Netflow still reporting errors with H3C devices
Heriam opened this issue · 2 comments
Heriam commented
Hi all. I tried to use Logstash to collect h3c netflow v9 messages but the following errors are reported:
[2018-07-18T11:00:50,548][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
[2018-07-18T11:00:53,546][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
[2018-07-18T11:00:56,546][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
[2018-07-18T11:01:08,546][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
[2018-07-18T11:01:23,550][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
[2018-07-18T11:01:23,558][WARN ][logstash.codecs.netflow ] Template length exceeds flowset length, skipping {:template_id=>3281, :template_length=>65615, :record_length=>84}
Both logstash and the netflow-codec plugin are most updated. Could anyone help identify what the problem is? Packet captures are attached here:
http://p3s9jxyns.bkt.clouddn.com/tmp/h3c-netstream.cap
Thank you very much!
@jorritfolmer could you kindly have a look at this please?
jorritfolmer commented
Thanks for the pcap!
I've just released v4.1.0 with support for devices using VarString in Netflow v9, like H3C Netstream
Heriam commented
Problem solved! Thank you @jorritfolmer !