netflow and samplicator

Are you running it as root?

I believe most, if not all, Cisco devices support multiple collectors being configured on their own...

Yes, I am running as root.  I am attempting to simplify our configurations - one syslog entry, one netflow entry. replicating the data from there makes life much easier, for us.

It also adds one more single point of failure.  Not a fan of that concept.  I would only use something like the samplicator when I needed to, either had a netflow source that wouldn't send to multiple collectors if I needed it, or maybe use it as a proxy for a netflow source that didn't have direct access to the collector.   A couple lines in a configuration are more reliable than another box forwarding the messages for you.

At a previous job someone had set up a pair of high-end syslog collectors as a mirror of each-other.   Only one would receive syslog messages and it was set up to forward to the "backup".  This was on a top-secret network that had no outside connectivity.  One day someone noticed that the main collector had been down for several days.   Had we set it up with two different logging entries, it wouldn't have been a problem.  But with the way it was set up, with the primary box going down there was no way for the backup box to continue getting the syslogs so we lost out on several days worth of potentially important information.

Similar setup to what you're describing.  What will you do if this intermediate box fails?  Will you be ok with losing data for that time period on both of your collectors?

Thanks for your comments, but does not help me solve my problem.

I have used samplicator a while back. If I recall correctly, the -S spoofed the address when I tried. I think it sources from port 2000 by default. Maybe remove the -s and the -p option and have one of the flow sources send to port 2000 of your samplicator? That way you startup the samplicator with all the defaults and just pass -S and the destinations as arguments. Just a troubleshooting thought.

Were either of you successful in getting this tool to work?  Most of our customers have leveraged nProbe in the past for this kind of functionality. 

I have it running, and love it. So easy to do..

I think I ended up upgrading my packages - and make sure is "-S" (case is very important.)

cant remember doing anything else,.