Flowview not showing any data

[philipz]

I have installed the flowview plugin today. I am receiving flows already since a while. This is for today:

Code: Select all

/tmp/2011/2011-11/2011-11-01]# ls -l
...
-rw-r--r--  1 root  wheel   4708 Nov  1 22:23 ft-v05.2011-11-01.222201+0100
-rw-r--r--  1 root  wheel   3620 Nov  1 22:24 ft-v05.2011-11-01.222301+0100
-rw-r--r--  1 root  wheel   3044 Nov  1 22:25 ft-v05.2011-11-01.222401+0100
-rw-r--r--  1 root  wheel   5284 Nov  1 22:26 ft-v05.2011-11-01.222501+0100
-rw-r--r--  1 root  wheel   3428 Nov  1 22:27 ft-v05.2011-11-01.222601+0100
-rw-r--r--  1 root  wheel   2084 Nov  1 22:28 ft-v05.2011-11-01.222730+0100
-rw-r--r--  1 root  wheel   2916 Nov  1 22:29 ft-v05.2011-11-01.222801+0100
-rw-r--r--  1 root  wheel   2788 Nov  1 22:30 ft-v05.2011-11-01.222901+0100

The flow-capture start works as well:

Code: Select all

/tmp/2011/2011-11/2011-11-01]# /etc/rc.d/flow-capture start
NOTE: Starting Flow Tools
NOTE: Launching flow-capture as '/usr/local/bin/flow-capture -S5 -V5 -z 0 -n 1439 -e 2880 -N 3 -w /tmp/ 0/0/9991'

(note the / behind /temp -> this is not in the cacti config)

This is my listener config:

Code: Select all

Name** 	Directory 	Nesting 	                 Allowed From 	     Port 	    Version 	          Compression 	      Rotation 	Expire
test 		            /YYYY/YYYY-MM/YYYY-MM-DD 	0 	                9991 	    NetFlow version 5 	0 	                1 Minute 	2 Days

The "Directory" is empty as the nesting is directly in the /flows directory (e.g. /tmp/2011/2011-11/2011-11-01)
The "Flow Tools Work Directory" and "Flow Directory" are both set to /tmp

Still I don't see any result or any flow. Anyone an idea what is wrong? I don't think it is a rights issue as that has been sorted.

Thanks!

- Phil

[TheWitness]

Go into Console->Settings->Misc and make sure the "Flows Directory" is set to /tmp.

TheWitness

[philipz]

Go into Console->Settings->Misc and make sure the "Flows Directory" is set to /tmp.

TheWitness

That is the case already (for both Work Directory & Flows Directory)
Is there a log entry created or could I debug via the logfile?

- Phil

[philipz]

I changed the Listener Directory to 2011 and changed the nesting to /YYYY-MM/YYYY-MM-DD
Then it worked, which is pretty strange as the outcome should be the same.
Could it be that the Listener Directory cannot be empty?

- Phil

[TheWitness]

Well, I would have to do more comprehensive testing. This code is a legacy from the early plugin and was 'assumed' to be functional. Full regression did not take place. The only test that took place was for the default heirarchy. Since the flow-capture is responsible for directory creation, it may be a problem with it. However, first guess is PEBKAC.

TheWitness

[marijonas]

Hi,

I'm having the same issue and couldn't make it work (fedora 13, cacti 0.8.6g, flowview v1.1, PA 2.9).
So, the files are being written into a /tmp/2011/YYYY-MM/YYYY-MM-DD directory.

flowcapture -restart displays, that it's using very same directory mentioned above and I see files are being writtent there every minute.

Both settings ("Flow Tools Work Directory" and "Flow Directory") in Misc configuration points to /tmp
Listener config under the "Flow" tab has "Listener Directory" set to "2011" and "Nesting" set to "YYYY-MM/YYYY-MM-DD"

Another thing I recognized (not sure how much may be related to this)), that my "filters" tab has only three buttons "View", "Defaults" and "Save", while like in youtube I can see guy has more buttons like "Save as" and so on.

In a screenshots bellow, you will see my configuration while I had the path set to /var/netflow/flows/completed and "cacti_server" for particular listener and had same results - files are being copied over into a directory, but no graphs.

[marijonas]

By the way, I tried to dump flow data from files, which were generated and appears, that files are empty: there is no data, and only column names.
So, my assumption is that either equipment sends empty flow files, or some misconfiguration in flow capture processes.

[TheWitness]

Is the flow capture running? Have you replace the default init.d script with the one provided? Have you setup the root patch in Console->Settings->Misc?

TheWitness

[marijonas]

Hi,

Thanks for a reply.

Is the flow capture running? Have you replace the default init.d script with the one provided? Have you setup the root patch in Console->Settings->Misc?

Yes - the flow capture is running. At least ps - ef shows the process running with the correct folder name and other parameters in it
Yes, I have placed provided flow-capture script under init.d directory, where only thing I have modified - provided the current path $cacti_base variable.
Not sure if completely- only thing I have modified in "Misc" section is directory paths binary (/usr/bin), tools (/tmp) and Flow directory (/tmp).

[TheWitness]

You should see something like this in your process status

Code: Select all

nobody    2846     1  0 May07 ?        01:29:43 /usr/sbin/softflowd -i eth1 -n 127.0.0.1:9995
root      3450     1  0 May07 ?        00:42:13 /usr/bin//flow-capture -w /var/flow/NewLink 0/0/9995 -S5 -V5 -z 0 -n 1439 -e 2880 -N -1

The softflowd is an collector for Linux.

[marijonas]

Hi,

I made it work. Not sure, whether restart helped, or just a fact, that we were running insuficient amount of data, but flow files has started to fill up and now I'm able to see reports.
Thanks for your suggestions and helping out.

Another questions is that I'm not sure if I do right trying to save new queries, but I'm not able to save any so far and only what I see on "Saved queries" is "None". Whatever changes I tried to make on report configuration window, I wasn't able to get an option "Save As" for new report.
Any help would be very appreciated.

[TheWitness]

Use firefox and install 'firebug'. Then watch the little bug and see if when you load that page you get little ascending number (javascript errors). If you do, then you'll have to open the firebug window and goto it's console and perform a screen capture of what you find and attach it here.

TheWitness

[vesparossa]

Hi guys,

thanks to this thread I fix out my Flowview issues. I do support marijonas thesis: in order to get the FlowView plugin show me some data, I had to change the flow directory to /tmp (same path of the working directory). Btw nasting is working correctly.


Let me know if you need some debug output.

BR
Andrea