[prev in list] [next in list] [prev in thread] [next in thread]
List: ntop
Subject: Re: [Ntop] crash after IDLE_PURGE
From: "Gary Gatten" <Ggatten () waddell ! com>
Date: 2009-06-24 15:46:51
Message-ID: 70C0964126D66F458E688618E1CD008A0793F0AD () WADPEXV0 ! waddell ! com
[Download RAW message or body]
--===============8989343961088352960==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C9F4E2.FDAAAE65"
This is a multi-part message in MIME format.
I've taken steps to reduce the spikes in host counts, yet the segfaults
after an IDLE_PURGE cycle are still prevalent. Anyone else having this
issue? Any idea's how to fix this? I have gdb output and have posted
it before. I can attach again if someone will actually do something
with it. My skill set in C development/debugging is ever expanding, but
they're exhausted for the time being.
TIA for any help!
Gary
________________________________
From: Gary Gatten
Sent: Friday, June 19, 2009 2:49 PM
To: 'ntop@unipi.it'
Subject: RE: [Ntop] crash after IDLE_PURGE
PS: The only way I found this is the new graphs in 3.3.x that keep info
about how many hosts ntop knows about. Whomever decided to add this -
good idea!
________________________________
From: Gary Gatten
Sent: Friday, June 19, 2009 2:01 PM
To: Gary Gatten; 'ntop@unipi.it'
Subject: RE: [Ntop] crash after IDLE_PURGE
I MAY have found the trigger for this. Our internal A/V / Spyware /
whatever scans our entire internal network range causing nTop to "see"
about 50,000 hosts. I'm not 100% sure on the correlation, but it
appears Ntop Crashes every couple hours when this discovery process
runs. Not *every* time - but often enough I'm convinced it play at
least some role in these crashes.
Any thoughts? My -x and -X values are high enough to not cause any
issues...
________________________________
From: Gary Gatten
Sent: Thursday, June 18, 2009 11:22 AM
To: 'ntop@unipi.it'
Subject: RE: [Ntop] crash after IDLE_PURGE
FWIW this is the last entry in the log:
IDLE_PURGE: Device 1 [NetFlow-device.2]: 719/8486 hosts deleted, elapsed
time is 0.494425 seconds (0.000688 per host)
________________________________
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of
Gary Gatten
Sent: Thursday, June 18, 2009 11:19 AM
To: ntop@unipi.it; ntop-dev@unipi.it
Subject: [Ntop] crash after IDLE_PURGE
On 3.3.10 rev 3780 - Solaris 10 x86. Had this same problem on 3.2 on
FreeBSD...
Anyway, nTop blows up after an IDLE_PURGE cycle. There was no entry in
the log this time even though I have -t 5 specified. On FreeBSD it
would through a signal 11.
"One" of the reasons I updated Is to hopefully solve this problem. I'll
run it in gdb again and post anything I find.
Anyone else having this issue? I have a lot of hosts "monitored' -
like... 12,000 ish at times. Not sure if that's part of the problem or
why it's more apparent for me?
TIA!
Gary
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential. If
you are not the intended recipient, you are hereby notified that any
review, use, dissemination, disclosure or copying of this email and its
attachments, if any, is strictly prohibited. If you have received this
email in error, please immediately notify the sender by return email and
delete this email from your system."
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
[Attachment #3 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" \
xmlns:st1="urn:schemas-microsoft-com:office:smarttags" \
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta name="Microsoft Theme 2.00" content=".htm 011">
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
color:black;}
span.EmailStyle20
{mso-style-type:personal;
color:black;}
span.EmailStyle21
{mso-style-type:personal-reply;
color:black;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>I’ve taken steps to reduce the spikes
in host counts, yet the segfaults after an IDLE_PURGE cycle are still \
prevalent. Anyone else having this issue? Any idea’s how to fix \
this? I have gdb output and have posted it before. I can attach again if \
someone will actually do something with it. My skill set in C \
development/debugging is ever expanding, but they’re exhausted for the time \
being.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>TIA for any help!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><st1:City w:st="on"><st1:place w:st="on"><font size=3
color=black face="Times New Roman"><span \
style='font-size:12.0pt;color:black'>Gary</span></font></st1:place></st1:City><font \
color=black><span style='color:black'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Gary Gatten <br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, June 19, 2009 2:49
PM<br>
<b><span style='font-weight:bold'>To:</span></b> 'ntop@unipi.it'<br>
<b><span style='font-weight:bold'>Subject:</span></b> RE: [Ntop] crash after
IDLE_PURGE</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>PS: The only way I found this is the new
graphs in 3.3.x that keep info about how many hosts ntop knows about.
Whomever decided to add this – good idea!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Gary Gatten <br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, June 19, 2009 2:01
PM<br>
<b><span style='font-weight:bold'>To:</span></b> Gary Gatten; <st1:PersonName
w:st="on">'ntop@unipi.it'</st1:PersonName><br>
<b><span style='font-weight:bold'>Subject:</span></b> RE: [Ntop] crash after
IDLE_PURGE</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>I MAY have found the trigger for this. Our
internal A/V / Spyware / whatever scans our entire internal network range
causing nTop to “see” about 50,000 hosts. I’m not 100%
sure on the correlation, but it appears Ntop Crashes every couple hours when
this discovery process runs. Not *<b><span \
style='font-weight:bold'>every</span></b>* time – but often enough I’m \
convinced it play at least some role in these crashes.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>Any thoughts? My –x and
–X values are high enough to not cause any \
issues…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Gary Gatten <br>
<b><span style='font-weight:bold'>Sent:</span></b> Thursday, June 18, 2009
11:22 AM<br>
<b><span style='font-weight:bold'>To:</span></b> <st1:PersonName \
w:st="on">'ntop@unipi.it'</st1:PersonName><br> <b><span \
style='font-weight:bold'>Subject:</span></b> RE: [Ntop] crash after \
IDLE_PURGE</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>FWIW this is the last entry in the \
log:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>IDLE_PURGE: Device 1 [NetFlow-device.2]:
719/8486 hosts deleted, elapsed time is 0.494425 seconds (0.000688 per \
host)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Gary Gatten<br>
<b><span style='font-weight:bold'>Sent:</span></b> Thursday, June 18, 2009
11:19 AM<br>
<b><span style='font-weight:bold'>To:</span></b> ntop@unipi.it;
ntop-dev@unipi.it<br>
<b><span style='font-weight:bold'>Subject:</span></b> [Ntop] crash after
IDLE_PURGE</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>On 3.3.10 rev 3780 – Solaris 10 x86. Had this
same problem on 3.2 on FreeBSD…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Anyway, nTop blows up after an IDLE_PURGE cycle. There
was no entry in the log this time even though I have –t 5
specified. On FreeBSD it would through a signal \
11.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>“One” of the reasons I updated Is to hopefully
solve this problem. I’ll run it in gdb again and post anything I
find. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Anyone else having this issue? I have a lot of hosts
“monitored’ – like… 12,000 ish at times. Not sure
if that’s part of the problem or why it’s more apparent for \
me?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>TIA!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><st1:place w:st="on"><st1:City w:st="on"><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>Gary</span></font></st1:City></st1:place><font
size=2 face=Arial><span \
style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=1 face="Times New Roman"><span style='font-size:
7.5pt'>"This email is intended to be reviewed by only the intended
recipient and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that any review,
use, dissemination, disclosure or copying of this email and its attachments, if
any, is strictly prohibited. If you have received this email in error, please
immediately notify the sender by return email and delete this email from your
system." </span></font><o:p></o:p></p>
</div>
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt \
0in'> </div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
</body>
</html>
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
--===============8989343961088352960==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic