sorry. i'm late.
2016-02-08 1:02 GMT+09:00 Christos Zoulas <chris...@astron.com>:
>>>>>>pflogd process consume CPU.
>>>>>>Because of that in load average is too high.
>>>>> Can you ktrace it?
>>>>this is kdump output.
>>>>sakura# kdump ktrace.out
>>>> 974 1 pflogd EMUL "netbsd"
>>>> 974 1 pflogd CALL read(3,0xbb912000,0x80000)
>>>> 974 1 pflogd RET read -1 errno 35 Resource temporarily
>>>> unavailable
>>> And what does 'fstat -p 974' say about fd 3?
>>
>>fd 3 is bpf.
>>
>>% fstat -p 974
>>USER CMD PID FD MOUNT INUM MODE SZ|DV R/W
>>_pflogd pflogd 974 root /var 389524 drwxr-xr-x 512 r
>>_pflogd pflogd 974 wd /var 389524 drwxr-xr-x 512 r
>>_pflogd pflogd 974 0 / 380813 crw-rw-rw- null rw
>>_pflogd pflogd 974 1 / 380813 crw-rw-rw- null rw
>>_pflogd pflogd 974 2 / 380813 crw-rw-rw- null rw
>>_pflogd pflogd 974 3* bpf rec=0, dr=0, cap=0, pid=1135,
>>promisc, seesent, idle
>>_pflogd pflogd 974 4 /var 1855883 -rw------- 24 rw
>>_pflogd pflogd 974 5* unix stream 0xc4eda9b8 <-> 0xc4edaa08
>>
> Seems that there is a general problem with non-blocking fd's on 7.
> Can you start pflogd with ktrace or gdb and see where it is setting
> non-blocking I/O on the fd?
fd 3 is libpcap handle. in pflogd.c
hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
hpcap->fd is 3.
It is set to NONBLOCK in pcap_setnonblock().
but pcap_setnonblock() is not called from anywhe... hmmm
http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1447
pcap_setnonblock()
ret = p->setnonblock_op(p, nonblock, errbuf
setnonblock_op was set pcap_setnonblock_fd() .
http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1471
--
miwarin
