[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ntop-dev
Subject:    RE: [Ntop-dev] Rather severe ntop bug
From:       "Burton M. Strauss III" <Burton () ntopsupport ! com>
Date:       2004-04-28 12:25:11
Message-ID: JIEPJGFPFMFIGBNCPKGGGELDFIAA.Burton () ntopsupport ! com
[Download RAW message or body]

26K hosts would be a reasonable estimate for that many pages.  If ntop
rolled into swap space, then I could see how some of the more complex pages
could take long enough to create to trip the alarm (the basic flow is to
walk the table, creating an array of pointers to the selected HostTraffic
entries, then sort the pointers and walk that array to output the rows - so
there can be quite a lot of swapping)

A more robust log wouldn't have prevented anything but the space exhaustion.
It's still a good idea - I'll be there are metalog (or another alternative)
rpms out there.

The point remains that something got messed up in the tables - stray
pointer, etc. - and that we'll never know what unless it repeats and you can
trap the issue (which is unlikely given the size factor - running under
Valgrind would probably be prohibitively slow).

Thanks for the responses, however.

-----Burton


> -----Original Message-----
> From: ntop-dev-admin@unipi.it [mailto:ntop-dev-admin@unipi.it]On Behalf
> Of Berggren Niklas
> Sent: Wednesday, April 28, 2004 1:09 AM
> To: ntop-dev@Unipi.IT
> Subject: RE: [Ntop-dev] Rather severe ntop bug
>
>
> >OK, but WHICH version of ntop?
> Sorry about that, the version is 3.0
>
> >The trap code worked, but what was it trapping????
> I have no clue. All I could find about the problem was the
> entries in the submitted log.
> If there are places I haven't looked at, please let me know.
>
> >...although it would be nice to have the stats from the problem
> report to see
> >how many hosts ntop 'knows' about.
> Unfortunately, the data was lost with the ntop crash. However the
> total amount of hosts were close to 200 pages, and since ntop
> shows 130 hosts per page, that would be approximately 26000 hosts
> collected through NetFlow. Please note however that this is my
> approximation, not a fact!
>
> >For practical purposes, you should probably configure your
> logrotate with a
> >size limit too.  Or even move to a more robust log.  I use metalog on my
> >Gentoo systems - it manages the log file size on each message,
> rather than a
> >cron-driven logrotate.  That would have prevented your log filling up the
> >system.
> That's very true, however this instance of ntop was installed on
> a system which already had Redhat ES 2 installed, and I'm not
> allowed to use any other distribution than RH fedora or ES
> (Unfortunate company policy).
> I'm well aquainted with the benefits of metalog (I'm running it
> as well on a few private machines) but trying to mess with redhat
> is often a bad idea, and this system in particular is rather a
> mess. I'll have a few things changed when I get the hardware for
> "my" system.
>
> //Niklas Berggren.
> _______________________________________________
> Ntop-dev mailing list
> Ntop-dev@unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev

_______________________________________________
Ntop-dev mailing list
Ntop-dev@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
[prev in list] [next in list] [prev in thread] [next in thread]