Hello,
As much as I try not to, it seems that most of the time I write my first
message to a newly subscribed mailing list, I need to ask for some help.
This is one of those messages ;)
After having run nfsen/nfdump in a pilot setting on some old decrepit
hardware for a few weeks to see if it provides the level of insight into our
network traffic that we were looking for, I purchased a shiny new server and
installed it with an Ubuntu 64-bit operating system. Nfdump (from the SVN
repository) compiled easily and nfsen followed rapidly after. Starting the
processes was as easy as it was during my pilot. However, when I asked my
NOC to redirect one of our netflows to go to the new machine, nfcapd
consistently crashes on the first packet it receives.
Invocation:
r...@mississippi:/opt/nfsen/bin# /opt/nfdump/bin/nfcapd -w -I core-hagedorn
-p 9998 -u netflow -g www-data -B 200000 -S 1 -l
/opt/nfsen/profiles-data/live/core-hagedorn -P
/opt/nfsen/var/run/core-hagedorn.pid
Segmentation fault
If it helps, I can produce a core.
The corresponding entries from my syslog are:
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 2
byte input/output interface index
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
byte input/output interface index
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 2
byte src/dst AS number
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
byte src/dst AS number
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
dst tos, direction, src/dst mask
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
IPv4 next hop
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
IPv6 next hop
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
IPv4 BGP next IP
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
IPv6 BGP next IP
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
src/dst vlan id
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
byte output packets
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
byte output packets
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
byte output bytes
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
byte output bytes
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 4
byte aggregated flows
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: 8
byte aggregated flows
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: in
src/out dst mac address
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension: in
dst/out src mac address
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Add extension:
MPLS Labels
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Bound to IPv4
host/IP: any, Port: 9998
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Standard
setsockopt, SO_RCVBUF is 129024 Requested length is 200000 bytes
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: System set
setsockopt, SO_RCVBUF to 262142 bytes
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Startup.
Mar 4 10:52:05 mississippi /opt/nfdump/bin/nfcapd[23060]: Init v9:
Recognised number of v9 tags: 54
Mar 4 10:52:06 mississippi /opt/nfdump/bin/nfcapd[23060]: Process_v5: New
exporter engine id 0, type 0
Mar 4 10:52:06 mississippi kernel: [172970.205601] nfcapd[23060]: segfault
at 9ba2f01c ip 00007fdf9b4155a7 sp 00007fffb9fa8b68 error 6 in
libc-2.10.1.so[7fdf9b393000+166000]
I did notice a patch for an uninitialized variable that circulated a little
while ago, but it does not seem to apply to the current trunk.
At this time, I am obviously reverting back to my old machine. However,
given its state, I am not sure how much longer it will be able to keep up
with the data. Is this a known issue? If so, what can I do to fix it? If
not, what can I do to help solve it?
-Kees
--
Kees Leune
Blog at http://www.leune.org
On twitter as @leune
PGP Key 0xE80D8F7F
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
