# ntop, rrd and 'arbitrary graphs' - howto?

## tedbar123

Running ntop 3.2-r1 on x86.

It mostly works just fine, but not quite all  :Sad:  I'm interested in monitoring the ssh traffic on eth0 on a box. Following:

rrd -> arbitrary graphs -> SSH Sent Bytes returns an error "error while building graph ...." Clearly this is because the file has not been created, looking at /var/lib/ntop/rrd/interfaces/eth0 the file 'IP SShSentBytes.rrd' does not exist.

rrd is running fine (I think - see ntop log extract below) and I turned on logging of all items (Domains, Flows, Hosts, Interfaces and Matrix) then restarted the plugin just in case it was not under interfaces.

Is there a howto that explains how to get these additional reports up and running? Please point me in the right direction.

thanks

Ted

===================================================================

Wed Feb 15 15:24:58 2006  THREADMGMT[t49156]: SIH: Started thread for idle hosts detection

Wed Feb 15 15:24:58 2006  THREADMGMT[t65541]: DNSAR(1): Started thread for DNS address resolution

Wed Feb 15 15:24:58 2006  Calling plugin start functions (if any)

Wed Feb 15 15:24:58 2006  SSL is present but https is disabled: use -W  for enabling it

Wed Feb 15 15:24:58 2006  INITWEB: Initializing web server

Wed Feb 15 15:24:58 2006  INITWEB: Initializing tcp/ip socket connections for web server

Wed Feb 15 15:24:58 2006  THREADMGMT[t16386]: NPA: network packet analyzer (packet processor) thread running [p8250]

Wed Feb 15 15:24:58 2006  THREADMGMT[t32771]: SFP: Fingerprint scan thread starting [p8251]

Wed Feb 15 15:24:58 2006  THREADMGMT[t49156]: SIH: Idle host scan thread starting [p8252]

Wed Feb 15 15:24:58 2006  THREADMGMT[t65541]: DNSAR(1): Address resolution thread running [p8253]

Wed Feb 15 15:24:58 2006  INITWEB: Initialized socket, port 3000, address (any)

Wed Feb 15 15:24:58 2006  INITWEB: Waiting for HTTP connections on port 3000

Wed Feb 15 15:24:58 2006  INITWEB: Starting web server

Wed Feb 15 15:24:58 2006  THREADMGMT[t81926]: INITWEB: Started thread for web server

Wed Feb 15 15:24:58 2006  Listening on [eth0]

Wed Feb 15 15:24:58 2006  Loading Plugins

Wed Feb 15 15:24:58 2006  THREADMGMT[t81926]: WEB: Server connection thread starting [p8257]

Wed Feb 15 15:24:58 2006  Searching for plugins in /usr/lib/ntop/plugins

Wed Feb 15 15:24:58 2006  Note: SIGPIPE handler set (ignore)

Wed Feb 15 15:24:58 2006  THREADMGMT[t81926]: WEB: Server connection thread running [p8257]

Wed Feb 15 15:24:58 2006  WEB: ntop's web server is now processing requests

Wed Feb 15 15:24:58 2006  ICMP: Welcome to ICMP Watch. (C) 1999-2005 by Luca Deri

Wed Feb 15 15:24:58 2006  LASTSEEN: Welcome to Host Last Seen. (C) 1999 by Andrea Marangoni

Wed Feb 15 15:24:58 2006  NETFLOW: Welcome to NetFlow.(C) 2002-05 by Luca Deri

Wed Feb 15 15:24:58 2006  PDA: Welcome to PDA. (C) 2001-2005 by L.Deri and W.Brock

Wed Feb 15 15:24:58 2006  RRD: Welcome to Round-Robin Databases. (C) 2002-04 by Luca Deri.

Wed Feb 15 15:24:58 2006  SNMP: Welcome to SNMP. (C) 2004 by F.Fusco and G.Giardina

Wed Feb 15 15:24:58 2006  SFLOW: Welcome to sFlow.(C) 2002-04 by Luca Deri

Wed Feb 15 15:24:58 2006  **WARNING** Unable to load plugin '/usr/lib/ntop/plugins/xmldumpPlugin.so'

Wed Feb 15 15:24:58 2006  **WARNING** Message is '/usr/lib/ntop/plugins/xmldumpPlugin.so: undefined symbol: dumpXML'

Wed Feb 15 15:24:58 2006  Calling plugin start functions (if any)

Wed Feb 15 15:24:58 2006  RRD: Welcome to the RRD plugin

Wed Feb 15 15:24:58 2006  RRD: Mask for new directories is 0700

Wed Feb 15 15:24:58 2006  RRD: Mask for new files is 0066

Wed Feb 15 15:24:58 2006  THREADMGMT: RRD: Started thread (t98311) for data collection

Wed Feb 15 15:24:58 2006  THREADMGMT[t16384]: ntop RUNSTATE: INITNONROOT(3)

Wed Feb 15 15:24:58 2006  Now running as requested user 'nobody' (65534:65534)

Wed Feb 15 15:24:58 2006  **WARNING** INIT: Unable to create pid file (/var/lib/ntop/ntop.pid)

Wed Feb 15 15:24:58 2006  Note: Reporting device initally set to 0 [eth0] (merged)

Wed Feb 15 15:24:58 2006  THREADMGMT[t16384]: ntop RUNSTATE: RUN(4)

Wed Feb 15 15:24:58 2006  THREADMGMT[t114696]: NPS(1): Started thread for network packet sniffing

Wed Feb 15 15:24:58 2006  THREADMGMT[t98311]: RRD: Data collection thread starting [p8258]

Wed Feb 15 15:24:58 2006  THREADMGMT[t114696]: NPS(1,eth0): pcapDispatch thread starting [p8259]

Wed Feb 15 15:24:58 2006  THREADMGMT[t114696]: NPS(1,eth0): pcapDispatch thread running [p8259]

Wed Feb 15 15:24:58 2006  THREADMGMT[t32771]: SFP: Fingerprint scan thread running [p8251]

Wed Feb 15 15:24:58 2006  THREADMGMT[t49156]: SIH: Idle host scan thread running [p8252]

Wed Feb 15 15:25:08 2006  THREADMGMT[t131081]: RRD: Started thread for throughput data collection

Wed Feb 15 15:25:08 2006  THREADMGMT[t98311]: RRD: Data collection thread running [p8258]

Wed Feb 15 15:25:08 2006  THREADMGMT[t131081]: RRD: Throughput data collection: Thread starting [p8265]

Wed Feb 15 15:25:08 2006  THREADMGMT[t131081]: RRD: Throughput data collection: Thread running [p8265]

======================================================================

----------

## haven

Recursively chmod everything in /var/lib/ntop to user ntop and group ntop i.e.

```
chmod -R ntop:ntop /var/lib/ntop
```

Then see if your graphs start working, its possibly a permissions problem. When I first ran ntop as root to set an admin password all the files were created as owner root (unsurprisingly) and I had to alter them to allow it to work.

oops just noticed the date on your message ... I'm hoping you figured it out  :Smile: 

----------

## lcj

that would be chown not chmod  :Smile: 

Anyway I'm using ntop 3.2-r1 and it segfaults after half an hour. Using -snmp switch to compile it properly and using Netflow plugin... I've read that CVS version is OK, but it doesn't have configure script...

----------

