Install NFSEN (Centos 6 & Fedora 20)

Found myself having to do this a few times now and it usually ends up being quite messy in the end so some nice clean instructions from a real sysadmin. All credit goes to @gowmonster. I’ve tested this guide against Fedora 20 and Centos 6. This guide follows Centos 6 but the commands are more or less the same.

NFSEN is an awesome (and opensource!) netflow collector supporting various versions of netflow, sflow and recently ipfix. It can also make the start of a DDOS mitigation system 😀

Install the required packages:

yum install httpd php perl perl-TimeDate perl-Pod-Escapes perl-Pod-Simple perl-Test-Pod perl-MailTools libdbi lua mysql-server net-snmp-utils perl-rrdtool gcc make flex rrdtool-devel byacc perl-Socket6

Download the latest sources for NFSEN and NFDUMP into the same directory e.g /tmp. Now lets extract and install nfdump

tar -zxvf nfdump-1.6.11.tar.gz
tar -zxvf nfsen-1.3.6p1.tar.gz

mv nfdump-1.6.11 /usr/local/src/
mv nfsen-1.3.6p1 /usr/local/src/

cd /usr/local/src/nfdump-1.6.11/
./configure –enable-nfprofile
make install
make clean

Now to setup and install NFSEN (this is just an example config file)

cd ../nfsen-1.3.6p1/
cat > etc/nfsen.conf << EOF
# Example Config file!
$BASEDIR = “/usr/local/nfsen”;
$HTMLDIR = “/var/www/nfsen/”;
$PREFIX = ‘/usr/local/bin’; $USER = “apache”;
$WWWUSER = “apache”;
$WWWGROUP = “apache”;
$EXTENSIONS = ‘all’;
$ZIPcollected = 1;
$ZIPprofiles = 1;

# Exporters are defined here. Name is what will be displayed in NFSEN
%sources = (

‘’ => { ‘port’ => ‘9992’, ‘col’ => ‘#000000’, ‘type’ => ‘netflow’ },
‘’ => { ‘port’ => ‘9993’, ‘col’ => ‘#000000’, ‘type’ => ‘netflow’ },

$low_water = 90;
$syslog_facility = ‘local3’;
@plugins = (
%PluginConf = (
demoplugin => {
param2 => 42,
param1 => { ‘key’ => ‘value’ },
otherplugin => [
‘mary had a little lamb’
$MAIL_FROM = ‘’;
$SMTP_SERVER = ‘localhost’;
Alert ‘@alert@’ triggered at timeslot @timeslot@

mkdir /var/www/nfsen/
./ etc/nfsen.conf

Setup httpd:

/sbin/chkconfig httpd on

vi /etc/httpd/conf/httpd.conf
below line Alias /error/ “/var/www/error/” add

Alias /nfsen/ “/var/www/nfsen/”

Save the file
service httpd start

Now to make an init script so we can auto start NFSEN on boot etc.

cat > /etc/init.d/nfsen <<EOF
# chkconfig: – 50 50
# description: nfsen

case “$1” in
$DAEMON start
$DAEMON stop
$DAEMON status
$DAEMON stop
sleep 1
$DAEMON start
echo “Usage: $0 {start|stop|status|restart}”
exit 1

exit 0

Make our init script executable, configure to start on boot and start the service now 🙂

chmod 755 /etc/init.d/nfsen
chkconfig nfsen on
service nfsen start

Send it some flows on the ports you configured then browse to http://myserver/nfsen, job done hopefully. Just remember it make take some time to populate depending on how often your exporter sends templates.



  • Thanks for providing the guide. Ran into some issues and am still having trouble.
    Tried copying your sample nfsen.conf (modifying the %sources to what I have) and was getting an error initially – not having installed perl-Socket6.
    After installing perl-Socket6 I now get the below.

    [root@NMC nfsen-1.3.6p1]# ./ etc/nfsen.conf
    Check for required Perl modules: All modules found.
    Setup NfSen:
    Version: 1.3.6p1: $Id: 53 2012-01-23 16:36:02Z peter $

    Perl to use: [/usr/bin/perl]
    nfdump tools installation error: ‘nfprofile’ not found in ‘/usr/local/bin’ at ./ line 202, line 1.


    Any ideas on what still needs done?

  • Hi Matt

    Thanks for the feedback I updated the post to include perl-Socket6.
    Regarding nfprofile not being found did you compile/install ndump with “./configure –enable-nfprofile”?


  • hi,

    I am Configuring nfsen without any error.Facing problem only no packet shown in graph. no error when perl script,nfsen except get log Error reading channel stat information,Missing key “first”.

    i could not find any cause.

    With Thanks

  • Hi Alok

    Did this start graphing after leaving it running for a while? Sometimes takes a little while for the templates to be send/processed.


  • Also got a lot of errors when trying to start nfsen.

    # service nfsen start
    Subroutine Lookup::pack_sockaddr_in6 redefined at /usr/share/perl5/vendor_perl/ line 66.

    Running on CentOS 7.

    Any ideas?

  • I seem to be running into the same issue as Matt.

    [root@test-v nfsen-1.3.6p1]# ./ etc/nfsen.conf
    Check for required Perl modules: All modules found.
    Setup NfSen:
    Version: 1.3.6p1: $Id: 53 2012-01-23 16:36:02Z peter $

    Perl to use: [/usr/bin/perl]
    nfdump tools installation error: ‘nfprofile’ not found in ‘/usr/local/bin’ at ./ line 202, line 1.
    [root@test-v nfsen-1.3.6p1]#

    This is Fedora 20 and I did compile with nfdump with successfully ‘./configure –enable-nfprofile’

    Any help or ideas in this matter would be greatly appreciated.


  • Matt and Eric,

    In the nfsen.conf you need to point the installer to the nfdump binaries.
    If you installed nfdump from yum, they are in /usr/bin, not /usr/local/bin,

    $PREFIX = ‘/usr/bin’;

    Then rerun the installer.

  • hi
    [root@localhost init.d]# chmod 755 /etc/init.d/nfsen
    [root@localhost init.d]# chkconfig nfsen on
    service nfsen does not support chkconfig

  • So when i navigate to http://myserver/nfsen i get a 403 forbidden error. ‘This website requires you to log in”

    From what i understand, alias would fall under the /var/www directory which allows all to access.

    I even created:

    AllowOverride All
    Require all granted

    Still was not able to access http://myserver/nfsen.

    Any ideas??

    (And yes i replaced myserver with the IP of the server) 😉

  • I am receiving a HTTP 403 – ‘This website requires you to log in’ error when navigating to http://myserver/nfsen

    I even specified:

    AllowOverride All
    Require all granted

    Although it should fall under

    AllowOverride None
    # Allow open access:
    Require all granted

    Any ideas?

    (I did replace myserver with the servers IP address btw 😉 )

  • HI gman372

    I’ve never seen that before and I dont think anything in this guide should configure authentication for your webserver. Possible there is other apache config on there interfering? Perhaps the logs on your server could highlight whats going on?


  • After Installing I just get the following when I try and start nfsen:

    # bin/nfsen start
    bash: bin/nfsen: %%PERL%%: bad interpreter: No such file or directory

    Any ideas? Everything else seems to have gone fine.