[flow-tools] Strange problem

[Mark Fullmer]

A few ideas

  Does this happen when you do not use -a.  This option is intended for
  recovering partial files from flow-capture, the 'tmp' files are not
  guaranteed to be useable, although you should not be getting 
  nondeterministic results.

  Can you try this on each individual file, ie

  cd /netflow/flows/saved/2002/12/16
  for name in *; do
    flow-cat $name | flow-filter -f filter-acl -Dmisc | flow-stat -f17
  done

  Does it change between runs?

  Can you try to run a checksum on the files and see if it changes, ie

  cd /netflow/flows/saved/2002/12/16
  for name in *; do
    md5 $name
  done

I've seen a problem like this once before when a disk drive was failing.

mark

On Thu, Jan 16, 2003 at 01:06:59PM -0600, Mike Hyde wrote:
> No, nothing changes in this directory.
> 
> 
> On Thu, 2003-01-16 at 12:30, Clayton Fiske wrote:
> > On Thu, Jan 16, 2003 at 09:47:38AM -0600, Mike Hyde wrote:
> > > I am running into a strange problem.  I am running the following:
> > > flow-cat -a /netflow/flows/saved/2002/12/16 | flow-filter -f filter-acl
> > > -Dmisc | flow-stat -f17
> > > 
> > > It runs fine, but I keep getting different results when I run it.  I
> > > make no changes between runs.
> > 
> > I assume /netflow/flows/saved/2002/12/16 isn't getting new flow files
> > added to it constantly (i.e. by flow-capture)? This could certainly
> > cause your problem.
> > 
> > -c
> > 
> > 
> > _______________________________________________
> > flow-tools@splintered.net
> > http://www.splintered.net/sw/flow-tools
> -- 
> Mike Hyde <mhyde@escape.ca>
> 
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools