<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>By default, selinux is turned off in the server kicks I have, but I did give it a try. I was also wrong about Debian, I /was/ having issues, but it was failing first on the PID file location. I think I was hopeful because the error was different. ;)<br><br>I'll keep looking, but is there a chance the problems could be related to a kernel change? The 0.9.1 release hasn't been updated in some time, and even though it a great tool, could there be issues with something new in the OS's?<br><br>--Nick Cappelletti<br><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Craig Weinhold" <craig.weinhold@cdw.com><br><b>To: </b>"Nick Cappelletti" <nick@switchtower.org><br><b>Cc: </b>netflow-tools@mindrot.org<br><b>Sent: </b>Saturday, April 13, 2013 6:00:11 PM<br><b>Subject: </b>Re: [netflow-tools] CentOS Logsocket Issues<br><div><br></div>Not sure if this is what you're seeing, but I've had a bear of a time with selinux, the invisible security layer which is enabled by default in Centos.<br><div><br></div>For example, if you configure /etc/syslog.conf with "$AddUnixListenSocket /var/empty/dev/log" and then launch rsyslogd by hand, it creates the unix socket fine and then you can have it process flowd's log messages. But if you launch rsyslogd from the /etc/init.d/rsyslog script, it can't create the unix socket and doesn't log any error message at all. Tat's selinux at work in the background.<br><div><br></div>You can quickly disable selinux to see if that's the cause of your woes:<br><div><br></div> echo 0 >/selinux/enforce<br><div><br></div>If that is the problem, then you _should_ spend time to figure out how to make your stuff work with selinux. It's a headache. Use "ls -Z" to see what security characteristics each file has, and then use "chcon" to change the file type. For example, to fix the /etc/init.d/rsyslog script, I did this:<br><div><br></div> chcon -t etc_t /etc/init.d/rsyslog<br><div><br></div>-Craig<br><div><br></div><br><div><br></div><br>On Sat, 13 Apr 2013, Nick Cappelletti wrote:<br><div><br></div>> Hey everyone, <br>> <br>> I hope someone can help me out here. I'm attempting to configure flowd to send the created flows to a socket on a CentOS 6.4 server, but I'm not having any success. <br>> <br>> I'm using version 0.9.1 and I've tested it on a Debian server, so I know the logsocket functionality works. <br>> <br>> Is there perhaps a package I need to install to get the logsocket functionality to work? <br>> <br>> Here is my configuration: <br>> <br>> #### <br>> <br>> pidfile "/var/run/flowd.pid" <br>> logsock "/var/log/flowdata.socket" <br>> logfile "/var/flowdata" <br>> listen on 0.0.0.0:9995 <br>> listen on [::]:9995 <br>> store ALL <br>> accept all <br>> <br>> #### <br>> <br>> Here is the output from when I run flowd in debug mode: <br>> <br>> #### <br>> <br>> read_config: entering <br>> child_get_config: entering <br>> drop_privs: dropping privs without chroot <br>> send_config: entering fd = 4 <br>> send_config: done <br>> child_get_config: child config done <br>> recv_config: entering fd = 3 <br>> recv_config: ready to receive config <br>> Listener for [0.0.0.0]:9995 fd = 3 <br>> Adjusted socket receive buffer from 229376 to 524288 <br>> Setting socket send buf to 1024 <br>> Listener for [::]:9995 fd = 4 <br>> Adjusted socket receive buffer from 229376 to 524288 <br>> Setting socket send buf to 1024 <br>> privsep_init: entering <br>> drop_privs: dropping privs with chroot <br>> init_pfd: entering (num_fds = 0) <br>> init_pfd: done (num_fds = 3) <br>> client_open_log: entering <br>> answer_open_log: entering <br>> client_open_socket: entering <br>> answer_open_socket: entering <br>> connect to logsock: No such file or directory <br>> receive_fd: recvmsg: expected received 1 got 0 <br>> <br>> ### <br>> <br>> Thanks for any help! <br>> <br>> --Nick Cappelletti <br>> <br></div><div><br></div></div></body></html>