Not able to parse JSON output from sflowtool

8 views
Skip to first unread message

anu mercian

unread,
Jul 17, 2019, 9:22:47 AM7/17/19
to sFlow
Hello! 

I am using this script that I found online to parse the JSON output of sflowtool latest release. But I am getting an error and it looks like it is complaining of the JSON format. Can you help identify a solution to this problem?

Thank you,
Anu

This is the script:

import subprocess
from json import loads

p = subprocess.Popen(
['/usr/local/bin/sflowtool','-j'],
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT
)
lines = iter(p.stdout.readline,'')
for line in lines:
print line
datagram = loads(line)
localtime = datagram["localtime"]
samples = datagram["samples"]
for sample in samples:
sampleType = sample["sampleType"]
elements = sample["elements"]
if sampleType == "FLOWSAMPLE":
for element in elements:
tag = element["flowBlock_tag"]
if tag == "0:1":
try:
src = element["srcIP"]
dst = element["dstIP"]
pktsize = element["sampledPacketSize"]
print "%s %s %s %s" % (localtime,src,dst,pktsize)
except KeyError:
pass


This is the error:
Traceback (most recent call last):
  File "./flow.py", line 14, in <module>
    datagram = loads(line)
  File "/usr/lib64/python2.7/json/__init__.py", line 339, in loads
    return _default_decoder.decode(s)
  File "/usr/lib64/python2.7/json/decoder.py", line 364, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib64/python2.7/json/decoder.py", line 380, in raw_decode
    obj, end = self.scan_once(s, idx)

The JSON seems to be missing commas:
"datagramSourceIP":"104.3.28.3","datagramSize":"716","unixSecondsUTC":"1563314035","localtime":"2019-07-16T21:53:55+0000","datagramVersion":"5","agentSubId":"0","agent":"15.11.20.2","packetSequenceNo":"1812216","sysUpTime":"1122908000","samplesInPacket":"4""samples":[{"sampleType_tag":"0:1"

anu mercian

unread,
Jul 17, 2019, 2:01:11 PM7/17/19
to sFlow

I think I found the issue in the code sflowtool.c file.

A comma is needed in these instances to make the JSON a valid one:

  1. Before starting a "samples": keyword and appending a comma to it
  2. Before starting an "elements": keyword and appending a comma to it
  3. If there are more than 1 samples, appending a "comma" in between
  4. If there are more than 1 elements, appending a "comma" in between

I am relatively novice in coding C, so will try to fix the bug and push a pull request. 


However, any help from the developers is much appreciated. 

Neil McKee

unread,
Jul 17, 2019, 2:29:39 PM7/17/19
to sf...@googlegroups.com
The bug is fixed.  Please download version 5.04.

Thank you for pointing it out.
Neil

------
Neil McKee
InMon Corp.
http://www.inmon.com


--
You received this message because you are subscribed to the Google Groups "sFlow" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sflow+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/sflow/ea643cae-c81c-46a0-8603-f9475a60f035%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

anu mercian

unread,
Jul 17, 2019, 2:35:44 PM7/17/19
to sf...@googlegroups.com
Thank you very much for the quick response. Truly appreciate it.

Regards,
Anu

Zahra Hosseini

unread,
Jul 18, 2019, 10:54:35 AM7/18/19
to sf...@googlegroups.com
Hello Anu , Im sorry im not familiar with python , i used jsonparser in java .
Good Luck.

anu mercian

unread,
Jul 18, 2019, 11:46:41 AM7/18/19
to sFlow
Thank you for your response. 

The latest release of the tool now works with python json parser library! Thanks to the community! :) 


On Thursday, July 18, 2019 at 7:54:35 AM UTC-7, Zahra Hosseini wrote:
Hello Anu , Im sorry im not familiar with python , i used jsonparser in java .
Good Luck.

On Wed, Jul 17, 2019 at 11:05 PM anu mercian <freebi...@gmail.com> wrote:
Thank you very much for the quick response. Truly appreciate it.

Regards,
Anu

To unsubscribe from this group and stop receiving emails from it, send an email to sf...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "sFlow" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sf...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "sFlow" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sf...@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages