Agenda: exercise5-NfSen-PortTracker.htm

File exercise5-NfSen-PortTracker.htm, 9.3 KB (added by Chris Elliott, 6 years ago)
Line 
1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html xmlns="http://www.w3.org/1999/xhtml">
3<head>
4  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5  <meta http-equiv="Content-Style-Type" content="text/css" />
6  <meta name="generator" content="pandoc" />
7  <title></title>
8  <style type="text/css">code{white-space: pre;}</style>
9  <link href="data:text/css;charset=utf-8,%0A%0A%0A%0Adiv%23header%2C%20header%0A%7B%0A%0Aborder%2Dbottom%3A%201px%20solid%20%23aaa%3B%0Amargin%2Dbottom%3A%200%2E5em%3B%0A%7D%0A%2Etitle%20%0A%7B%0Atext%2Dalign%3A%20center%3B%0A%7D%0A%2Eauthor%2C%20%2Edate%20%0A%7B%0Atext%2Dalign%3A%20center%3B%0A%7D%0A%0Adiv%23TOC%2C%20nav%23TOC%0A%7B%0A%0Aborder%2Dbottom%3A%201px%20solid%20%23aaa%3B%0Amargin%2Dbottom%3A%200%2E5em%3B%0A%7D%0A%40media%20print%0A%7B%0Adiv%23TOC%2C%20nav%23TOC%0A%7B%0A%0Adisplay%3A%20none%3B%0A%7D%0A%7D%0A%0Ah1%2C%20h2%2C%20h3%2C%20h4%2C%20h5%2C%20h6%0A%7B%0Afont%2Dfamily%3A%20%22Helvetica%20Neue%22%2C%20Helvetica%2C%20%22Liberation%20Sans%22%2C%20Calibri%2C%20Arial%2C%20sans%2Dserif%3B%20%0A%0Apage%2Dbreak%2Dafter%3A%20avoid%3B%20%0A%7D%0A%0Adiv%20div%2C%20section%20section%20%0A%7B%0Amargin%2Dleft%3A%202em%3B%20%0A%7D%0Ap%20%7B%7D%0Ablockquote%0A%7B%20font%2Dstyle%3A%20italic%3B%0A%7D%0Ali%20%0A%7B%0A%7D%0Ali%20%3E%20p%20%0A%7B%0Amargin%2Dtop%3A%201em%3B%20%0A%7D%0Aul%20%0A%7B%0A%7D%0Aul%20li%20%0A%7B%0A%7D%0Aol%20%0A%7B%0A%7D%0Aol%20li%20%0A%7B%0A%7D%0Ahr%20%7B%7D%0A%0Asub%20%0A%7B%0A%7D%0Asup%20%0A%7B%0A%7D%0Aem%20%0A%7B%0A%7D%0Aem%20%3E%20em%20%0A%7B%0Afont%2Dstyle%3A%20normal%3B%0A%7D%0Astrong%20%0A%7B%0A%7D%0A%0Aa%20%0A%7B%0A%0Atext%2Ddecoration%3A%20none%3B%0A%7D%0A%40media%20screen%0A%7B%0Aa%3Ahover%0A%7B%0A%0Atext%2Ddecoration%3A%20underline%3B%0A%7D%0A%7D%0A%40media%20print%0A%7B%0Aa%20%7B%0A%0Acolor%3A%20black%3B%0Abackground%3A%20transparent%3B%0A%7D%0Aa%5Bhref%5E%3D%22http%3A%2F%2F%22%5D%3Aafter%2C%20a%5Bhref%5E%3D%22https%3A%2F%2F%22%5D%3Aafter%0A%7B%0A%0Acontent%3A%20%22%20%28%22%20attr%28href%29%20%22%29%20%22%3B%0Afont%2Dsize%3A%2090%25%3B%0A%7D%0A%7D%0A%0Aimg%0A%7B%0A%0Avertical%2Dalign%3A%20middle%3B%0A%7D%0Adiv%2Efigure%20%0A%7B%0A%0Amargin%2Dleft%3A%20auto%3B%0Amargin%2Dright%3A%20auto%3B%0Atext%2Dalign%3A%20center%3B%0Afont%2Dstyle%3A%20italic%3B%0A%7D%0Ap%2Ecaption%20%0A%7B%0A%0A%7D%0A%0Apre%2C%20code%20%7B%0Abackground%2Dcolor%3A%20%23fdf7ee%3B%0A%0A%0A%0Awhite%2Dspace%3A%20pre%2Dwrap%3B%20%0Awhite%2Dspace%3A%20%2Dmoz%2Dpre%2Dwrap%20%21important%3B%20%0Awhite%2Dspace%3A%20%2Dpre%2Dwrap%3B%20%0Awhite%2Dspace%3A%20%2Do%2Dpre%2Dwrap%3B%20%0Aword%2Dwrap%3A%20break%2Dword%3B%20%0A%0A%7D%0Apre%20%0A%7B%0A%0Apadding%3A%200%2E5em%3B%20%0Aborder%2Dradius%3A%205px%3B%20%0A%0Aborder%3A%201px%20solid%20%23aaa%3B%0A%0Amargin%2Dleft%3A%200%2E5em%3B%0Amargin%2Dright%3A%200%2E5em%3B%0A%7D%0A%40media%20screen%0A%7B%0Apre%0A%7B%0A%0Awhite%2Dspace%3A%20pre%3B%0Aoverflow%3A%20auto%3B%0A%0Aborder%3A%201px%20dotted%20%23777%3B%0A%7D%0A%7D%0Acode%20%0A%7B%0A%7D%0Ap%20%3E%20code%2C%20li%20%3E%20code%20%0A%7B%0A%0Apadding%2Dleft%3A%202px%3B%0Apadding%2Dright%3A%202px%3B%0A%7D%0Ali%20%3E%20p%20code%20%0A%7B%0A%0Apadding%3A%202px%3B%0A%7D%0A%0Aspan%2Emath%20%0A%7B%0A%0A%7D%0Adiv%2Emath%20%0A%7B%0A%7D%0Aspan%2ELaTeX%20%0A%7B%0A%7D%20eq%20%0A%7B%0A%7D%20%0A%0Atable%0A%7B%0Aborder%2Dcollapse%3A%20collapse%3B%0Aborder%2Dspacing%3A%200%3B%20%0Aborder%2Dbottom%3A%202pt%20solid%20%23000%3B%0Aborder%2Dtop%3A%202pt%20solid%20%23000%3B%20%0A%0Amargin%2Dleft%3A%20auto%3B%0Amargin%2Dright%3A%20auto%3B%0A%7D%0Athead%20%0A%7B%0Aborder%2Dbottom%3A%201pt%20solid%20%23000%3B%0Abackground%2Dcolor%3A%20%23eee%3B%20%0A%7D%0Atr%2Eheader%20%0A%7B%0A%7D%20tbody%20%0A%7B%0A%7D%0A%0Atr%20%7B%0A%7D%0Atr%2Eodd%3Ahover%2C%20tr%2Eeven%3Ahover%20%0A%7B%0Abackground%2Dcolor%3A%20%23eee%3B%0A%7D%0A%0Atr%2Eodd%20%7B%7D%0Atr%2Eeven%20%7B%7D%0Atd%2C%20th%20%0A%7B%20vertical%2Dalign%3A%20top%3B%20%0Avertical%2Dalign%3A%20baseline%3B%20%0Apadding%2Dleft%3A%200%2E5em%3B%0Apadding%2Dright%3A%200%2E5em%3B%0Apadding%2Dtop%3A%200%2E2em%3B%0Apadding%2Dbottom%3A%200%2E2em%3B%0A%7D%0A%0A%0Ath%20%0A%7B%0Afont%2Dweight%3A%20bold%3B%20%7D%0Atfoot%20%0A%7B%0A%7D%0Acaption%20%0A%7B%0Acaption%2Dside%3A%20top%3B%0Aborder%3A%20none%3B%0Afont%2Dsize%3A%200%2E9em%3B%0Afont%2Dstyle%3A%20italic%3B%0Atext%2Dalign%3A%20center%3B%0Amargin%2Dbottom%3A%200%2E3em%3B%20%0Apadding%2Dbottom%3A%200%2E2em%3B%0A%7D%0A%0Adl%20%0A%7B%0Aborder%2Dtop%3A%202pt%20solid%20black%3B%0Apadding%2Dtop%3A%200%2E5em%3B%0Aborder%2Dbottom%3A%202pt%20solid%20black%3B%0A%7D%0Adt%20%0A%7B%0Afont%2Dweight%3A%20bold%3B%0A%7D%0Add%2Bdt%20%0A%7B%0Aborder%2Dtop%3A%201pt%20solid%20black%3B%0Apadding%2Dtop%3A%200%2E5em%3B%0A%7D%0Add%20%0A%7B%0Amargin%2Dbottom%3A%200%2E5em%3B%0A%7D%0Add%2Bdd%20%0A%7B%0Aborder%2Dtop%3A%201px%20solid%20black%3B%20%0A%7D%0A%0Aa%2Efootnote%2C%20a%2EfootnoteRef%20%7B%20%0Afont%2Dsize%3A%20small%3B%20vertical%2Dalign%3A%20text%2Dtop%3B%0A%7D%0Aa%5Bhref%5E%3D%22%23fnref%22%5D%2C%20a%2Ereversefootnote%20%0A%7B%0A%7D%0A%40media%20print%0A%7B%0Aa%5Bhref%5E%3D%22%23fnref%22%5D%2C%20a%2Ereversefootnote%20%0A%7B%0A%0Adisplay%3A%20none%3B%0A%7D%0A%7D%0Adiv%2Efootnotes%20%0A%7B%0A%7D%0Adiv%2Efootnotes%20li%5Bid%5E%3D%22fn%22%5D%20%0A%7B%0A%7D%0A%0A%40media%20print%0A%7B%0A%2Enoprint%0A%7B%0Adisplay%3Anone%3B%0A%7D%0A%7D%0A" rel="stylesheet" type="text/css" />
10</head>
11<body>
12<div id="TOC">
13<ul>
14<li><a href="#optional-tasks"><span class="toc-section-number">1</span> Optional Tasks</a><ul>
15<li><a href="#installing-the-porttracker-plugin-optional-or-as-reference"><span class="toc-section-number">1.1</span> Installing the PortTracker plugin (Optional or as reference)</a></li>
16<li><a href="#troubleshooting"><span class="toc-section-number">1.2</span> Troubleshooting</a></li>
17</ul></li>
18</ul>
19</div>
20<p>NetFlow - PortTracker Exercises</p>
21<h1 id="optional-tasks"><span class="header-section-number">1</span> Optional Tasks</h1>
22<h2 id="installing-the-porttracker-plugin-optional-or-as-reference"><span class="header-section-number">1.1</span> Installing the PortTracker plugin (Optional or as reference)</h2>
23<p>This exercise assumes you already built nfdump from source with options <code>--enable-nfprofile</code> and <code>--enable-nftrack</code>, with nftrack installed under /usr/local/bin. If not, see exercise2-install-nfdump-nfsen.</p>
24<ul>
25<li>Make a directory for the nftrack data</li>
26</ul>
27<pre><code>$ sudo mkdir /var/ports-db
28$ sudo chown netflow /var/ports-db</code></pre>
29<ul>
30<li>Set the nftrack data directory in the PortTracker.pm module (which is under the nfsen source)</li>
31</ul>
32<pre><code>$ cd
33$ cd nfsen-1.3.6p1/contrib/PortTracker
34$ editor PortTracker.pm
35
36    Find the line:
37
38my $PORTSDBDIR = &quot;/data/ports-db&quot;;
39
40    and change it to:
41
42my $PORTSDBDIR = &quot;/var/ports-db&quot;;</code></pre>
43<p>Save and exit from the file.</p>
44<ul>
45<li>Install the plugin into the NFSen distribution</li>
46</ul>
47<pre><code>$ sudo cp PortTracker.pm /var/nfsen/plugins/
48$ sudo cp PortTracker.php /var/www/nfsen/plugins/</code></pre>
49<ul>
50<li>Add the plugin definition to the nfsen.conf configuration</li>
51</ul>
52<pre><code>$ cd /var/nfsen/etc
53$ sudo editor nfsen.conf</code></pre>
54<ul>
55<li>Find the plugins section and make it look like this:</li>
56</ul>
57<pre><code>@plugins = (
58   [ 'live', 'PortTracker'],
59); </code></pre>
60<p>Save and exit from the file.</p>
61<ul>
62<li>Initialize the PortTracker database files</li>
63</ul>
64<pre><code>$ sudo -u netflow nftrack -I -d /var/ports-db</code></pre>
65<p>(This can take a LONG time! - 8 GB worth of files will be created)</p>
66<ul>
67<li>Set the permissions so the netflow user running nfsen, and the www-data user running the Web interface, can access the porttracker data.</li>
68</ul>
69<pre><code>$ sudo chown -R netflow:www-data /var/ports-db
70$ sudo chmod 775 /var/ports-db
71$ sudo chmod 664 /var/ports-db/*</code></pre>
72<ul>
73<li>Restart NfSen</li>
74</ul>
75<pre><code>$ sudo service nfsen reload</code></pre>
76<ul>
77<li>Check for success:</li>
78</ul>
79<pre><code>$ grep -i 'porttracker.*success' /var/log/syslog
80Oct 12 13:19:35 pc1 nfsen[28005]: Loading plugin 'PortTracker': Success
81Oct 12 13:19:35 pc1 nfsen[28005]: Initializing plugin 'PortTracker': Success</code></pre>
82<ul>
83<li>Wait some minutes, and go the the nfsen GUI</li>
84</ul>
85<pre><code>http://pcX.ws.nsrc.org/nfsen/nfsen.php</code></pre>
86<p>... and select the Plugins tab.</p>
87<blockquote>
88<p>You may get an error that &quot;No plugins available!&quot;: if so, quit and re-start your browser.</p>
89<p>You may get &quot;Error reading stat&quot;. You will need to wait a few minutes before NfSen will begin to show the graphs.</p>
90</blockquote>
91<p>At this point you are done. Congratulations!</p>
92<h2 id="troubleshooting"><span class="header-section-number">1.2</span> Troubleshooting</h2>
93<p>If you get &quot;Error reading stat&quot;, check the /var/ports-db directory for 2 additional files: portstat24.txt and portstat.txt like this:</p>
94<pre><code>$ ls -l /var/ports-db/portstat*
95-rw-r--r-- 1 netflow www-data     512 Jul 17 21:20 /var/ports-db/portstat24.txt
96                                                   /var/ports-db/portstat.txt</code></pre>
97<p>If either is missing then this will cause the problem. Make sure that nfsen can write in that directory.</p>
98<p>You can get additional debugging by setting <code>$DEBUG = 1</code> in /var/www/nfsen/conf.php, and then looking in /var/tmp/nfsen.log</p>
99</body>
100</html>