NFEXPIRE(1)

💅 nfexpire — the nfexpire(1) glow-up 🎀

okay so bestie, welcome to nfexpire, a Gen Z–approved member of the General Commands Manual squad ✨. It's the little tool that decides when your netflow files have ✨lived their best life✨ and gotta go. Let's get into it 🦋

---

✨ NAME ✨

nfexpire — lowkey the manager of flow-file expiration, based on time or volume. it's giving "declutter queen" 👑

---

🌸 SYNOPSIS 🌸

nfexpire -l directory
nfexpire -L directory
nfexpire -r directory
nfexpire -e directory [-s maxsize] [-t maxlife] [-w watermark]
         [-T runtime]
nfexpire -u path [-s maxsize] [-t maxlife] [-w watermark]

---

🫶 DESCRIPTION 🫶

so nfexpire handles the expiration of netflow data files based on their lifetime and/or the total volume of all flow files. those flow files are usually created by any nfdump collector (nfcapd, sfcapd, or nfpcapd) — iykyk 💫

nfexpire is the tool you use to set up the expire parameters (that's maintenance mode) or to actually run the expire process (that's expire mode) based on those parameters. and the expire process can be triggered three ways, bestie:

1. by a cron job,
2. by the collector process itself (nfcapd, sfcapd auto expire mode),
3. or by running nfexpire manually.

nfexpire interacts with the collector, so it's literally safe to set up and expire files from a directory that any collector is using to store flow files. no cap 🧚

it also stores a statistics file .nfstat in the given directory to maintain the status and parameters. ⚠️ you should not modify this file manually unless you know what you're doing — that's a whole main-character risk you don't need 💀

and heads up: the directory argument for nfexpire corresponds to the -l argument on the collector command line. match them up, slay 🔥

the options are as follows:

---

👑 OPTIONS 👑

• -l directory — lists the current expire statistics from directory datadir. if this is the first time nfexpire runs on this directory, it automatically rescans the flow files first to update the statistics. and if this is an active data directory used by any collector, the statistics get updated automatically 🔄
• -L directory — lists current expiration statistics and the bookkeeping records for directory. the deluxe version, periodt 💅
• -r directory — rescans the data directory, even if a statistics file already exists. use this to update the statistics after a disk full event, after manually changing the compression of the files, or if files have been deleted manually or manipulated otherwise. the "refresh my memory" option 🧠✨
• -e directory — expire data files according to the parameters maxsize and maxlife. the expire parameters are taken from the statfile if they were previously set with -u, or they can be overwritten with the additional options -s, -t, and -w. files are deleted from the oldest towards the latest according to both limits, and it stops at the watermark below the limit. bye bye old files 👋😭
• -u directory — updates the expire parameters (size and lifetime limits) specified by -s, -t, and -w, and stores them in the statfile as default values. any running collector process in auto expire mode will take these new values starting with the next expire cycle. and running nfexpire the next time in expire mode will take these new parameters — unless they get overwritten by the arguments -s, -t, and -w 🎀
• -s maxsize — sets the max size limit for all data files. maxsize accepts values such as 100M, 100MB, 1G, 1.5G (number + quantity factor) etc. accepted size factors are K, KB, M, MB, G, GB, and T, TB. if no factor is given, bytes (B) is assumed. a value of 0 disables the max size limit 🚫
• -t maxlife — sets the max lifetime for the data files. maxlife accepts values such as 31d, 240H, 1.5d (number + quantity factor) etc. accepted time factors are w (weeks), d (days), H (hours). if no factor is given, hours (H) is assumed. a value of 0 disables the max lifetime limit ⏳
• -w watermark — sets the water mark in % of any limit. it applies to both limits, maxsize and maxlife. the expire process is triggered if any of the limits are hit, and stops if the new value reaches the watermark level in % of the limit. meaning: files are allowed to grow between the watermark % lower level and the 100% upper level. default for watermark is 95% 💧
• -T runtime — forces nfexpire to end the expire task after runtime seconds, even if the task is not yet completed. nfexpire updates the statistics and exits cleanly, so it will pick up next time where it left off 🫶 by default nfexpire runs until the task is done.
• -p — puts nfexpire in profile mode. only legacy NfSen will need this option 🧓
• -Y — prints a NfSen compatible statistic. only legacy NfSen will need this option 🧓
• -h — prints help text on stdout with all options and exits. our fave, the "wait what does this do again" button 🙈

---

💀 EXIT STATUS 💀

nfexpire returns 0 on success and 255 otherwise. that's it. that's the whole vibe check ✅❌

---

🌈 SEE ALSO 🌈

nfcapd(1), nfdump(1), sfcapd(1) — go say hi to the rest of the family bestie 🦋

---

✨ and that's the whole page, no skips, no summaries, we ate and left no crumbs 💅🍓

---

mwah 💖 this cutie came from the Debian fam with a date of $Mdocdate$ — see u in the group chat, bestie 👑