Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Misc

nprobe 6.5 / fastbit / timestamp

 

 

NTop misc RSS feed   Index | Next | Previous | View Threaded


alan at three6five

Jul 11, 2011, 4:18 AM

Post #1 of 2 (433 views)
Permalink
nprobe 6.5 / fastbit / timestamp

Hey Guys

Running nprobe 6.5.0, fastbit version 1.2.4 as a collector for cisco version 9 netflow, on ubuntu Linux (natty)

When dumping the flows into fastbit the LAST_SWITCHED and FIRST_SWITCHED times are very wrong, (it appears as if the timestamp is the time that I started nprobe, and every flow has the same timestamp.

eg
--snip--
# date
Mon Jul 11 13:16:55 SAST 2011
1310128222,1310128222,38.103.40.165
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.167
1310128222,1310128222,38.103.40.177
1310128222,1310128222,38.103.62.154
1310128222,1310128222,38.103.62.167
1310128222,1310128222,38.103.141.254
1310128222,1310128222,38.103.160.21
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122
1310128222,1310128222,38.103.167.122

$date -r 1310128222
Fri Jul 8 14:30:22 SAST 2011
--snip--

Now if I dump the flows into ascii text, the LAST and FIRST SWITCHED is 100% correct, so it must be the conversion done before it dumps it into fastbit.

is there anyone else having the issue?

cheers

--
Alan Kemp
email: alan [at] three6five
mobile: +27 83 257 5970
three6five systems


deri at ntop

Jul 11, 2011, 4:35 AM

Post #2 of 2 (408 views)
Permalink
Re: nprobe 6.5 / fastbit / timestamp [In reply to]

Alan
please file a bug on http://bugzilla.ntop.org

Luca

On Jul 11, 2011, at 1:18 PM, Alan Kemp wrote:

> Hey Guys
>
> Running nprobe 6.5.0, fastbit version 1.2.4 as a collector for cisco version 9 netflow, on ubuntu Linux (natty)
>
> When dumping the flows into fastbit the LAST_SWITCHED and FIRST_SWITCHED times are very wrong, (it appears as if the timestamp is the time that I started nprobe, and every flow has the same timestamp.
>
> eg
> --snip--
> # date
> Mon Jul 11 13:16:55 SAST 2011
> 1310128222,1310128222,38.103.40.165
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.167
> 1310128222,1310128222,38.103.40.177
> 1310128222,1310128222,38.103.62.154
> 1310128222,1310128222,38.103.62.167
> 1310128222,1310128222,38.103.141.254
> 1310128222,1310128222,38.103.160.21
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
> 1310128222,1310128222,38.103.167.122
>
> $date -r 1310128222
> Fri Jul 8 14:30:22 SAST 2011
> --snip--
>
> Now if I dump the flows into ascii text, the LAST and FIRST SWITCHED is 100% correct, so it must be the conversion done before it dumps it into fastbit.
>
> is there anyone else having the issue?
>
> cheers
>
> --
> Alan Kemp
> email: alan [at] three6five
> mobile: +27 83 257 5970
> three6five systems
>
>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

---
If you can not measure it, you can not improve it - Lord Kelvin

NTop misc RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.