. If you
> received this e-mail in error or from someone who was not authorized to
> send it to you, do not disseminate, copy or otherwise use this e-mail or
> its attachments.  Please notify the sender immediately by reply e-mail and
> delete the e-mail from your system.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
Werner Schram | 4 Sep 2008 11:39
Picon
Picon

Re: Nfsen profiles and channels creation via command line


Alexis Letessier wrote:
| Hello,
|
| Is it possible to create profiles and channels via the command line?
|
| We have profiles with more than 30 channels and would like to automate
| their creation.
|
| Regards,
|
| Alexis

Hi Alexis,

Yes, that is possible. We synchronize a list of profiles with an
external database on daily basis, without problems. If you type "nfsen
--help" you'll get all the information you need to create, modify and
delete channels.

Regards,

Werner
Donnelly, Michael (OFT | 4 Sep 2008 13:26
Picon

Re: Alert Examples To Share?

We set up an “ISP Drop”  alert for each of our four ISP routers.. This alert tells us that theres

 been a drastic drop in traffic on a particular ISP , indicating a possible BGP/routing protocol

 issue.

 

    Bits/s   <    %90    30 minute average   .

 

                     MPDonnelly

 

 

From: nfsen-discuss-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org [mailto:nfsen-discuss-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] On Behalf Of Donnelly, Michael (OFT)
Sent: Tuesday, September 02, 2008 11:28 AM
To: nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
Subject: [Nfsen-discuss] Alert Examples To Share?

 

I was wondering if anyone has any creative or interesting alerts

   they would be willing to share with the list ?

This e-mail, including any attachments, may be confidential, privileged or otherwise legally protected. It is intended only for the addressee. If you received this e-mail in error or from someone who was not authorized to send it to you, do not disseminate, copy or otherwise use this e-mail or its attachments.  Please notify the sender immediately by reply e-mail and delete the e-mail from your system.

 

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
Brown, Robin | 7 Sep 2008 19:48
Picon
Favicon

Re: nfprofile takes more than 5 min to complete

This is not working for us, it seems to spawn hundreds of nfsend and
nfprofile processes and logs these to syslog:

Sep  7 13:35:41 munchies nfsen[21090]: 348 channels/alerts to profile
Sep  7 13:35:45 munchies nfsen[21090]: nfprofile failed: Too many open
files
Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
string ne at /var/local/nfsen/bin/nfsend line 303.
Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
print at /var/local/nfsen/bin/nfsend line 304.
Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
concatenation (.) or string at /var/local/nfsen/bin
/nfsend line 305.

Using nfsen-1.3b-20070720 and we're exceeding the 5 minute run time,
this would help a lot if we could get it to work.

-Robin

-----Original Message-----
From: nfsen-discuss-bounces@...
[mailto:nfsen-discuss-bounces@...] On Behalf Of Werner
Schram
Sent: Wednesday, August 13, 2008 8:27 AM
To: dirkjan@...
Cc: nfsen-discuss@...
Subject: Re: [Nfsen-discuss] nfprofile takes more than 5 min to complete

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Dirk-Jan,

Dirk-Jan van Helmond wrote:
| The nfprofile process takes more than 5 minutes to complete.
| I have 20 profiles, and about 90G/sec of data to be graphed.
|
| The machine used is a quad-core Xeon 2.4G, with 2GB of memory.
|
|
| Is there any possible way to increase the performance of nfprofile?

We also had this problem. I solved it by patching nfsen to run multiple
instances of nfprofile parallel. It is a simple patch as nfprofile can
actually run in parallel very well by design. I actually promised to
submit this patch on several occasions, but I never got to it. I posted
it in the patches section of the nfsen project on sourceforge:

https://sourceforge.net/tracker/index.php?func=detail&aid=2049518&group_
id=134525&atid=730182

If you apply this patch, you can add a $PROFILERS=x variable in your
nfsen.conf, where you can set x to the amount of nfprofile processes you
want to use. We keep this number at least one below the number of
available cores, because this allows the OS to take control of the
remaining one to process the IO. We haven't tested if this is actually
necessary, as this gives us enough processing time either way.

regards,
Werner Schram
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkii0xgACgkQ3ULkMS4OADnsQgCfZZ8Io/3fMpNZ8GTXALSbFYLj
rAMAoLjpus+s1kuw5gkeNfPkGxElcOko
=1qqq
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
-
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge Build the coolest Linux based applications with Moblin SDK &
win great prizes Grand prize is a trip for two to an Open Source event
anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
Werner Schram | 8 Sep 2008 11:16
Picon
Picon

Re: nfprofile takes more than 5 min to complete


Brown, Robin wrote:
| This is not working for us, it seems to spawn hundreds of nfsend and
| nfprofile processes and logs these to syslog:
|
| Sep  7 13:35:41 munchies nfsen[21090]: 348 channels/alerts to profile
| Sep  7 13:35:45 munchies nfsen[21090]: nfprofile failed: Too many open
| files
| Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
| string ne at /var/local/nfsen/bin/nfsend line 303.
| Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
| print at /var/local/nfsen/bin/nfsend line 304.
| Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized value in
| concatenation (.) or string at /var/local/nfsen/bin
| /nfsend line 305.
|
| Using nfsen-1.3b-20070720 and we're exceeding the 5 minute run time,
| this would help a lot if we could get it to work.
|
| -Robin

Hi Robin,

The reason for the amount of processes is most likely because your
system still doesn't have enough resources to run the periodic updates
in time. What you should start with is looking at how long it actually
takes for the periodic updates to complete. In your debug log, you can
see when the profiling stages starts and ends, and when the plugin stage
starts and ends. Another important thing to look at if the bottleneck is
either your cpu capacity or harddisk throughput. I am not an expert in
assessing the performance of a system, but the amount of processing time
going to user and to the system could give some pointers. Possible ways
of speeding things are:

Do not set the $PROFILERS variable higher than the number of available
processing cores. All instances of nfprofile run independently, so they
all read the complete live profile separately. So it only makes sense to
run multiple instances of nfprofile if they don't have to fight each
other for processing time.
Use compression. Peter has told me that there are reports of increased
performance when using compression. This is likely because compression
moves the strain from your storage hardware to your cpu.
Use a ramdisk (tmpfs in linux or freebsd 7). If you are not actively
using your live profile, you could consider moving it to a tmpfs
partition, this decreases the load on your storage hardware during the
profiling stage and a tmpfs partition has a considerably higher
throughput. But at the cost of having a very short and non-persistent
live profile.
Reconsider the used plugins. If the bottleneck is the plugin phase,
you could consider disabling some of them or look into ways of
increasing their performance.
Upgrade your harddisks. If the bottleneck is your harddisk troughput,
this can help solving your problem.
Upgrade your cpu hardware. see above.
Consider moving part of your profiles to another machine. If
everything fails, just buy more hardware :)

I hope this helps.

Regards,
Werner

|
|
|
| -----Original Message-----
| From: nfsen-discuss-bounces@...
| [mailto:nfsen-discuss-bounces@...] On Behalf
Of Werner
| Schram
| Sent: Wednesday, August 13, 2008 8:27 AM
| To: dirkjan@...
| Cc: nfsen-discuss@...
| Subject: Re: [Nfsen-discuss] nfprofile takes more than 5 min to complete
|
| Hi Dirk-Jan,
|
| Dirk-Jan van Helmond wrote:
| | The nfprofile process takes more than 5 minutes to complete.
| | I have 20 profiles, and about 90G/sec of data to be graphed.
| |
| | The machine used is a quad-core Xeon 2.4G, with 2GB of memory.
| |
| |
| | Is there any possible way to increase the performance of nfprofile?
|
| We also had this problem. I solved it by patching nfsen to run multiple
| instances of nfprofile parallel. It is a simple patch as nfprofile can
| actually run in parallel very well by design. I actually promised to
| submit this patch on several occasions, but I never got to it. I posted
| it in the patches section of the nfsen project on sourceforge:
|
| https://sourceforge.net/tracker/index.php?func=detail&aid=2049518&group_
| id=134525&atid=730182
|
| If you apply this patch, you can add a $PROFILERS=x variable in your
| nfsen.conf, where you can set x to the amount of nfprofile processes you
| want to use. We keep this number at least one below the number of
| available cores, because this allows the OS to take control of the
| remaining one to process the IO. We haven't tested if this is actually
| necessary, as this gives us enough processing time either way.
|
| regards,
| Werner Schram

------------------------------------------------------------------------
-
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge Build the coolest Linux based applications with Moblin SDK &
win great prizes Grand prize is a trip for two to an Open Source event
anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

Brown, Robin | 9 Sep 2008 02:28
Picon
Favicon

Re: nfprofile takes more than 5 min to complete


> -----Original Message-----
> From: Werner Schram [mailto:Werner.Schram@...] 
> Sent: Monday, September 08, 2008 5:17 AM
> To: Brown, Robin
> Cc: dirkjan@...; nfsen-discuss@...
> Subject: Re: [Nfsen-discuss] nfprofile takes more than 5 min 
> to complete
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Brown, Robin wrote:
> | This is not working for us, it seems to spawn hundreds of 
> nfsend and 
> | nfprofile processes and logs these to syslog:
> |
> | Sep  7 13:35:41 munchies nfsen[21090]: 348 channels/alerts 
> to profile 
> | Sep  7 13:35:45 munchies nfsen[21090]: nfprofile failed: 
> Too many open 
> | files Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized 
> | value in string ne at /var/local/nfsen/bin/nfsend line 303.
> | Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized 
> value in 
> | print at /var/local/nfsen/bin/nfsend line 304.
> | Sep  7 13:35:45 munchies nfsen[23128]: Use of uninitialized 
> value in 
> | concatenation (.) or string at /var/local/nfsen/bin /nfsend 
> line 305.
> |
> | Using nfsen-1.3b-20070720 and we're exceeding the 5 minute 
> run time, 
> | this would help a lot if we could get it to work.
> |
> | -Robin
> 
> Hi Robin,
> 
> The reason for the amount of processes is most likely because 
> your system still doesn't have enough resources to run the 
> periodic updates in time. What you should start with is 
> looking at how long it actually takes for the periodic 
> updates to complete. In your debug log, you can see when the 
> profiling stages starts and ends, and when the plugin stage 
> starts and ends. Another important thing to look at if the 
> bottleneck is either your cpu capacity or harddisk 
> throughput. I am not an expert in assessing the performance 
> of a system, but the amount of processing time going to user 
> and to the system could give some pointers. Possible ways of 
> speeding things are:
> 
> - - Do not set the $PROFILERS variable higher than the number 
> of available processing cores. All instances of nfprofile run 
> independently, so they all read the complete live profile 
> separately. So it only makes sense to run multiple instances 
> of nfprofile if they don't have to fight each other for 
> processing time.
> - - Use compression. Peter has told me that there are reports 
> of increased performance when using compression. This is 
> likely because compression moves the strain from your storage 
> hardware to your cpu.
> - - Use a ramdisk (tmpfs in linux or freebsd 7). If you are 
> not actively using your live profile, you could consider 
> moving it to a tmpfs partition, this decreases the load on 
> your storage hardware during the profiling stage and a tmpfs 
> partition has a considerably higher throughput. But at the 
> cost of having a very short and non-persistent live profile.
> - - Reconsider the used plugins. If the bottleneck is the 
> plugin phase, you could consider disabling some of them or 
> look into ways of increasing their performance.
> - - Upgrade your harddisks. If the bottleneck is your 
> harddisk troughput, this can help solving your problem.
> - - Upgrade your cpu hardware. see above.
> - - Consider moving part of your profiles to another machine. 
> If everything fails, just buy more hardware :)
> 
> I hope this helps.
> 
> Regards,
> Werner
> 

Thanks Werner, compression did not help.  I'll try deleting some
profiles next.  Then if I can get this in under 5 minutes I'll try the
patch once more to see if it spawns over 1000 processes again.

But should I be getting the 'Use of uninitialized value' errors in
syslog when the patch is applied?

-Robin

> 
> |
> |
> |
> | -----Original Message-----
> | From: nfsen-discuss-bounces@...
> | [mailto:nfsen-discuss-bounces@...] On Behalf
Of 
> | Werner Schram
> | Sent: Wednesday, August 13, 2008 8:27 AM
> | To: dirkjan@...
> | Cc: nfsen-discuss@...
> | Subject: Re: [Nfsen-discuss] nfprofile takes more than 5 min to 
> | complete
> |
> | Hi Dirk-Jan,
> |
> | Dirk-Jan van Helmond wrote:
> | | The nfprofile process takes more than 5 minutes to complete.
> | | I have 20 profiles, and about 90G/sec of data to be graphed.
> | |
> | | The machine used is a quad-core Xeon 2.4G, with 2GB of memory.
> | |
> | |
> | | Is there any possible way to increase the performance of 
> nfprofile?
> |
> | We also had this problem. I solved it by patching nfsen to run 
> | multiple instances of nfprofile parallel. It is a simple patch as 
> | nfprofile can actually run in parallel very well by design. 
> I actually 
> | promised to submit this patch on several occasions, but I 
> never got to 
> | it. I posted it in the patches section of the nfsen project 
> on sourceforge:
> |
> | 
> https://sourceforge.net/tracker/index.php?func=detail&aid=2049518&grou
> | p_
> | id=134525&atid=730182
> |
> | If you apply this patch, you can add a $PROFILERS=x 
> variable in your 
> | nfsen.conf, where you can set x to the amount of nfprofile 
> processes 
> | you want to use. We keep this number at least one below the 
> number of 
> | available cores, because this allows the OS to take control of the 
> | remaining one to process the IO. We haven't tested if this 
> is actually 
> | necessary, as this gives us enough processing time either way.
> |
> | regards,
> | Werner Schram
> 
> - 
> --------------------------------------------------------------
> ----------
> - -
> This SF.Net email is sponsored by the Moblin Your Move 
> Developer's challenge Build the coolest Linux based 
> applications with Moblin SDK & win great prizes Grand prize 
> is a trip for two to an Open Source event anywhere in the 
> world http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@...
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.9 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAkjE7XkACgkQ3ULkMS4OADnlGgCfclPweV2uBKc+Ypk/n3pMf1zo
> fy4AoKExd/hMMghVelF6/ZHcfrfLGEdq
> =0XrQ
> -----END PGP SIGNATURE-----
> 

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/

Gmane