CMDPHP Column with field id 34 Does not exist for V4 flow template

[Catalyst4948]

These kinds of errors still pop up quite often.

[TheWitness]

What hardware vendor and device type is this? What is the streams flowview version (v9 or IPFIX)? We have been making heavy changes to the plugin. You might also want to consider downloading a fresh copy.

[Catalyst4948]

Cisco equipment model CISCO2911/K9 (revision 1.0)
I configured netflow v9 on it

[TheWitness]

Edit the listener, and then go to the Templates tab and take a screen grab and upload it.

[TheWitness]

I'll be committing a change shortly. You might want to grab that and do an upgrade too. I'll post here once it's done.

[Catalyst4948]

[Catalyst4948]

The following error started appearing in the logs

[TheWitness]

I suspect you have a protocol filter in place. Let me verify that this is working.

[Catalyst4948]

Yes, I only indicated it in the filters TCP and UDP Protocols

[TheWitness]

Grab the latest copy and of the plugin and then let's see what other errors are going on. Note that in Template 256, there is no Flow ID: 45, but there is for Template 258.

The reason that we are glad you are here is that we are trying to identify the minimal subset of Field ID's that constitute a full 'common' schema, and your Template 256 for that Cisco device tells us something new.

[Catalyst4948]

Sorry, I don’t quite understand what I need to do and how to select this Template

[TheWitness]

Download a fresh copy of the plugin, then:

php -q flowview_upgrade.php --forcever=3.3
systemctl restart flow-capture

[TheWitness]

The protocol errors should go away afterwards. You may see some errors when you update the plugin, but they should be transient.

[Catalyst4948]

I understand you were talking about these errors
when I made the transition to 3.3

[Catalyst4948]

somehow he began to behave strangely)

[TheWitness]

Take a fresh pull and those 'Column with field id' warnings should go away.

[Catalyst4948]

unfortunately it didn't give any results
the same errors keep popping up

[TheWitness]

Did you not update to the latest develop? Field 34 is no long required. You will have to restart flow-capture though...

[TheWitness]

Closing this one. If you still get those errors (not the 34 but the other ones), open a new ticket.

[TheWitness]

Ope, I know what the other issue is now. Stop using your own DNS and use local DNS for the moment. I have to fix some buggy code there. I'll open the ticket separately.

[TheWitness]

New bug here: #141