[j-nsp] about file /var/log/sampled

[Stefan Fouant]

I believe that line is indicating that the flow was removed from the
flow-cache.  It probably doesn't need to display any more additional
information than that since it's merely clearing the record.  If you want to
find out what interface/s the flow was traversing you'll probably need to
scour the log/s for the initial entry inserting the flow record into the
flow-cache.  That will give you more information with regards to which
interfaces the flow is traversing.

HTHs.

Stefan Fouant
Principal Network Engineer
NeuStar, Inc. - http://www.neustar.biz

2008/6/12 qingdai <qingdai at 163.com>:

> It's sampling action in a firewall filter term ,and implied on more than
> one interfaces . This's a line of the file :
>
> rr DELETE: pref 202.87.248.0 len 23 doesn't exist
>
> What's the meaning ? If is's a flow , then which interface is it from ?
>
>
>
> 在2008-06-12，"Stefan Fouant" <sfouant at gmail.com> 写道：
>
>  That's the log file for sampled traffic if you've enabled sampling on an
> interface or via a action-modifier in a firewall filter term.  It's similar
> to the information you would send to a CFlowD server if you've got one
> configured.  What else do you want to know?
>
> Stefan Fouant
> Principal Network Engineer
> NeuStar, Inc. - http://www.neustar.biz
> On Thu, Jun 12, 2008 at 6:07 AM, qingdai <qingdai at 163.com> wrote:
>
>>
>> how can i find help messages about sampling file /var/log/sampled ? I
>> wanted to know info at /var/log/sampled .
>>
>>
>> thanks
>>
>>
>> _______________________________________________
>> juniper-nsp mailing list juniper-nsp at puck.nether.net
>> https://puck.nether.net/mailman/listinfo/juniper-nsp
>>
>
>
>
> ------------------------------
> 小户型月供一千多 <http://popme.163.com/link/3982_0613_2600.html>