Announcement

Collapse
No announcement yet.

NetFlow no longer working

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • NetFlow no longer working

    I am on 4.7.1.7
    Netflow data used to come up under Logging > Netflow. I havent checked in a while but today i checked and see no results.
    I can confirm Flow data is showing up on the server itself by running tcpdump. Any ideas?


    tcpdump -i eth0 | grep 2055
    tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
    listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
    20:09:29.581140 IP atl-fw1-inet.moore.lan.10305 > nxfilter-192-168-3-60.moore.lan.2055: UDP, length 1464
    20:09:29.581203 IP atl-fw1-inet.moore.lan.10305 > nxfilter-192-168-3-60.moore.lan.2055: UDP, length 1464

  • #2
    Ive also noticed that there are no DNS blocks being logged. Logging > DNS Requests and searching for Block Only with a Fetch Limit of 100000

    I know there are blocks happening because if I view the reports for Daily, there are domains being blocked. Top 5 domains by block and it comes up as :4. Domains arent even listed.
    Between Netflow and DNS logging, there seems to be something broken within this release.

    Comment


    • #3
      Probably your traffic database file has some problem. Was there a power failure or sudden rebooting? Try to rebuild the traffic database. Stop it first and then delete /nxfilter/db/traffic* files and then restart it.

      Comment


      • Botch5547
        Botch5547 commented
        Editing a comment
        removing all traffic files worked.

        For background, i believe this virtual machine which is hosting nxfilter did lose its storage awhile back ago. Of course that's a problem but once service was restored DNS was being served again so the problem went unnoticed until data was needed.

        Appreciate you responding so quickly !
    Working...
    X