mbolli / nfsen-ng

Responsive NetFlow visualizer built on top of nfdump tools.
Apache License 2.0
231 stars 43 forks source link

Installation issues #73

Closed moozer closed 7 months ago

moozer commented 2 years ago

I am installing nfsen-ng and have a hard time making it work.

Everything seems to be in order, but I get nothing in the UI.

A thing I noticed is that in the docs, it says ./cli.php start starts the daemon. what does that do and is it needed? How is it supposed to be started?

debug info below

Current status is that nfcapd is working and I am storing stuff in the correct location.

root@debian11-base:/opt/nfsen-ng/backend# tree -h /var/nfdump/profiles-data/
/var/nfdump/profiles-data/
└── [4.0K]  live
    └── [4.0K]  source1
        ├── [4.0K]  2022
        │   └── [4.0K]  03
        │       └── [4.0K]  10
        │           ├── [ 276]  nfcapd.202203102030
        │           ├── [2.8K]  nfcapd.202203102035
        │           ├── [7.8K]  nfcapd.202203102040
        │           ├── [9.1K]  nfcapd.202203102045
        │           ├── [8.4K]  nfcapd.202203102050
        │           ├── [7.8K]  nfcapd.202203102055
        │           └── [7.7K]  nfcapd.202203102100
        └── [ 276]  nfcapd.current.9521

5 directories, 8 files

I am seeing this in the logs

Mar 10 21:08:22 debian11-base php: nfsen-ng: Last update: 2022-03-10 21:00
Mar 10 21:08:22 debian11-base php: nfsen-ng: Scanning path /var/nfdump/profiles-data/live/source1/2022/03/10

So I am assuming the nfsen.ng is looking in the right place.

Doing import seems to work

root@debian11-base:/opt/nfsen-ng/backend# ./cli.php -f -p -ps -v import | head -n 25
2022-03-10 21:10:35 CLI: Starting import
Resetting existing data...

Processing 1 ...0.0% 0/1097 ETC: ???. Elapsed: < 1 sec [>                              ]
Processing source source1 (1/1)...

Processin...0.1% 1/1097 ETC: < 1 sec. Elapsed: < 1 sec [>                              ]
...

I also have the rrd files

root@debian11-base:/opt/nfsen-ng/backend# ls datasources/data/* -hl
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/22.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/53.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/80.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/source1_22.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/source1_53.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/source1_80.rrd
-rw-r--r-- 1 root root 5.3M Mar 10 21:10 datasources/data/source1.rrd

The web interface looks like this image

I am using nginx. In the logs I get errors related to favicon.png missing, but that is unrelated to this issue.

OS info for reference

root@debian11-base:/opt/nfsen-ng/backend# uname -a
Linux debian11-base 5.10.0-11-amd64 #1 SMP Debian 5.10.92-2 (2022-02-28) x86_64 GNU/Linux
moozer commented 2 years ago

I tried switching to apache.

I added "allowoverride all", and now I will not do the rulle rewrite (eg. go form / to /frontend). DO you have an example apache config I could test?

perceival commented 2 years ago
  1. make sure to enable rrd.so for php
  2. here is relevant part of httpd.conf:
    
    ServerAdmin root@localhost
AllowOverride none
Require all denied

DocumentRoot "/var/www/html/nfsen-ng"

<Directory "/var/www"> AllowOverride None Require all granted

<Directory "/var/www/html"> Options Indexes FollowSymLinks

AllowOverride all

Require all granted

DirectoryIndex index.html
perceival commented 2 years ago

also to start nfsen-ng with systemd I am using following service file (adjust accordingly to your OS requirements and your paths):

[Unit]
Description=nfsen-ng daemon
Requires=network.target nfcapd.service httpd.service

[Service]
PIDFile=/var/www/html/nfsen-ng/backend/nfsen-ng.pid
WorkingDirectory=/var/www/html/nfsen-ng/backend/
ExecStart=/usr/bin/php /var/www/html/nfsen-ng/backend/listen.php
Restart=always
Type=simple
KillMode=process
User=apache
Group=apache
StandardOutput=null
StandardError=syslog
ProtectSystem=full
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
moozer commented 2 years ago

Thank you for that.

I now have nfsen-ng to periodically check the input from nfcapd. Using the service file, it is now started automatically. This is the "daemon" related to ./cli.php that I was wondering about earlier.

Apache is now working also. Besides the updates to the config files, I had to enable the "rewrite" module. This is done by a2enmod rewrite

I have done echo "extension=rrd.so" > /etc/php/7.4/mods-available/rrd.ini and phpenmod rrd . I have not found a way of verifying that it actually worked.

I still don't have anything in the web interface.

I checked the api endpoint

✗ curl http://192.168.111.101:81/api/config
<?php
spl_autoload_register(function ($class) {
    $class = strtolower(str_replace('nfsen_ng\\', '', $class));
    include_once __DIR__ . DIRECTORY_SEPARATOR . str_replace('\\', DIRECTORY_SEPARATOR, $class) . '.php';
});

use nfsen_ng\api\API;

ini_set('display_errors', true);
ini_set('error_reporting', E_ALL);

if (isset($_GET['request'])) {

    // initialize api
    $api = new API();

}

This is wrong, and let me to enabling mod php also.

a2dismod mpm_event # disable due to conflict
a2enmod php7.4 
systemctl restart apache2

I was sidetracked and not looking into PHP, since 1) I got stuff on the page (which apparently is the pure html+js part) and 2) rdd files are generated by backend php scripts - so php was not considered.

Now the web ui is working. Thanks for the help.

perceival commented 2 years ago

Any idea how to achieve the same for nginx? Looks like such a query (http://server:8080/api/config - that is Apache) is returning correctly: {"sources":["source"],"ports":[80,22,53,443,1883,5353,8123,12345],"stored_output_formats":[],"stored_filters":[],"daemon_running":true,"frontend":{"reload_interval":60,"defaults":{"view":"graphs","graphs":{"display":"sources","datatype":"flows","protocols":["any"]},"flows":{"limit":50},"statistics":{"order_by":"bytes"}}}} while nginx (https://server/api/config) is downloading file like that:

<?php
spl_autoload_register(function ($class) {
    $class = strtolower(str_replace('nfsen_ng\\', '', $class));
    include_once __DIR__ . DIRECTORY_SEPARATOR . str_replace('\\', DIRECTORY_SEPARATOR, $class) . '.php';
});

use nfsen_ng\api\API;

ini_set('display_errors', true);
ini_set('error_reporting', E_ALL);

if (isset($_GET['request'])) {

    // initialize api
    $api = new API();

}
moozer commented 2 years ago

Yes, I encountered that one also. It is the same problem as with apache where php is not enabled.

My solution was to install php-fpm and pipe all /api call through php. The nginx config looks like this:

server {
    listen 80;
    listen [::]:80;
    root {{ nfsen_dir }};
    index index.html index.htm;
    server_name {{ nfsen_hostname }};

    location / {
        rewrite ^/$ /frontend break;
    }

    # we only do php on api
    location /api {
        if (!-e $request_filename) {
            rewrite ^/api/(.*)$ /backend/index.php?request=$1 break;
        }
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.4-fpm.sock;

    }
} 

It is this file

(the double curly braces is jinja2 templating for substituting variables)

If you are ansible literate, you can see the installation steps in this repo https://gitlab.com/moozer/server-monitor-ansible/-/blob/master/tasks/install_nfsen.yml

mbolli commented 2 years ago

@Dona21 https://gitlab.com/moozer/server-monitor-ansible/-/blob/master/tasks/install_nfsen.yml maybe useful to check in or merge with yours?

moozer commented 2 years ago

FYI I just update the role so it fixes some systemd issue with "run" files.

Feel free to ask.

perceival commented 2 years ago

@moozer were you able to set it up with nginx?

moozer commented 2 years ago

@perceival Yes, I use nginx

The repo referenced above includes grafana and other things. I was unable to make nfsen work on e.g. <ip>/nfsen, so I have two virtual hosts. This requires two dns names or two ip addresses.

jult commented 7 months ago

Does this repo require nfsen to be installed as well, or does it entirely replace the old NFSEN git repo?

mbolli commented 7 months ago

@jult nfsen-ng does not entirely replace nfsen, but is totally independent of it.

jult commented 7 months ago

OK, but it's still not clear to me if I need to install nfsen to get nfsen-ng to function. The original nfsen repo is updated 3 months ago, so is this ng more up to date, still? If so, in what regard?

Dona21 commented 7 months ago

@jult no, it does not need nfsen. Please read the install instructions. If it would need it, it would be mentioned. However, it needs nfdump, which is not the same thing as nfsen.

jult commented 7 months ago

@jult no, it does not need nfsen. Please read the install instructions. If it would need it, it would be mentioned. However, it needs nfdump, which is not the same thing as nfsen.

I read the install instructions. They are really NOT clear. For example, it says: "nfsen-ng is an in-place replacement for the ageing nfsen", in-place usually would mean one has nfsen installed and then installs nfsen-ng over it, replacing necessary parts. (It also calls it 'ageing', while, it was updated 3 months ago. How ageing is it really?) It's also unclear if both are in each other's way if they are both installed. It does not, for example, say to uninstall/purge/remove nfsen prior to installing nfsen-ng. Just one sentence about that would do wonders.

mbolli commented 7 months ago

@jult We understand "in-place" as in putting it instead of the other. "Ageing" is in respect to bitmap graphics, perl and the UX. It's no problem to have them both installed pointing to the same profiles folder, as it's a read-only operation anyway (might impact performance a bit though). Both nfsen-ng and nfsen use their own RRD databases.

jult commented 2 weeks ago

Then why use "in-place" and not "instead"? In-place official meaning is that it is using (parts of) something already existing in a place and taking that place in. Also, you call it a "replacement of", which also implies that one replaces an existing other.