Thursday, March 30, 2017

NfSen on CentOS 7



Ahhh Netflow (and sFlow for that matter).

That magic service that let's you see what's happening on your routers WAN interface.

For new players, there's a fantastic open source product called NfSen that collects Netflow data and provides a GUI with input box to allow you to bring up flow information as and when required (going back as far as your storage can handle).

Now, like all Open Source products, they can be a bit of a PITA to setup.

I've sat down and followed three different guides to get this working on CentOS 7 and found one that was 99.9% there.

The guide I recommend is over at ProLinuxHub @
http://prolinuxhub.com/building-centos-7-netflows-monitoring-station-with-nfsen-and-nfdump/

Follow that guide to the tee with the following changes and you'll be ready to rock n roll:



Extra Packages
On the line that says:
 yum install perl-Data-Dumperu

Change this to
 yum install perl-Data-Dumper

NfSen.conf Settings File
On the line that says:
 $HTMLDIR = "/var/www/nfsen";

Change this to:
 $HTMLDIR = "/var/www/html/nfsen";


Final note:

If you see the following message when you hit up your NfSen URL @ http://x.x.x.x/nfsen/nfsen.php

 Frontend - Backend version missmatch!

Edit /var/www/html/nfsen/nfsen.php

Comment out the line:
 if ( !array_key_exists('backend_version', $_SESSION ) || $_SESSION['backend_version'] !=  $expected_version ) {

And enter directly below:
 if ( array_key_exists('backend_version', $_SESSION ) && $_SESSION['backend_version'] !=  $expected_version ) {

 Save the file.

Restart NfSen:
 /etc/init.d/nfsen restart

3 comments:

  1. iptables -I INPUT -p tcp –dport 80 -j ACCEPT

    Doesn't work either.

    Lot's of errors on that page.

    ReplyDelete
  2. /opt/nfsen-1.3.6p1/cp etc/nfsen-dist.conf /opt/nfsen-1.3.6p1/etc/nfsen.conf

    and then

    vi /etc/nfsen.conf

    ???

    Umm we did not copy nfsens.conf to /etc/



    ReplyDelete
  3. That tutorial is full of errors actually, you need to adapt a bit an check every line for logical or "typo" mistakes.

    ReplyDelete