simonemainardi
commented
5 years ago I've just tried to reproduce but everything seems to work as expected.
[simone@develv5 nProbe]$ sudo ./nprobe -i eno1 -n none --mysql="127.0.0.1:nprobe:nf:root:"Then data is immediately populated:
MariaDB [nprobe]> drop table nfflow;
ERROR 1051 (42S02): Unknown table 'nfflow'
MariaDB [nprobe]> drop table nfflows;
Query OK, 0 rows affected (0.00 sec)
MariaDB [nprobe]> show tables
-> ;
+------------------+
| Tables_in_nprobe |
+------------------+
| nfflows |
+------------------+
1 row in set (0.00 sec)
MariaDB [nprobe]> select * from nfflows limit 1;
+-----+----------+---------+----------+---------+-----------+-------------+---------------+------------+-------------+---------------+-------------+--------+--------+---------------+----------------+---------------+---------------+
| idx | IN_BYTES | IN_PKTS | PROTOCOL | SRC_TOS | TCP_FLAGS | L4_SRC_PORT | IPV4_SRC_ADDR | INPUT_SNMP | L4_DST_PORT | IPV4_DST_ADDR | OUTPUT_SNMP | SRC_AS | DST_AS | LAST_SWITCHED | FIRST_SWITCHED | IPV6_SRC_ADDR | IPV6_DST_ADDR |
+-----+----------+---------+----------+---------+-----------+-------------+---------------+------------+-------------+---------------+-------------+--------+--------+---------------+----------------+---------------+---------------+
| 1 | 752 | 5 | 6 | 16 | 24 | 22 | 3232236257 | 0 | 52295 | 3232236162 | 0 | 0 | 0 | 1540456528 | 1540456512 | | |
+-----+----------+---------+----------+---------+-----------+-------------+---------------+------------+-------------+---------------+-------------+--------+--------+---------------+----------------+---------------+---------------+
1 row in set (0.00 sec)Is seems your command line has issues. Fields are not escaped, and some others are missing the double dash. The correct line is
nprobe --zmq "tcp://127.0.0.1:5556" --zmq-probe-mode --interface ens18 --flow-templ "@NTOPNG@ %EXPORTER_IPV4_ADDRESS %EXPORTER_IPV6_ADDRESS" --flow-version 9 --mysql "127.0.0.1:ntop:nf:roman:PASSWORD"Using the debug flag, you will see nProbe INSERT INTO queries at runtime as follows:
25/Oct/2018 10:36:38 [database.c:37] INSERT INTO `nfflows` (IN_BYTES, IN_PKTS, PROTOCOL, SRC_TOS, TCP_FLAGS, L4_SRC_PORT, INPUT_SNMP, L4_DST_PORT, OUTPUT_SNMP, SRC_AS, DST_AS, LAST_SWITCHED, FIRST_SWITCHED, IPV6_SRC_ADDR, IPV6_DST_ADDR) VALUES ('56', '1', '58', '0', '0', '0', '0', '0', '0', '0', '0', '1540456596', '1540456596', 'fe80::20d:b9ff:fe37:ebf8', 'ff02::2')
romeor
Hello,
As requested, I open an issue here. Recently I updated nprobe running apt-get update and apt-get dist-upgrade for debian 9.1 repo. I was running the stable version, don't mind the exact version number, but it was just the one latest before the update in october I guess, as we started to test ntop in septempber and everything worked ok. I run nprobe with mysql for historical data as netflow collector.
After the update was done, I restarted the VM running nprobe and ntopng, as there was the kernel and some module update. After restart there was no historical data available. I see the traffic graphs history, I see the recent netflow data on the graphs, but as soon as I switch to flows, talkers, protocols - there is no data to see. It just says - "Flow Search Results No results found. Please modify your search criteria."
After some debugging, I've noticed, that nprobe does not even try conenct to mysql to create new database running this command:
nprobe --zmq tcp://127.0.0.1:5556 --zmq-probe-mode --interface none --collector-port 2055 --collector none --flow-templ "@NTOPNG@%EXPORTER_IPV4_ADDRESS %EXPORTER_IPV6_ADDRESS" flow-version 9 --mysql 127.0.0.1:ntop:nf:roman:PASSWORDBut if I run
nprobe --zmq tcp://127.0.0.1:5556 --zmq-probe-mode --interface ens18 --flow-templ "@NTOPNG@%EXPORTER_IPV4_ADDRESS %EXPORTER_IPV6_ADDRESS" flow-version 9 --mysql 127.0.0.1:ntop:nf:roman:PASSWORDI see new DB created inside the MariaDB console interface. So it seems, like nProbe does not connect to mysql in collector mode after latest changes.
as requested by e-mail, I've added the
-b=2 --debugand here is the output:# nprobe --zmq tcp://127.0.0.1:5556 --zmq-probe-mode --interface none -3 2055 --collector none --flow-templ "@NTOPNG@%EXPORTER_IPV4_ADDRESS %EXPORTER_IPV6_ADDRESS" flow-version 9 --mysql 127.0.0.1:ntop:nf:roman:PASSWORD -b=2 --debugJust wanted to add, that now I run the nightly build repository.