[flow-tools] problems with expire

[Michael Redinger]

I found that flow-capture correctly cleans up its directory on startup.
But then it somehow stops.

Below you find how I run flow-capture. Maybe there's a problem with the 
rotate script and flow-capture doesn't like it that I tag the flow files
in the directory they were created in?


/usr/local/bin/flow-capture -S 5 -V 5 -E 8G -N 0 -n 95 -p  \
/var/run/flow-capture.pid -w /var/local/netflow/flow-capture/ \
-R /usr/local/sbin/capture-post 127.0.0.1/127.0.0.1/9801


rotate script:
/usr/local/bin/flow-tag -t /usr/local/netflow/var/cfg/xlates -TUIBK \
	< $1 > ${1}.tmp && mv ${1}.tmp ${1}
/usr/local/bin/flow-report -s /usr/local/netflow/var/cfg/reports -Sall < $1



Michael



On Wed, 11 Dec 2002, Michael Redinger wrote:

> On Sun, 8 Dec 2002, Mark Fullmer wrote:
> 
> > Flow-capture needs to "own" its work directory.  Running flow-expire
> > in the same dir will cause the type of problem you ran into.
> > 
> > I'm not aware of any problems with flow-capture expiring files.
> > 
> > What does du -s -k /var/local/netflow/flow-capture show?
> 
> Currenty it's 10794608 (so approx. 10G). (One flow file is about 20 MB 
> here).
> 
> Michael
> 
> > On Sat, Dec 07, 2002 at 07:05:16PM +0100, Michael Redinger wrote:
> > > 
> > > Hello,
> > > 
> > > is there a bug in flow-capture that prevents it from expiring old flow 
> > > files? This doesn't work for me.
> > > 
> > > I also tried to run flow-expire directly, but that's even worse: it 
> > > deletes the temporary flow file (tmp-...). This even kills flow-capture then.
> > > 
> > > Here's how I run the two programs:
> > > 
> > > /usr/local/bin/flow-capture -S 5 -V 5 -E 8G -N 0 -n 95 -p \
> > > 	/var/run/flow-capture.pid -w /var/local/netflow/flow-capture/ \
> > > 	-R /usr/local/sbin/capture-post 127.0.0.1/127.0.0.1/9801
> > > 
> > > /usr/local/bin/flow-expire -E 8G -w /var/local/netflow/flow-capture/
> > > 
> > > 
> > > Thanks,
> > > 
> > > Michael
> > > 
> > > 
> > > 
> > > 
> > > 
> > > _______________________________________________
> > > flow-tools@splintered.net
> > > http://www.splintered.net/sw/flow-tools
> > 
> > _______________________________________________
> > flow-tools@splintered.net
> > http://www.splintered.net/sw/flow-tools
> > 
> > 
> 
> 
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools
> 
>