Ubuntu 10.04.1 LTS Nedi using nginx Fix 502 Bad Gateway and 1 issue

[nedijedi]

This morning I upgraded to Ubuntu 18.04.1 LTS (GNU/Linux 4.15.0-43-generic x86_64).  The web site was broke and I got it working again by 

editing  /etc/php/7.2/fpm/pool.d/www.conf and adding listen.mode = 0666 and
editing /etc/nginx/sites-available/default to have fastcgi_pass unix:/var/run/php/php7.2-fpm.sock; instead of 7.1.

The Monitoring-Health page I had problems was working this morning so not sure what was causing the issue.

The above should help anyone who installed using the generic Ubuntu installation.
Thanks!

[nedijedi]

Progress update
It looks after upgrading bionic is missing and maybe some other stuff which is required to handle netflow.

I was getting stat() error '/var/nfdump/default/nfcapd.201901051315': File not found!
Empty file list. No files to process
when I ran ./flowi.pl from the nedi folder.

checking the perldoc flowi.pl it shows that you need to install the following
 sudo apt-get install gcc make flex bison libbz2-dev libpcap-dev
 sudo apt-get install nfdump - nfdump was not missing.

Bionic was clearly missing. Still not working though.

Needed to run
sudo nfcapd -e -w -D -j -l/var/nfdump/default -p 2055  -- note changing the path in nedi config to match /var/cache/nfdump didn't work for me so I just modified the service start folder.
Files are showing up in /var/nfdump/default now

[nedijedi]

I started getting this error, "no matching cipher found".

The fix was to edit;
/etc/ssh/ssh_config

uncomment the Ciphers line

   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc

NeDi is so great!

[rickli]

Thanks for the info and feedback

[nedijedi]

Netflow stopped working after a restart

-rw-r--r-- 1 root root 1459251 Jan 18 13:35 nfcapd.201901181330
-rw-r--r-- 1 root root 1445174 Jan 18 13:40 nfcapd.201901181335
-rw-r--r-- 1 root root 1458065 Jan 18 13:45 nfcapd.201901181340
-rw-r--r-- 1 root root 1334153 Jan 18 13:50 nfcapd.201901181345
-rw-r--r-- 1 root root 1330496 Jan 18 13:55 nfcapd.201901181350
-rw-r--r-- 1 root root  693644 Jan 18 13:57 nfcapd.201901181355
-rw-r--r-- 1 root root 7673680 Jan 18 14:02 nfcapd.201901181357
-rw-r--r-- 1 root root 8046968 Jan 18 14:07 nfcapd.201901181402
-rw-r--r-- 1 root root 7334100 Jan 18 14:12 nfcapd.201901181407
-rw-r--r-- 1 root root 8080800 Jan 18 14:17 nfcapd.201901181412
-rw-r--r-- 1 root root 8129076 Jan 18 14:22 nfcapd.201901181417
-rw-r--r-- 1 root root 7860736 Jan 18 14:27 nfcapd.201901181422
-rw-r--r-- 1 root root 7497456 Jan 18 14:32 nfcapd.201901181427
-rw-r--r-- 1 root root 7913904 Jan 18 14:37 nfcapd.201901181432
-rw-r--r-- 1 root root 3564556 Jan 18 14:40 nfcapd.201901181437
-rw-r--r-- 1 root root     276 Jan 18 14:40 nfcapd.current.2479
-rw-r--r-- 1 root root     115 Jan 18 14:40 .nfstat

nedi:/var/nedi$ sudo ./flowi.pl       
stat() error '/var/nfdump/default/nfcapd.201901181435': File not found!
Empty file list. No files to process

stat() error '/var/nfdump/default/nfcapd.201901181435': File not found!
Empty file list. No files to process

I restarted the server and nfcapd started making files on some odd 5 minute interval, running flowi.pl looks like it is only trying to find files on the 5 minute interval.  Is there some flow processing thing where the file needs to be on the 0 and 5 minutes?

[rickli]

There are options for nfcapd. See perldoc flowi.pl for more info...