hi. 2016-03-05 1:20 GMT+09:00 Miwa Susumu <miwa...@gmail.com>: >>>>>>>pflogd process consume CPU. >>>>>>>Because of that in load average is too high. >>>>>> Can you ktrace it? >>>>>this is kdump output. >>>>>sakura# kdump ktrace.out >>>>> 974 1 pflogd EMUL "netbsd" >>>>> 974 1 pflogd CALL read(3,0xbb912000,0x80000) >>>>> 974 1 pflogd RET read -1 errno 35 Resource temporarily >>>>> unavailable >>>> And what does 'fstat -p 974' say about fd 3? >>> >>>fd 3 is bpf. >>> >>>% fstat -p 974 >>>USER CMD PID FD MOUNT INUM MODE SZ|DV R/W >>>_pflogd pflogd 974 root /var 389524 drwxr-xr-x 512 r >>>_pflogd pflogd 974 wd /var 389524 drwxr-xr-x 512 r >>>_pflogd pflogd 974 0 / 380813 crw-rw-rw- null rw >>>_pflogd pflogd 974 1 / 380813 crw-rw-rw- null rw >>>_pflogd pflogd 974 2 / 380813 crw-rw-rw- null rw >>>_pflogd pflogd 974 3* bpf rec=0, dr=0, cap=0, pid=1135, >>>promisc, seesent, idle >>>_pflogd pflogd 974 4 /var 1855883 -rw------- 24 rw >>>_pflogd pflogd 974 5* unix stream 0xc4eda9b8 <-> 0xc4edaa08 >>> >> Seems that there is a general problem with non-blocking fd's on 7. >> Can you start pflogd with ktrace or gdb and see where it is setting >> non-blocking I/O on the fd? > > fd 3 is libpcap handle. in pflogd.c > > hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf); > > hpcap->fd is 3. > > It is set to NONBLOCK in pcap_setnonblock(). > but pcap_setnonblock() is not called from anywhe... hmmm > > > http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1447 > > pcap_setnonblock() > ret = p->setnonblock_op(p, nonblock, errbuf > > setnonblock_op was set pcap_setnonblock_fd() . > http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1471
in bpf_open(), open(2) returns descriptor, it have O_NONBLOCK bit. There is a case to be so. then, consume CPU. However, open in bpf, not process set NONBLOCK. http://nxr.netbsd.org/xref/src/sys/net/bpf.c#437 it's function call tree: main (pflogd) init_pcap (pflogd) pcap_open_live (libpcap) pcap_activate_bpf (pcap-bpf.c) bpf_open (pcap-bpf.c) open <---- open return descriptor, it have NONBLOCK, in rare cases. -- miwarin
