Hello ntop team,
I've been trying to troubleshoot a flow collection issue where an old
version of nprobe was collecting a high flow volume, but collecting from
the same stream of UDP flow packets with a newer version produced
inconsistent flow collection rates. I was getting ready to write up a bug
report, but decided to update to the latest stable nprobe version and try
again first. Now, when I run nprobe the log output is full of lines like
these:
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 28][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 29][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 30][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 25][num: 256]: skipping
I'm not sure I understand what this is telling me. Wild guess: Are there
duplicate IPFIX templates for the same observation domain that nprobe isn't
sure what to do with?
My nprobe command line is like this:
/usr/bin/nprobe --collector-port=2155 --verbose 1 --max-log-lines=100000
--dump-path=/u01/flow/raw/2056 --collector=none --disable-cache
--dump-format=t --dont-nest-dump-dirs --dont-drop-privileges
--smart-udp-frags -V 10
And the version I'm running:
$ nprobe --version
Welcome to nProbe v.9.2.201112 (r6993) for x86_64-pc-linux-gnu
with native PF_RING acceleration.
Copyright 2002-20 ntop.org
Build OS: Ubuntu 20.04.1 LTS
...
Thank you,
Peter
--
Peter Giles | Senior Developer & Data Analyst | Office of the CISO |
University of Washington
I've been trying to troubleshoot a flow collection issue where an old
version of nprobe was collecting a high flow volume, but collecting from
the same stream of UDP flow packets with a newer version produced
inconsistent flow collection rates. I was getting ready to write up a bug
report, but decided to update to the latest stable nprobe version and try
again first. Now, when I run nprobe the log output is full of lines like
these:
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 28][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 29][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 30][num: 256]: skipping
12/Nov/2020 13:50:57 [collect.c:1632] WARNING: Too many templates defined
[bucket_id: 25][num: 256]: skipping
I'm not sure I understand what this is telling me. Wild guess: Are there
duplicate IPFIX templates for the same observation domain that nprobe isn't
sure what to do with?
My nprobe command line is like this:
/usr/bin/nprobe --collector-port=2155 --verbose 1 --max-log-lines=100000
--dump-path=/u01/flow/raw/2056 --collector=none --disable-cache
--dump-format=t --dont-nest-dump-dirs --dont-drop-privileges
--smart-udp-frags -V 10
And the version I'm running:
$ nprobe --version
Welcome to nProbe v.9.2.201112 (r6993) for x86_64-pc-linux-gnu
with native PF_RING acceleration.
Copyright 2002-20 ntop.org
Build OS: Ubuntu 20.04.1 LTS
...
Thank you,
Peter
--
Peter Giles | Senior Developer & Data Analyst | Office of the CISO |
University of Washington