Subject: Re: Not getting all RRD graphs
From: Dave Plonka (plonka@doit.wisc.edu)
Date: Mon Jun 04 2001 - 21:15:04 CDT
On Mon, May 28, 2001 at 07:20:58PM -0500, Adam Maloney wrote: > I ran flowscan against some raw files, and got the output below. The Out > of Memory error is particularly interesting, since this system has 96MB of > RAM plus 260M of swap, and all it's running is BIND. Whoa there... below your log shows: 2001/05/28 10:04:49 working on file xxx.xxx.xxx.xxx.flows.1... flowscan should *not* be processing files with names like that. When used w/cflowd it is only meant to process the time-stamped raw flow files that are produced when you patch and run cflowd as described here: http://net.doit.wisc.edu/~plonka/cflowd/ <snip> > If I run flowscan again, it doesn't update any of the rrd files now in the > graphs directory. > > bash-2.05# ./flowscan > NextHops and OutputIfIndexes are undefined. > Identifying outbound flows based solely on destination address ... > Loading "Napster_subnets.boulder" ... > Loading "local_nets.boulder" ... > 2001/05/28 10:04:49 working on file xxx.xxx.xxx.xxx.flows.1... > 2001/05/28 10:05:07 flowscan-1.020 CampusIO: Cflow::find took 18 wallclock > secs (18.18 usr + 0.04 sys = 18.22 CPU) for 1000000 flow file bytes, flow > hit ratio: 7353/18181 > perl in free(): warning: junk pointer, too high to make sense. It's exhibiting undefined behavior, so don't bother going into more detail. See how things are after you have it processing the flow files with the time stamps in their names, e.g. "flows.20010604_21:09:15-0500". Another hint - generally it isn't necessary to change the "FlowFileGlob" that is shown in the sample ".cf" file that ships with FlowScan: # FlowFileGlob (REQUIRED) # use this glob (file pattern match) when looking for raw flow files to be # processed, e.g.: # FlowFileGlob /var/local/flows/flows.*:*[0-9] FlowFileGlob flows.*:*[0-9] That would have kept flowscan from processing those "xxx.xxx.xxx.xxx.flows.1", etc. files. Dave -- plonka@doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Mon Jun 04 2001 - 21:19:41 CDT