On Thu, Apr 26, 2018 at 11:21:57PM +0200, Infoomatic wrote:
> Hi Stuart,
> thanks for your input! Actually, I was never really satisfied with
> the stability of ntopng, so this problem of the memory leak does not
> really surprise me. However, when killing the process, which also
> means freeing swap space, I think it is not an expected behaviour that
> the system does not handle any tcp/ip or icmp connections any more
> until the swap space is fully freed (which, in my case when ntopng
> used 3 out of 4GB swap, lastet for nearly 20 minutes). IMHO,
> unswapping a process should not influence network connectivity that
> much.
Please wrap your lines.
Depening on how you killed it, it's way more than unswapping: the
program likely accesses (all) its data while shutting down, and as a
conseqeunce is swappping in gigs of data, possibly repeatedly.
If the working set is larger han physical memory, all bets are off.
-Otto
>
> Regards,
> infoomatic
>
>
> > Gesendet: Donnerstag, 26. April 2018 um 16:10 Uhr
> > Von: "Stuart Henderson" <s...@spacehopper.org>
> > An: misc@openbsd.org
> > Betreff: Re: crash of OpenBSD 6.3 -stable (amd64 MP kernel) - unswapping
> > kills connections
> >
> > On 2018-04-26, Infoomatic <infooma...@gmx.at> wrote:
> > > Hi,
> > >
> > > Today I discovered some interesting details: I guess ntopng has a memory
> > > leak, thus eating all my 4GB RAM and some 3GB swap - this appeared in the
> > > morning, so after all the backups and heavy traffic occured.
> > > When I fired up a rcctl stop ntopng the ssh connection stalled. The
> > > firewall could not handle further connections, and established
> > > connections dropped. The system could not answer to ping packets etc.
> > > This now also happened on a 2nd machine. After 20 minutes (when I was in
> > > a taxi to the datacenter) I could login again and realized that ntopng
> > > was stopped and swap was freed.
> > >
> > > I have now disabled ntopng. I kindly ask the devs to take a look at this!
> > > If you need a testsetup for this or if I can do anything, just contact me.
> >
> > First off, it's not a big surprise to have a hanging machine if you
> > run it out of memory.
> >
> > ntopng is not really stable. There is a newer version upstream but it
> > crashes very often with certain packet types suggesting bugs in the packet
> > parsers.
> >
> > If you run ntopng at all, I would recommend you only run it while you
> > need to investigate traffic, not leave it running unattended permanently.
> >
> > It might also be a good idea to set login.conf limits for it, if you
> > start it via the rc.d script you can add an "ntopng" class with say
> > datasize=2500M.
> >
> >
> >
