Closed thezoggy closed 5 months ago
I am sorry for the trouble, but between the two master version, there is no change for backend or expire behavior.
It looks to me, that that all was a chaining of unlucky events!
The file nfsen-dist.conf
always reflected all available variables. The change from …=1;
to …= “-z= xx”
was introduced mainly because of users wanted to have different compression available in NfSen. In oder to be backward compatible, 1 was mapped to lz4. The NfSen main branch should be up to date to reflect all that.
The way you collect and process the flows is controlled be NfSen and its config.
As of lz4: It was a user demand to explicitly use the system installed lz4 library and not the code, which comes with nfdump. However, as I still consider lz4 as one of the optimal compression, which should be available in nfdump, the lz4 code still is shipped with nfdump. The configure
command checks for the system installed lz4 library and if it is not available it builds the shipped lz4 code - the embedded
version. Therefore, its a matter of taste, which one you prefer.
Finally please note, if you change the compression of the files, you need the rebuild the profile in order to reflect the correct new size of the profile.
Updated title and original notes since, also moved original problem with compression not working to nfdump repo for that. Keeping this for only the nfsen conf one
There is no change, which stops nfcapd from compressing with lz4.
moved original nfdump question over to nfdump - updated this one to focus on just nfsen
Recently I upgraded to nfdump and saw nfcapd no longer being stored in lz4 even thought I saw it still being set to use it. I wanted to test if updating to another compression such as zstd fixed it and ran into an issue.
looking at nfsen.conf I see it was using the legacy value:
looking at nfsen status, I do see it is doing
-z=lz4
to nfcapd...Looking at: https://github.com/phaag/nfsen/blob/main/etc/nfsen-dist.conf#L126
I wanted to try using zstd so I updated:
This did not change what is being passed to nfcapd...
digging into nfconf.. https://github.com/phaag/nfsen/blob/main/libexec/NfConf.pm#L152
I see its "$ZIPcollected" is what needs to be changed... nfsen-dist.conf never got updated to note it like ZIPprofiles did.
Waiting for some stuff to finish, but will updated nfsen conf to test and confirm: