[netsa-tools-discuss] rwflowpack won't start

[Steven Duffield]

Hi,

I had a server reboot on me unexpectedly and when it came back 
rwflowpack failed to start. I've tried "service rwflowpack start" a few 
times but it still fails to restart. It's a centos7 system but journald 
and syslog don't give much away (at least to my untrained eye) even with 
LOG_LEVEL=debug. Seems to fail at the same place each time...

Nov 29 19:02:27 flowm systemd: Starting LSB: start and stop SiLK 
rwflowpack daemon...
Nov 29 19:02:27 flowm rwflowpack[16198]: Started logging at 2018-11-29 
19:02:27Z
Nov 29 19:02:27 flowm rwflowpack[16198]: '/usr/sbin/rwflowpack' 
'--sensor-configuration=/etc/silk/sensor.conf' 
'--compression-method=best' '--site-config-file=/etc/silk/silk.conf' 
'--output-mode=sending' 
'--sender-directory=/data/silk-processing/packer_dest' 
'--incremental-directory=/data/silk-processing/packer_work' 
'--pidfile=/var/lib/rwflowpack/log/rwflowpack.pid' '--log-level=debug' 
'--log-destination=syslog'
Nov 29 19:02:27 flom rwflowpack[16198]: Forked child 16200.  Parent exiting
Nov 29 19:02:27 flowm rwflowpack[16200]: Using packing logic from 
/usr/lib64/silk/packlogic-twoway.so
Nov 29 19:02:27 flowm rwflowpack[16200]: Creating stream cache
Nov 29 19:02:27 flowm rwflowpack[16200]: Checking incremental directory 
for old files...
Nov 29 19:02:27 flowm rwflowpack[16200]: No incremental files to move.
Nov 29 19:02:27 flowm rwflowpack[16200]: Creating NetFlowV9 Reader for 
probe 'sensor1' on 6000
Nov 29 19:02:28 flowm rwflowpack: Starting rwflowpack:#011[Failed]
Nov 29 19:02:28 flowm systemd: rwflowpack.service: control process 
exited, code=exited status=1
Nov 29 19:02:28 flowm systemd: Failed to start LSB: start and stop SiLK 
rwflowpack daemon.
Nov 29 19:02:28 flowm systemd: Unit rwflowpack.service entered failed state.
Nov 29 19:02:28 flowm systemd: rwflowpack.service failed.

If I remove sensor1 from sensor.conf it fails at sensor2.

I tried starting it from the commandline as a quick check and got this...

/usr/sbin/rwflowpack --sensor-configuration=/etc/silk/sensor.conf 
--compression-method=zlib --site-config-file=/etc/silk/silk.conf 
--input-mode=stream --output-mode=incremental-files 
--root-directory=/data/FLOWS 
--pidfile=/var/lib/rwflowpack/log/rwflowpack.pid --log-level=debug 
--log-destination=syslog 
--incremental-directory=/data/silk-processing/packer_dest --no-daemon


/usr/sbin/rwflowpack: symbol lookup error: /lib64/libflowsource.so.17: 
undefined symbol: fbSessionAddTemplateCtxCallback2


Any pointers on where to look or what to try next would be most appreciated.

Thanks,

Steven.


-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.