[netsa-tools-discuss] timestamp issue post the core router upgrade from Nexus 7000 series to Nexus 7700 series.

[Mark Thomas]

Sanjay-

I do not know the cause of your issue, but there are a couple of
things you can do to help you discover its source.

1. You can modify the sensor.conf file used by rwflowpack to log how
it uses the time-related information elements on a record to compute
the record's timestamps.

To do this, modify the probe block[1] so that the log-flags
statement includes record-timestamps.  If there is already a
log-flags statement, append record-timestamps to it.  If it is not
present, then add this line to the probe block

  log-flags default record-timestamps

2. Setting the environment variable SILK_IPFIX_PRINT_TEMPLATES to 1
prior to starting rwflowpack[2] causes it to write log messages that
describe each template as it arrives.

This output is less helpful than record-timestamps, but it will show
which time fields are present in each record.


Note that both of those approaches produce many log messages.

I hope that helps you find the source of the issue.  If you would
like assistance in understanding the log files, please let me know.

Thanks,

-Mark

[1]https://tools.netsa.cert.org/silk/sensor.conf.html#Probe-Block
[2]https://tools.netsa.cert.org/silk/rwflowpack.html#ENVIRONMENT


-----Original Message-----
From: Sanjay Liman <Sanjay at netmagicsolutions.com>
Date: Sun, 25 Nov 2018 15:53:57 +0000
To: "netsa-tools-discuss at cert.org" <netsa-tools-discuss at cert.org>
Subject: [netsa-tools-discuss] timestamp issue post the core router upgrade
 from Nexus 7000 series to Nexus 7700 series.

Hi,

We recently upgraded both our core router hardware from Nexus 7000 series to Nexus 7700 series.
Core 1 was upgraded on 02nd  Sep 2018 and Core 2 was upgraded on 13th Oct 2018.

Post the hardware upgrade the rwflowpack is writing the data into a single file rather than creating and writing to per day file.

The only difference in Cisco Nexus 7700 series hardware that we have
deployed is that the new hardware is having the M3 line cards whereas
the old hardware had M1 series line card.

I am sure there must be deployments of flow-viewer/SiLk with Cisco
Nexus 7706. Has anyone faced similar issue? How to overcome this.?

Regards,


Sanjay Liman
Vice President - IT Operations
IT Operations
Netmagic (An NTT Communications Company)
Direct: +91 +91 22 40099132
Cell: +91 9821078497
Email: Sanjay at netmagicsolutions.com
[https://www.netmagicsolutions.com/assets/images/EDM/images/ntt-com-netmagic-logo2018.jpg]
<https://www.netmagicsolutions.com/>

Data Center Services
<http://www.netmagicsolutions.com/datacenter-services> | Hosted IT
Infrastructure<http://www.netmagicsolutions.com/managed-dedicated-servers-hosting-in-india.html>
| Cloud Services
<http://www.netmagicsolutions.com/cloud-infrastructure-services> |
Managed
Services<http://www.netmagicsolutions.com/infrastructure-management-services>
| Infrastructure
Application<http://www.netmagicsolutions.com/simpliapp-overview> |
SD-WAN<https://www.netmagicsolutions.com/sd-wan>


[https://www.netmagicsolutions.com/assets/images/EDM/images/SD-wan-mail-banner.jpg]<https://www.netmagicsolutions.com/sd-wan>