[prev in list] [next in list] [prev in thread] [next in thread] 

List:       flowscan
Subject:    Re: NaN problems (flow-tools indigestion?)
From:       Mike Hunter <mhunter () ack ! berkeley ! edu>
Date:       2005-07-22 0:25:32
Message-ID: 20050722002532.GB37710 () malcolm ! berkeley ! edu
[Download RAW message or body]

On Jul 22, "Leigh Sharpe" wrote:

> Your flow hit ratio is very small. This would indicate that you probably
> haven't got flowscan configured properly.
> Have a look at your NextHop and ifInIndex directives.

Thanks for your reply.  I did as you suggested (by adding NextHops) and my 
hit ratio went way up.  Thanks!

> bin/flowscan
Loading "bin/local_nets.boulder" ...
2005/07/21 17:09:28 working on file ft-v05.2005-07-21.160001-0700...
2005/07/21 17:12:04 flowscan-1.020 CampusIO: Cflow::find took 156 wallclock secs \
(154.45 usr +  1.39 sys = 155.84 CPU) for 168505112 flow file bytes, flow hit ratio: \
2564354/2632892 2005/07/21 17:12:05 flowscan-1.020 CampusIO: report took  1 wallclock \
secs ( 1.12 usr +  0.02 sys =  1.15 CPU) sleep 30...

Unfortunately I'm still in NaN land...

> rrdtool dump http_dst.rrd | grep -i nan | tail        
                        <!-- 2005-07-11 17:00:00 PDT / 1121126400 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-12 17:00:00 PDT / 1121212800 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-13 17:00:00 PDT / 1121299200 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-14 17:00:00 PDT / 1121385600 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-15 17:00:00 PDT / 1121472000 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-16 17:00:00 PDT / 1121558400 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-17 17:00:00 PDT / 1121644800 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-18 17:00:00 PDT / 1121731200 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-19 17:00:00 PDT / 1121817600 --> <row><v> NaN \
                </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN \
                </v></row>
                        <!-- 2005-07-20 17:00:00 PDT / 1121904000 --> <row><v> NaN \
</v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v><v> NaN </v></row>

> rrdtool dump http_dst.rrd | grep -i -v nan | wc -l
     159
> rrdtool dump http_dst.rrd | grep -i  nan | wc -l
    3887

Turning on verbose didn't help:

> bin/flowscan 
Loading "bin/local_nets.boulder" ...
2005/07/21 17:18:31 working on file ft-v05.2005-07-21.160001-0700...
2005/07/21 17:18:31 %CampusIO::FTPSession -> 0
2005/07/21 17:18:31 %CampusIO::FTPSession -> 0
2005/07/21 17:21:06 flowscan-1.020 CampusIO: Cflow::find took 155 wallclock secs \
(153.87 usr +  1.57 sys = 155.44 CPU) for 168505112 flow file bytes, flow hit ratio: \
2564354/2632892 2005/07/21 17:21:06 scalar(%CampusIO::RealServer) -> 101/256
2005/07/21 17:21:08 flowscan-1.020 CampusIO: report took  2 wallclock secs ( 1.07 usr \
+  0.08 sys =  1.15 CPU) sleep 30...

Thanks for any suggestions!

Mike

--
Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/


[prev in list] [next in list] [prev in thread] [next in thread]