Ahhh Netflow (and sFlow for that matter).
That magic service that let's you see what's happening on your routers WAN interface.
For new players, there's a fantastic open source product called NfSen that collects Netflow data and provides a GUI with input box to allow you to bring up flow information as and when required (going back as far as your storage can handle).
Now, like all Open Source products, they can be a bit of a PITA to setup.
I've sat down and followed three different guides to get this working on CentOS 7 and found one that was 99.9% there.
The guide I recommend is over at ProLinuxHub @
http://prolinuxhub.com/building-centos-7-netflows-monitoring-station-with-nfsen-and-nfdump/
Follow that guide to the tee with the following changes and you'll be ready to rock n roll:
Extra Packages
On the line that says:
yum install perl-Data-Dumperu
Change this to
yum install perl-Data-Dumper
NfSen.conf Settings File
On the line that says:
$HTMLDIR = "/var/www/nfsen";
Change this to:
$HTMLDIR = "/var/www/html/nfsen";
Final note:
If you see the following message when you hit up your NfSen URL @ http://x.x.x.x/nfsen/nfsen.php
Frontend - Backend version missmatch!
Edit /var/www/html/nfsen/nfsen.php
Comment out the line:
if ( !array_key_exists('backend_version', $_SESSION ) || $_SESSION['backend_version'] != $expected_version ) {
And enter directly below:
if ( array_key_exists('backend_version', $_SESSION ) && $_SESSION['backend_version'] != $expected_version ) {
Save the file.
Restart NfSen:
/etc/init.d/nfsen restart
iptables -I INPUT -p tcp –dport 80 -j ACCEPT
ReplyDeleteDoesn't work either.
Lot's of errors on that page.
/opt/nfsen-1.3.6p1/cp etc/nfsen-dist.conf /opt/nfsen-1.3.6p1/etc/nfsen.conf
ReplyDeleteand then
vi /etc/nfsen.conf
???
Umm we did not copy nfsens.conf to /etc/
That tutorial is full of errors actually, you need to adapt a bit an check every line for logical or "typo" mistakes.
ReplyDelete