Docs

Troubleshooting

The most common NfSen failures and the exact commands that fix them — including what to do when your VPS disk fills up completely.

Common problems and fixes

Problem	Fix
Web UI shows `Can not initialize globals` / `nfsend connect() error: No such file or directory` / `nfsend - connection failed!!`	The nfsend daemon is not running. On the first start after switching to the data folders (bind mounts), this means the `live` profile is missing (an empty `nfsen-stat/` folder hides it and NfSen refuses to start). Fix once: `docker compose up -d --build` — the entrypoint re-seeds the profile automatically. Then check `docker logs netlens` for `nfsend .... running`.
Web UI shows `nfsend connect() error` (daemon was running before)	`docker restart netlens`, or stop/start the daemon.
Config changes not showing after reconfig	Do a full restart of the nfsen daemon.
`Error: missing parameter 'IP' for multiple sources collector`	Add `'IP' => '0.0.0.0'` to all existing sources manually — see the sources guide.
`Reconfig: No changes found!`	The source name doesn't exist — check `%sources` in `nfsen.conf`.
Port already in use	Change the Apache port in `docker-compose.yml`.
Can't access port 8070	Check the firewall: `ufw allow 8070/tcp`.
NfSen not starting	`docker logs netlens --tail 30`, then `docker restart netlens`.
`nfsend connect() error` after disk full	The socket is dead. Restart the container: `docker restart netlens`.
Login page rejects a password you're sure is right	Reset it instantly, no restart: `docker exec netlens htpasswd -b /var/nfsen/etc/.htpasswd admin <newpass>` (file lives at `nfsen-etc/.htpasswd` on the host).

No flow files

Confirm the router exports NetFlow v5, v9, or IPFIX to the host IP.
Confirm the correct UDP port is published and allowed by the firewall.
Check the source port in nfsen.conf and reconfigure the daemon.
Inspect docker logs netlens and nfsen-data/live/.

inspect

docker compose ps
docker logs --tail=100 netlens
find nfsen-data/live -maxdepth 2 -type f | head

LibreNMS shows no Netflow tab

Use the LibreNMS integration guide verification checklist. Common causes are an empty nfsen_suffix, a wrong source/device name, incorrect nfsen_subdirlayout, or an nfdump version mismatch.

Storage full — recover disk space

NfSen's NetFlow capture files accumulate quickly. When your VPS disk fills up (100%), docker exec commands fail with:

symptom

OCI runtime exec failed: write /tmp/runc-processXXXXXX: no space left on device

And nfsen stop fails because the Unix socket can't be written to:

symptom

setlogsock(): type='unix': path not available

Step 1 — Free a few MB to get Docker working again

Run these host-level commands (no docker exec needed):

free space

docker system prune -f
docker builder prune -f

# if that's not enough, also clean system logs
sudo journalctl --vacuum-time=1d
sudo rm -f /var/log/syslog.1 /var/log/kern.log.1 2>/dev/null; true

# check how much space you have now
df -h /

You only need ~50 MB free for docker exec to work again.

Step 2 — Stop everything and delete the data

Method A — Quick (if docker stop works):

method A

# Stop the entire container (always works - doesn't need the nfsen socket)
docker stop netlens

# Delete the flow data directly from the data folders (bind mounts)
rm -rf nfsen-data/live/*
rm -rf nfsen-stat/live/*
rm -rf nfsen-var/*

# Start fresh
docker start netlens

Method B — Via docker exec (if you already freed some space):

method B

# Delete the captured flow data (this frees the most space)
docker exec netlens bash -c "rm -rf /var/nfsen/profiles-data/live/* /var/nfsen/profiles-stat/live/*"

# Truncate logs too
docker exec netlens bash -c "truncate -s 0 /var/nfsen/var/nfsen.log"

Step 3 — Restart NfSen

Restart the whole container — the entrypoint starts NfSen automatically, no manual daemon handling needed:

restart

docker restart netlens

Verify recovery

verify

# Check disk space
df -h /

# Check NfSen status
docker exec netlens /var/nfsen/bin/nfsen status

# Access Web UI: http://<YOUR_IP>:8070/nfsen.php

Data folders hold everything

Only rm -rf of the folders themselves deletes your data permanently. Deleting the live/* content clears the flow data and graphs but keeps your config and sources intact. Always stop the container before cleaning a mounted folder.