I don't think the "no mac" setting will influence these warnings - but you probably need it anyway (most times you do).
Maybe check the rrd configs and play with the update timers? Also, any detail you don't "need" disable so that rrd is storing only what you'll actually use. Lastly, if your switch supports it maybe have it mirror TX and RX so you only need a single interface and NIC for monitoring. Merging tends to distort the details of full duplex traffic. Ie: Is 45Mb/s on a T3 bad? Well, if the traffic is all unidirectional - say ingress - yea, probably bad cause that circuit is maxed. If however it's 25 Mb in and 20 Mb out - maybe not so bad - especially if it's legit traffic. Openview sometimes treats a full-duplex link like two half-duplex links merged together: on a T1 running at 1536Kb/s egress it would show up on reports as 50% utilization when really it's 100% of egress. Lastly, these warnings are annoying but I don't *THINK* they're causing any harm. Gary ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Derek Gore Sent: Monday, November 17, 2008 11:43 AM To: ntop@unipi.it Subject: [Ntop] rrdtool and ntop --no-mac Greetings all, I've recently been working on a project to setup ntop to the end of analyzing our network load/traffic so we can better accommodate the demands of the network. A test case using a simple machine with a single nic went flawlessly. However, when I set up a more powerful machine with 2 nics to start production monitoring, I started getting warnings from RRD tool that go along the lines of this: **WARNING** RRD: rrd_update(/usr/.../ipBytesSent.rrd) error: illegal attempt to update using time 1109523297 when last update time is 1109523297 (minimum one second step) I have, of course, researched this problem a little and tried launching with the --no-mac option as well as configuring via the web interface to not trust macs. Nevertheless, the problem persists. The setup is a gigabit switch hooked into 2 nics on the monitoring computer. One port is mirrored egress, and the other ingress, and I have ntop set to merge the stats from both nics. Does anyone have any suggestions for how I might be able to fix this? Thank you. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
