nfcapd / nfprofile nfcapd.JJJJMMDDHHMM: File not found! #40
Assignees
Labels
question
Further information is requested
Comments
|
As of the file not found - it looks like the Subdir values are not identical from old with new installation. Please make sure they fit. Otherwise you have errors like these. As of the dropouts - Just from the picture itself, this is difficult to debug. You need to check your log files. |
|
hi @phaag What do you mean by Subdir values? The device names? (For the most part, they are the same, but we had to replace the '-' with '_' for certain devices.) I've tried to comple nfdump with the --enable-devel flag for more logs but it fails to compile nfcapd/nfprofile log: |
|
in |
|
The compile flag |
|
I cannot debug your installation from here! Check your logs, compare the old and new installation - check the nfcapd logs how many packets, bytes and flows have beed captured and so on .. |
|
Hi @phaag I've removed all hyphens from the sources and profile names. The $SUBDIRLAYOUT is identical between the old and new installations. Additionally, I've set up a third instance without tor and gelookup enabled and without any plugins. I've also created a custom profile that is identical across all instances. I'll check on Monday to see if there are any differences across the instances. If you have any tips or suggestions for me, I would greatly appreciate it. Thank you very much! |
|
@phaag I tested the releases between nfdump-1.6.25 - and nfdump-1.7.4, as well as the last commits of each month, until I found the specific commit where the issue started. For example, in NfSen, I observed that the issue occurred at 14:15. While the logs from that timestamp appear normal, at 14:20 the following error is logged:
I also tried adjusting the maxworker setting to 1 in an attempt to bypass the issue, but unfortunately, it had no effect. I have since reverted the setting. Do you have any suggestions on how to further investigate and debug this issue? logs between 14:10 and 14:25 BR |
Takalele
added a commit
to Takalele/nfdump
that referenced
this issue
May 12, 2025
- Add thread_local.h header with portable TLS macro - Replace static buffer in GetSubDir() with thread-local storage - Make localtime() calls thread-safe using localtime_r() - Create thread-local copies of filenames in InitChannels() - Update Makefile.am to include new header This fixes race conditions that caused incorrect path/filename handling when multiple threads access these resources concurrently. Fixes phaag/nfsen#40
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
I am in the process of migrating from my old nfdump (v1.6.18) and nfsen (v1.3.6p1) installation to the latest available source versions of both tools.
Currently, I have configured the new nfdump installation to export to the old setup via the -R IP/Port option, allowing me to compare the two installations.
However, I am encountering an issue where nfprofile occasionally fails to find the corresponding nfcapd files. The error message looks like this:
The strange part is that the file does exist, but in a different directory:
From my perspective, it seems that the file is being moved before nfprofile has a chance to access it. This issue occurs randomly and affects all custom profiles.
old installation:
new installation:
Do you have any advice or suggestions on how to resolve this issue?
thank you and BR
Takalele
The text was updated successfully, but these errors were encountered: