More info: it SEEMED to be working fine (<25% CPU) for many hours - came back from lunch today and once again it was > 95% CPU. I killed it and restarted, and CPU is again "normal" - 10% - 25%. The traffic loads, number of hosts, sessions, etc. have not drastically changed all day - and in fact are near the high end right now and CPU load is fine.
So, this tells me that after some period of time ntop freaks out about something and runs crazy. I DID have a problem with Firefox blowing up on my system which had an active nTop tab. Could this MAYBE be causing some issues? Also, memory footprint is about 400MB at this time and was closer to 600MB when it blew up, I still have plenty of physical RAM and SWAP - so that's not an issue. Actually.... Let me check ulimits to make sure!!!! Gary ________________________________ From: Gary Gatten Sent: Wednesday, June 17, 2009 3:13 PM To: 'ntop@unipi.it'; 'ntop-...@unipi.it' Subject: RE: HIGH cpu util and system load I changed some start args: disabled decoders, set interface to none, etc. Been babysitting all day, SO far cpu is < 30% and load is < .5, however, it's doubled in the last 20 mins or so as has memory utilization. Most of the CPU load us in the USER space, so I guess that's "good". Context Switches have increased quite a bit as well. I'm now showing 34,000 stored hosts (11,000 active) and 34,000 sessions - these are rounded numbers. Developers - I know there are many differences between 3.2 and 3.3. Should any of these changes cause a "significant" increase in CPU utilization? Thanks! Gary ________________________________ From: Gary Gatten Sent: Wednesday, June 17, 2009 10:32 AM To: 'ntop@unipi.it'; 'ntop-...@unipi.it' Subject: HIGH cpu util and system load OK, similar to other posts but now I've all but ruled out hardware issues. When running v3.2 on FreeBSD 6.0 I was running 3 instances of ntop with a total of about... 20 netflow interfaces. This was a PIII-750 and load average and cpu was fine (50% and .5) until it ran out of memory and started swapping. When I upgraded to 3.3.3-8 I immediately noticed this system could no longer keep up with the netflow load - even though our traffic remained pretty much the same. I messed with this for some time disabling different features, including GeoIP - but no no avail. So, I upgraded hardware. Now I'm running Solaris 10 x86 on a VMWare VM. I only have one instance of ntop 3.3.10 running, but it see's everything through our core LAN - it now has about 12,000 hosts and 20,000 sessions. I don't know what the physical hardware is, but the sysadmin tells me I have a single 3GHz CPU - obviously MUCH more powerfule than a PIII-750, yet CPU util is still > 90% and load is about 1.3. And I still have 2 other ntop instances to move over to this platform.... So, what can I do to determine what is causing such a drastic increase in 3.3.x cpu requirements? I guess more accurately, how can I determine if ntop is working "correctly", or if there's a bug of some kind causing a race condition, or maybe I linked against some library with problems? I'm half tempted to compile v3.2 on this platform and see what happens, but I'm guess I'll get similar results as the FreeBSD platform. Any help on this would be GREATLY appreciated! If anyone else running 3.3.8+ is monitoring a large number of hosts with many dynamic sessions, maybe you can reply with your CPU info? Oh yea, I restarted this instance last night while traffic was low and it was using < 10% cpu, when I came in this morning it was > 95% again. prstat shows 8 LWP's: (1) zombie (libpcap - don't care), 6 mostly in sleep, and one process in run and consuming 85% of the cpu. I tried to check this out with gdb but it's not workin too well - it's not listing thread 1! Anyway, TIA! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
