On Tue, 3 May 2005 11:03:11 -0700
Mark Boolootian <[EMAIL PROTECTED]> wrote:
> Are you accounting for the fact that scan_size() uses 2^30 bytes for
> Gigabytes, rather than 10^9?
Mark and I talked a little offline. While this may be happening, it
is orthogonal to the issue I was specifically raising.
Mark later identified the following in flow-capture.c (and I am expiring
flows with flow-capture as opposed to flow-expire directly, I had thought
all the same code was used, but apparently I missed this):
if (!(cap_file.hdr_nflows % 1001)) {
if (fte.expiring)
if (ftfile_expire(&fte, enable_unlink, cap_file.nbytes))
fterr_errx(1, "ftfile_expire(): failed");
} /* ager run? */
Notice the first if test above. That seems like an odd way to
decide when to run the expiration process, but I guess I'm hoping
Mark Fullmer can clue us in on the how and the why when he gets a
chance.
John
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
