'RE: [Jkflow-users] Performance Issues'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       flowscan
Subject:    RE: [Jkflow-users] Performance Issues
From:       Jurgen Kobierczynski <jurgen.kobierczynski () pandora ! be>
Date:       2004-06-23 23:18:53
Message-ID: 1088032733.4447.12.camel () localhost ! localdomain
[Download RAW message or body]

The included flowscan file was the official FlowScan 1.006, merged with
the flowscan instance fork patch appeared earlier on the flowscan
mailing list. The original Flowscan doesn't support the flow-tools dump
layout, and I didn't included it (yet?).

A question: Is there an official release location of Flowscan supporting
flow-tools? 

Jurgen


On Wed, 2004-06-23 at 19:48, Anderson, Jordan T. wrote:
> I'm having these issues with my test JKFlow SMP setup.  I'm wondering what these \
> error messages mean: 
> 2004/06/23 12:52:19 PID 17726 working on file \
>                 /var/local/flows/ft-v05.2004-06-23.123500-0500...
> /var/local/flows/ft-v05.2004-06-23.123500-0500: Invalid index in cflowd flow file: \
> 0xCF100203! Version 5 flow-export is required with *all* fields being saved. \
> 2004/06/23 12:52:19 flowscan-1.020 JKFlow: Cflow::find took  0 wallclock secs ( \
> 0.00 usr +  0.00 sys =  0.00 CPU) for 0 flow file bytes, flow hit ratio: 0/0 \
> 2004/06/23 12:52:20 flowscan-1.020 JKFlow: report took  1 wallclock secs ( 0.36 usr \
> +  0.06 sys =  0.42 CPU) Queue file /var/local/queue/17726-results doesn't exist!
> 
> First of all, is this new JKFlow version meant only for cflowd?  Also, why does \
> JKFlow not create the queue file it needs?  I have created the directory for it to \
> go in and given full r/w permission. 
> Thanks
> 
> Jordan
> 
> 
> 
> -----Original Message-----
> From: jkflow-users-admin@lists.sourceforge.net
> [mailto:jkflow-users-admin@lists.sourceforge.net]On Behalf Of Jurgen
> Kobierczynski
> Sent: Saturday, June 19, 2004 5:19 PM
> To: joe.borg@datastream.com.mt
> Cc: jkflow users
> Subject: Re: [Jkflow-users] Performance Issues
> 
> 
> Hi!
> 
> I have a multiprocessor Flowscan version with JKFlow version3.2.2
> created. It's currently only located on my homesite
> http://users.telenet.be/jurgen.kobierczynski/jkflow yet, but I will
> update http://jkflow.sourceforge.net shortly.
> 
> screenshot:
> http://users.telenet.be/jurgen.kobierczynski/jkflow/flowscansmp.jpg
> 
> Jurgen Kobierczynski
> 
> On Fri, 2004-06-18 at 13:50, Joe Borg wrote:
> > Hi,
> > 
> > IâEUR(tm)ve recently installed JKFlow (3.2.1) and IâEUR(tm)ve found it to be
> > extremely useful. However, IâEUR(tm)m facing a couple of performance issues
> > and was therefore hoping someone could help me. 
> > 
> > My collector machine is a dual Xeon 1.8GHz (with Hyperthreading) and
> > 512MB Ram, running Fedora core 2 (N.B. The smp kernel actually sees 4
> > CPUâEUR(tm)s due to hyperthreading). IâEUR(tm)m collecting netflow data from \
> > the central router (only) in a hub and spoke configuration (I am not
> > interested in traffic that does not pass through the hub router). My
> > XML config file is simply based on defined sites and directions (i.e.
> > no routergroups etc.).  
> > 
> > 
> > 
> > Even with this amount of processing power, the collector doesnâEUR(tm)t seem
> > to be coping with the amount of netflow data (I do have a lot of sites
> > defined). IâEUR(tm)ve noticed, however, that only one of the four CPUâEUR(tm)s \
> > is actually being loaded by Flowscan. Is there any way in which I can
> > configure JKFlow/Flowscan to make use of all the available CPUâEUR(tm)s?
> > 
> > 
> > 
> > Secondly, even with 512MB Ram, memory utilisation is at 98%. I read in
> > a previous post that thereâEUR(tm)s an issue with perl not releasing memory.
> > Is there any workaround for this?
> > 
> > 
> > 
> > Finally, would anyone have any suggestions as to how I can optimise my
> > xml config so that itâEUR(tm)s more efficient (I do not have access to the
> > spoke routersâEUR �)? 
> > 
> > Sincerely,
> > 
> > Joe Borg
> > 
> > 
> > 
> > ------------------------------------------------ 
> > Mr. Joseph Borg 
> > Network Engineer 
> > DataStream Ltd. 
> > Office Direct: 2567 7245 
> > Office General: 2567 7000 
> > URL: <http://www.datastream.com.mt/>
> > 
> > This Email is confidential and intended solely for the use of the
> > individual to whom it is addressed. Any views or opinions represented
> > are solely those of the author and do not necessarily represent those
> > of Datastream Ltd. If you are not the intended recipient, be advised
> > that you have received this e-mail in error and that any use,
> > dissemination, forwarding,printing or copying of this Email is
> > strictly prohibited. Please notify the sender immediately by e-mail if
> > you have received this e-mail by mistake or call +356 21482000 and
> > delete this e-mail from your system. E-mail transmission cannot be
> > guaranteed to be secure or free of errors as information could be
> > intercepted, corrupted, lost, destroyed, delayed or incomplete, and/or
> > contain viruses. The sender therefore does not accept liability for
> > any errors or omissions in the contents of this message, which arise
> > as a result of Email Transmission.
> > 
> > 
> > 
> > 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> _______________________________________________
> Jkflow-users mailing list
> Jkflow-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/jkflow-users
> 
> 
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
> digital self defense, top technical experts, no vendor pitches, 
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> Jkflow-users mailing list
> Jkflow-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/jkflow-users
-- 
Jurgen Kobierczynski <jurgen.kobierczynski@pandora.be>


--
Help        mailto:majordomo@net.doit.wisc.edu and say "help" in message body
Unsubscribe mailto:majordomo@net.doit.wisc.edu and say
"unsubscribe flowscan" in message body
Archive     http://net.doit.wisc.edu/~plonka/list/flowscan/archive/


[prev in list] [next in list] [prev in thread] [next in thread]
Configure | About | News | Add a list | Sponsored by KoreLogic