Suggestion: Ignore those and wait for 2.3.x - not fixable. There's now even a hackish symlink to /usr/local under the PBI directory structure. Hopeless. PBI packaging format is broken by design and FUBARed.

@phil.davis:

That is because the data is not being written to local files, it is being sent to the database.

I may be a bit slow, but how exactly is it getting sent to the database? Teleported?

Another clean install, and now it seems to be working. However this time I went through the bandwidthd configuration page and set everything up. I don't think I did that on the last install. So, I would say this is completely my fault, thanks for entertaining me! pfSense is an awesome product!

Thanks doktornotor, much appreciated.

Hmmm, no. Cannot reproduce the issue. BTW, this thing is very much dead and has been so for quite some time. There are several forks, some of them even (claimed to be) IPv6 capable.  If someone wants to work on getting one of those into FreeBSD ports, feel free.

http://sourceforge.net/projects/bandwidthdipv6/
https://github.com/neatbasis/bandwidthd

The PBI shit is wrong. Move on.

1/ To check ntopng disk usage, run

du -sh /var/db/ntopng

The thing accumulated 20GiB worth of data in 10 days. Crazy.  ::)

2/ After your HDD got full after a month or so and you want to clean up the mess

While ntopng is running (!!!) do: # /usr/pbi/ntopng-*/local/bin/redis-cli 127.0.0.1:6379> FLUSHALL OK 127.0.0.1:6379> FLUSHDB OK 127.0.0.1:6379> exit

Stop ntopng service from the GUI.

Run # rm -rf /var/db/ntopng/ Go to Diagnostics - ntopng Settings, untick Historical Data Storage (!!!), click Change.

3/ No, not in a usable way ATM. Noone wants to wait days for the historical data to load.

See this for notes on the feature: https://redmine.pfsense.org/issues/4263#note-1
See this for howto on reclaiming the disk space wasted: https://forum.pfsense.org/index.php?topic=90146.msg542136#msg542136

The redis server has stop and ntopng service crash.

what is the problem ???

I mean I have zero issues like "I am unable to see the flows from the Lan interface". Monitoring ~15 interfaces will probably make your HDD explode soon.

https://forum.pfsense.org/index.php?topic=94792.msg528804#msg528804

Works just fine here, plus - what's suggested above. Looks like you had i386 install before, won't work with RRD DBs.

Hello,

This is linked to bug :
https://redmine.pfsense.org/issues/4567
Is there a way to reopen it ?

<piba-nl>if you open the file /usr/local/pkg/ntopng.xml in vi or any other editor and then substitute mkdir  by  safe_mkdir  on line 156 the warning should nolonger

Fixed thanks to PiBa-NL on freenode!</piba-nl>

Bump .. ! any help please …

bump?  :-[

I see there's no answers to my questions to ntop/ng, I'll post some updated info on the topic to see if someone recognizes anything.

I have installed a new virtual pfS 2.2.2 ("FW2") and installed softflowd on "FW1". FW2 only has one interface, WAN and some ports are opened on WAN side.
FW2 is placed on a special network dedicated to NMS systems, logging etc.
On FW1 in softflowd I have enabled some interfaces and on FW2 the WAN interface (not loopback). No timeout values set.
After having run this for a few days it seems the ntopng GUI works well and it looks good and all that, but as earlier noted not all speaking hosts are present in the statistics.

I have a number of other networks in FW1 and nothing from them is seen in ntopng on FW2.

I have checked with Wireshark inside the flow data actually being received by FW2 from FW1 and they indeed do contain flow info from other interfaces on FW1.

The exported flows are in version 9.

I downloaded a 2 GB file online and that traffic newer showes up in ntopng for the host in question.

Questions
–---------

In ntopng settings there's an option to save historical data, I guess this relates to data being available through the "Historical" interface in ntopng GUI?

How do I manage how many days worth of data is saved? An earlier installation filled up the entire disk of that system and I'd like to be able to manage this in a balanced manner.

Isn't there a setting somewhere to tell ntopng what networks to collect info for? I think there were some settings of that kind in the ntop GUI.

What am I missing?

TIA,