It's probably not optimal. The issue is how often to check disk space.
Every flow is too often, ever new file is not often enough because if
the rotate time is large, say hours and the disk is near full then the
current file may fill up the disk.
--
mark
On May 4, 2005, at 2:45 PM, John Kristoff wrote:
On Tue, 3 May 2005 11:03:11 -0700
Mark Boolootian <[EMAIL PROTECTED]> wrote:
Are you accounting for the fact that scan_size() uses 2^30 bytes for
Gigabytes, rather than 10^9?
Mark and I talked a little offline. While this may be happening, it
is orthogonal to the issue I was specifically raising.
Mark later identified the following in flow-capture.c (and I am
expiring
flows with flow-capture as opposed to flow-expire directly, I had
thought
all the same code was used, but apparently I missed this):
if (!(cap_file.hdr_nflows % 1001)) {
if (fte.expiring)
if (ftfile_expire(&fte, enable_unlink, cap_file.nbytes))
fterr_errx(1, "ftfile_expire(): failed");
} /* ager run? */
Notice the first if test above. That seems like an odd way to
decide when to run the expiration process, but I guess I'm hoping
Mark Fullmer can clue us in on the how and the why when he gets a
chance.
John
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
