Package: nfdump
Version: 1.6.8p1-1
Severity: serious
Tags: patch
--- Please enter the report below this line. ---
Hello,
I configured nfcapd to run expiration and external command on every new
file it creates (options -x and -e)
however, this operation runs only once (first time) and all consequent file
rotations do not execute external command and expiration process:
Jan 22 12:39:38 zabbix nfcapd[31437]: Init v9: Max number of v9 tags: 75
Jan 22 12:39:38 zabbix nfcapd[31437]: Init IPFIX: Max number of IPFIX tags:
62
Jan 22 12:39:38 zabbix nfcapd[31437]: Process_v5: New exporter: SysID: 1,
engine id 0, type 0, IP: 138.34.6.221, Sampling Mode: 0, Sampling Interval:
1
Jan 22 12:40:38 zabbix nfcapd[31437]: Ident: 'none' Flows: 2622, Packets:
12782, Bytes: 2807144, Sequence Errors: 3, Bad Packets: 0
Jan 22 12:40:38 zabbix nfcapd[31437]: Signal launcher
Jan 22 12:40:38 zabbix nfcapd[31437]: Total ignored packets: 0
Jan 22 12:40:38 zabbix nfcapd[31438]: Launcher: Wakeup
Jan 22 12:40:38 zabbix nfcapd[31438]: Launcher: ident: none run command:
'/root/perl_prog/nf2pg/nf2pg.pl /var/cache/nfdump/nfcapd.201401221239'
Jan 22 12:40:38 zabbix nfcapd[31438]: Launcher: fork child.
Jan 22 12:40:38 zabbix nfcapd[31438]: Launcher: child exec done.
Jan 22 12:40:39 zabbix nfcapd[31438]: Run expire on '/var/cache/nfdump'
Jan 22 12:40:39 zabbix nfcapd[31438]: Limits: Filesize <none>, Lifetime
604800 = 1.0 weeks, Watermark: 95%
Jan 22 12:40:39 zabbix nfcapd[31438]: Current size: 241070080 = 229.9 MB,
Current lifetime: 67178 = 18.7 hours, Number of files: 230
Jan 22 12:40:39 zabbix nfcapd[31438]: expire completed - nothing to expire.
Jan 22 12:40:39 zabbix nfcapd[31438]: Launcher: Sleeping
Jan 22 12:40:41 zabbix nfcapd[31438]: Launcher: Wakeup
Jan 22 12:40:41 zabbix nfcapd[31438]: Launcher: Sleeping
Jan 22 12:41:38 zabbix nfcapd[31437]: Ident: 'none' Flows: 2203, Packets:
22807, Bytes: 2994566, Sequence Errors: 0, Bad Packets: 0
Jan 22 12:41:38 zabbix nfcapd[31437]: Signal launcher
Jan 22 12:41:38 zabbix nfcapd[31437]: Total ignored packets: 0
Jan 22 12:41:38 zabbix nfcapd[31438]: Launcher: Wakeup
Jan 22 12:41:38 zabbix nfcapd[31438]: Launcher: Sleeping
Jan 22 12:42:38 zabbix nfcapd[31437]: Ident: 'none' Flows: 2513, Packets:
11841, Bytes: 3113153, Sequence Errors: 3, Bad Packets: 0
Jan 22 12:42:38 zabbix nfcapd[31437]: Signal launcher
Jan 22 12:42:38 zabbix nfcapd[31437]: Total ignored packets: 0
Jan 22 12:42:38 zabbix nfcapd[31438]: Launcher: Wakeup
Jan 22 12:42:38 zabbix nfcapd[31438]: Launcher: Sleeping
I found that the following changes in bin/launcher.c fix that behaviour:
_patch_BEGIN_
diff -Naur nfdump-1.6.8p1/bin/launch.c modified/bin/launch.c
--- nfdump-1.6.8p1/bin/launch.c 2012-03-09 10:49:39.000000000 -0500
+++ modified/bin/launch.c 2014-01-22 17:59:28.789367209 -0500
@@ -95,17 +95,21 @@
case SIGTERM:
// in case the process will not terminate, we
// kill the process directly after the 2nd TERM
signal
+ syslog(LOG_DEBUG, "Launcher: SIGTERM");
if ( done > 1 )
exit(234);
done++;
- break;
+ return;
case SIGHUP:
+ syslog(LOG_DEBUG, "Launcher: SIGHUP");
launch = 1;
- break;
+ return;
case SIGCHLD:
+ syslog(LOG_DEBUG, "Launcher: SIGCHILD");
child_exit++;
- break;
+ return;
}
+return;
} /* End of IntHandler */
@@ -370,6 +374,15 @@
while ( !done ) {
// sleep until we get signaled
syslog(LOG_DEBUG, "Launcher: Sleeping");
+ //this helps to run signal handler everytime, don't know
why :(
+ act.sa_handler = SignalHandler;
+ sigemptyset(&act.sa_mask);
+ act.sa_flags = 0;
+ sigaction(SIGCHLD, &act, NULL); // child process terminated
+ sigaction(SIGTERM, &act, NULL); // we are done
+ sigaction(SIGINT, &act, NULL); // we are done
+ sigaction(SIGHUP, &act, NULL); // run command
+ //_END_ of this helps to run signal handler everytime,
don't know why :(
select(0, NULL, NULL, NULL, NULL);
syslog(LOG_DEBUG, "Launcher: Wakeup");
if ( launch ) { // SIGHUP
_patch_END_
after this patch applied nfcapd log looks like:
Jan 23 07:41:25 zabbix nfcapd[26470]: Ident: 'none' Flows: 11597, Packets:
138316, Bytes: 15393459, Sequence Errors: 3, Bad Packets: 0
Jan 23 07:41:25 zabbix nfcapd[26470]: Signal launcher
Jan 23 07:41:25 zabbix nfcapd[26470]: Total ignored packets: 0
Jan 23 07:41:25 zabbix nfcapd[26471]: Launcher: SIGHUP
Jan 23 07:41:25 zabbix nfcapd[26471]: Launcher: Wakeup
Jan 23 07:41:25 zabbix nfcapd[26471]: Launcher: ident: none run command:
'/root/perl_prog/nf2pg/nf2pg.pl /var/cache/nfdump/nfcapd.201401230736'
Jan 23 07:41:25 zabbix nfcapd[26471]: Launcher: fork child.
Jan 23 07:41:25 zabbix nfcapd[26471]: Launcher: child exec done.
Jan 23 07:41:26 zabbix nfcapd[26471]: Run expire on '/var/cache/nfdump'
Jan 23 07:41:26 zabbix nfcapd[26471]: Limits: Filesize <none>, Lifetime
604800 = 1.0 weeks, Watermark: 95%
Jan 23 07:41:26 zabbix nfcapd[26471]: Current size: 432570368 = 412.5 MB,
Current lifetime: 135385 = 1.6 days, Number of files: 454
Jan 23 07:41:26 zabbix nfcapd[26471]: expire completed - nothing to expire.
Jan 23 07:41:26 zabbix nfcapd[26471]: Launcher: Sleeping
Jan 23 07:41:34 zabbix nfcapd[26471]: Launcher: SIGCHILD
Jan 23 07:41:34 zabbix nfcapd[26471]: Launcher: Wakeup
Jan 23 07:41:34 zabbix nfcapd[26471]: laucher child exit 1 childs.
Jan 23 07:41:34 zabbix nfcapd[26471]: launcher child 24631 exit status: 0
Jan 23 07:41:34 zabbix nfcapd[26471]: laucher waiting childs done. 0 childs
Jan 23 07:41:34 zabbix nfcapd[26471]: Launcher: Sleeping
Jan 23 07:46:25 zabbix nfcapd[26470]: Ident: 'none' Flows: 13237, Packets:
101872, Bytes: 28040647, Sequence Errors: 3, Bad Packets: 0
Jan 23 07:46:25 zabbix nfcapd[26470]: Signal launcher
Jan 23 07:46:25 zabbix nfcapd[26470]: Total ignored packets: 0
Jan 23 07:46:25 zabbix nfcapd[26471]: Launcher: SIGHUP
Jan 23 07:46:25 zabbix nfcapd[26471]: Launcher: Wakeup
Jan 23 07:46:25 zabbix nfcapd[26471]: Launcher: ident: none run command:
'/root/perl_prog/nf2pg/nf2pg.pl /var/cache/nfdump/nfcapd.201401230741'
Jan 23 07:46:25 zabbix nfcapd[26471]: Launcher: fork child.
Jan 23 07:46:25 zabbix nfcapd[26471]: Launcher: child exec done.
Jan 23 07:46:26 zabbix nfcapd[26471]: Run expire on '/var/cache/nfdump'
Jan 23 07:46:26 zabbix nfcapd[26471]: Limits: Filesize <none>, Lifetime
604800 = 1.0 weeks, Watermark: 95%
Jan 23 07:46:26 zabbix nfcapd[26471]: Current size: 433582080 = 413.5 MB,
Current lifetime: 135685 = 1.6 days, Number of files: 455
Jan 23 07:46:26 zabbix nfcapd[26471]: expire completed - nothing to expire.
Jan 23 07:46:26 zabbix nfcapd[26471]: Launcher: Sleeping
I found that without this change SIGHUP handler is called only for the
first time, it could be silly change, since I'm not a C developer at all,
but it does its job.
First block of changes and syslog() calls is mostly for debugging, which
signal is sent to a process. it can be ignored, same as 'break's vs
'return's.
Thanks
Tim
--- System information. ---
Architecture: amd64
Kernel: Linux 3.11-2-amd64
Debian Release: jessie/sid
800 unstable http.us.debian.org
800 unstable deb-multimedia.org
500 stable dl.google.com
1 experimental http.us.debian.org
--- Package information. ---
Depends (Version) | Installed
=========================- -=============
libc6 (>= 2.4) |
librrd4 (>= 1.3.0) |
zlib1g (>= 1:1.1.4) |
lsb-base (>= 3.0-6) |
Package's Recommends field is empty.
Package's Suggests field is empty.
