I have tried nfdump-snapshot-20070110, and now upgraded to
nfsen-snapshot-20070312.
In both cases, I have the same problem
What I notice is that memory 'leaks' until nfsend runs out of memory after
about 6 hours.
I have 1Gig of memory on a 1.7M Laptop - collecting 3 streams of live data,
with 3 profiles from stream 1 and about 14 fairly basic channels (per
profile).
It takes about 30-40 secs for nfsen to report in syslog its successfully
completed all operations.
It appears to extend to use the 1gig swap, and then report 'memory exausted'
in the nfsen logs and stops processing data (but it does stay up to browse
the web interface). Note, I also took out port tracker when going to
nfsen-snapshot-20070312
ie.. an example of the simple channels are as follows..
./nfsen --add-profile Apps_Brisbane
./nfsen --add-channel Apps_Brisbane/HTTP_in
./nfsen --add-channel Apps_Brisbane/HTTP_out
./nfsen --modify-channel Apps_Brisbane/HTTP_in sourcelist=stream1
./nfsen --modify-channel Apps_Brisbane/HTTP_out sign=- sourcelist=stream1
./nfsen --modify-channel Apps_Brisbane/HTTP_in filter="SRC NET
10.46.21.64/26 and SRC port 80 and proto TCP" order=1 color="#3333FF"
./nfsen --modify-channel Apps_Brisbane/HTTP_out filter="DST NET
10.46.21.64/26 and DST port 80 and proto TCP" order=1 color="#3333FF"
./nfsen --add-channel Apps_Brisbane/HTTPS_in
./nfsen --add-channel Apps_Brisbane/HTTPS_out
./nfsen --modify-channel Apps_Brisbane/HTTPS_in sourcelist=stream1
./nfsen --modify-channel Apps_Brisbane/HTTPS_out sign=- sourcelist=stream1
./nfsen --modify-channel Apps_Brisbane/HTTPS_in filter="SRC NET
10.46.21.64/26 and SRC port 443 and proto TCP" order=1 color="#339900"
./nfsen --modify-channel Apps_Brisbane/HTTPS_out filter="DST NET
10.46.21.64/26 and DST port 443 and proto TCP" order=1 color="#339900"
etc..
Its a low volumn source of flow info as follows:
Summary: total flows: 439, total bytes: 299082, total packets: 1782, avg
bps: 2187, avg pps: 1, avg bpp: 167
Time window: 2007-05-03 00:09:32 - 2007-05-03 00:27:46
Total flows processed: 439, skipped: 0, Bytes read: 22852
Sys: 0.002s flows/second: 146431.0 Wall: 0.002s flows/second: 177445.4
Obviously no one else appears to have the same issues as I have searched
around and found no one reported any similar issues.
I was wondering if anyone has any thoughts on this ? I don't see why nfsend
should need to retain memory from previous periods after proccessing them.
I suspect that it could be RRD version maybe ?
I dont want to go to a 4gig memory production server to find it still has
the same issue. I am run a portage based gentoo systems. Every package and
dependancies is current (maybe too current?) - and I think the Perl modules
are current since its all synced with portage and CPAN.
Any thoughts on this ?
Thanks all for such a great tool.
Cheers,
Jason
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
