[Ntop-dev] issue with rrd when "duplicate" interface ID's exist

[Luca Deri]

Gary
it's already like that

       safe_snprintf(__FILE__, __LINE__, rrdIfPath, sizeof(rrdIfPath),
                          "%s/interfaces/%s/NetFlow/%d_%u_%u/", myGlobals.rrdPath,
                          myGlobals.device[devIdx].uniqueIfName,
                          ifStats->interface_id, ifStats->netflow_device_ip, ifStats->netflow_device_port);
            mkdir_p("RRD", rrdIfPath, myGlobals.rrdDirectoryPermissions);

Please sync from SVN

Luca
  

On Jul 19, 2010, at 6:38 PM, Gary Gatten wrote:

> Hello,
>  
> My log file is filled with these errors:
>  
>    **WARNING** RRD: rrd_update(/usr/local/var/ntop/HQLAN/rrd/interfaces/LAN-Cores-HQ/NetFlow/37/ifInPkts.rrd) error: /usr/local/var/ntop/HQLAN/rrd/interfaces/LAN-Cores-HQ/NetFlow/37/ifInPkts.rrd: illegal attempt to update using time 1279555673 when last update time is 1279555673 (minimum one second step)
>  
>  
> Here is what I think is the problem:
>  
> I use netflow “exclusively”.  I have hundreds of flow exporters, which export to one of several netflow instances each with several netflow interfaces.  For example: I have apx. 180 remote offices around the USA.  These offices are grouped into 8 regions – each region exports to a different netflow interface within the same ntop instance.  Similarly, on my campus I have (2) 6509 switches: each export to the same netflow interface on the same ntop instance.
>  
> Quite often, exporters will have the same interface ID’s.  So, at any time ntop may receive flows from multiple exporters with the same interface ID, such as ‘37’ as in the example above, and of course when it tries to write the data you get the 1 second warning as above.
>  
> To Fix:
>  
> In addition to the interface ID, add an exporter ID (IP address?) such that the directory structure in the example above would become:
> …/interfaces/LAN-Cores-HQ/NetFlow/10.1.1.1/37/ifInPkts.rrd  AND
> …/interfaces/LAN-Cores-HQ/NetFlow/10.1.1.2/37/ifInPkts.rrd
>  
> In the case of my WAN exporters, where there are in some cases 50 exporters per netflow interface, it would be something like:
>  
> …/interfaces/Region-1/NetFlow/192.168.1.1/4/ifInPkts.rrd
> …/interfaces/Region-1/NetFlow/192.168.1.n…/4/ifInPkts.rrd
> …/interfaces/Region-1/NetFlow/192.168.1.50/4/ifInPkts.rrd
>  
>  
> OR
>  
> Change the method ntop uses to write to the rrd files such that flow data is buffered and concatenated as required so each “interface” is updated only every 1 second.
>  
> I THINK the first option would be easier to implement and provide a more accurate representation of data from each exporter. 
>  
> I hope this makes sense.  Please let me know if you have any further questions or want me to test anything. 
>  
> Thanks!
>  
> Gary
>  
> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system."

---

"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. - Brian W. Kernighan