NAME

     nfexpire — manage expiration of flow files based on time or volume.

SYNOPSIS

     nfexpire -l directory
     nfexpire -r directory
     nfexpire -e directory [-s maxsize] [-t maxlife] [-w watermark] [-T runtime]
     nfexpire -u path [-s maxsize] [-t maxlife] [-w watermark]

DESCRIPTION

     nfexpire manages the expiration of netflow data files based on their lifetime and/or the
     total volume of all flow files. The flow files are usually created be any nfdump collector (
     nfcapd sfcapd or nfpcapd )

     nfexpire is used to setup the expire parameters (maintainance mode) or to actually run the
     expire process (expire mode) based on these parameters. The expire process can be triggered
     by either a cron job, by the collector process itself (nfcapd, sfcapd auto expire mode), or
     by running nfexpire manually.

     nfexpire interacts with the collector, therefore it is safe to setup and expire files from a
     directory which is used by any collector to store flow files.

     nfexpire stores a statistics file .nfstat in the given directory to maintain the status and
     parameters. You should not modify this file manually unless you know what you do. The
     directory argument for nfexpire corresponds to the -l argument on the collector comman line.

     The options are as follows:

     -l directory
             List the current expire statistics from directory datadir. If this is the first time
             nfexpire runs on this directory it automatically rescans the flow files first to
             update the statistics. If this an active data directory used by any collector, the
             statistics are updated automatically.

     -r directory
             Rescans the data directory, even if a statistics file already exist. This command
             can be used to update the statistics after a disk full event, after manually
             changing the compression of the files, or if files have beed deleted manually or
             manipulated otherwise.

     -e directory
             Expire data files according to the parameters maxsize and maxlife.  The expire
             parameters are taken from the statfile, if they were previously set with -u or they
             can be overwritten with the additional options -s -t and -w.  Files are deleted from
             the oldest towards the latest according both limits and stops at the watermark below
             the limit.

     -u directory
             Updates the expire parameters such as size and lifetime limits, specified by -s -t
             and -w and stores them in the statfile as default values. Any running collector
             process in auto expire mode will take these new values starting with the next expire
             cycle.  Running nfexpire the next time in expire mode will take these new parameters
             unless they will be overwritten by the arguments -s -t and -w.

     -s maxsize
             This option sets the max size limit for all data files.  maxsize accepts values such
             as 100M, 100MB 1G 1.5G (number + quantity factor) etc. Accpeted size factors are K,
             KB, M, MB, G, GB and T, TB. If no factor is given, bytes (B) is assumed.  A value of
             0 disables the max size limit.

     -t maxlife
             This option sets the max lifetime for the data files.  maxlife accepts values such
             as 31d, 240H 1.5d (number + quantity factor) etc. Accpeted time factors are w
             (weeks) d (days) H (hours). If no factor is given, hours (H) is assumed.  A value of
             0 disables the max lifetime limit.

     -w watermark
             This options sets the water mark in % of any limit. It applies to both limits
             maxsize and maxlife.  The expire process is triggered if any of the limits are hit
             and stops, if the new value reaches the watermark level in % of the limit. This
             means files are allowed to grow between watermark % lower level and 100% upper
             level. The default for watermark is 95%.

     -T runtime
             This option forces nfexpire to end the expire task after runtime seconds, even if
             the task is not yet completed.  nfexpire updates the statistics and exists cleanly,
             so it will pick up next time where it left.  By default nfexpire runs until the task
             is done.

     -p      This option puts nfexpire in profile mode. Only legacy NfSen will need this option.

     -Y      This option prints a NfSen compatible statistic. Only legacy NfSen will need this
             option.

     -h      Print help text on stdout with all options and exit.

RETURN VALUES

     nfexpire returns 0 on success and 255 otherwise.

SEE ALSO

     nfdump(1) nfcapd(1) sfcapd(1)