Peter Haag wrote: > Hi Maurizio > > --On February 18, 2008 10:48:07 +0000 Maurizio Molina <[EMAIL PROTECTED]> > wrote: > > | Hi, > | I'm using nfsen snapshot-20070312 and nfdump snpsht-20070312 > | > | I frequently (say every few hours) see short periods (15-20') in which > | traffic from some routers drops almost to zero. Before investigating if > | something is wrong with the router or the communication channel with the > | collector, I think it's better to see if nfcapd is not loosing packets. > | I see that in nfsen.conf there's this conf parameter > | > | # Receive buffer size for nfcapd - see man page nfcapd(1) > | $BUFFLEN = 200000; > | > | -B bufflen > | Specifies the socket input buffer length in bytes. For high volume > | traffic ( near GB traffic ) it is recommended to set this value as > | high as possible ( typically > 100k ), otherwise you risk to lose > | packets. The default is OS (and kernel ) dependent. > | > | according to the above, I've set it to a safe value. The Netflow stream > | into my collector averages at 1-2 Mbit/s (but I don't know about peaks, > | they might actually be high, as the channels between the routers and the > | collectors are mostly Gbit/s ones...). > > Generally, you are safe with the defaults provided. The default buffer should > be big enough. 1-2 MB/s is absolute no problem for nfcapd. The buffer is > mostly > provided to cope with high peeks, at which the route may export the flows. > > | > | So: > | 1) should I try some other value? > > No - increasing this buff even more does not improve more. > > | 2) if I do loose packets because of this buffer issue, would tehre be > | messages in the nfsen logs? which ones? > > Loosing packets may occur anywhere in the chain from the exporter to the > collector. > nfcapd reports sequence failures via syslog, which covers all missing packets. Hi Peter, I'm seeing occasionally messages like the following one in /var/log/messages: Feb 18 10:50:01 srv3 /opt/flowtest/tools/nfdump/1.5/bin/nfcapd[20858]: Ident: 'ath_gr' Flows: 121413, Packets: 188322, Bytes: 129264757, Sequence Errors: 1, Bad Packets: 0
Is it that what you were referring too? thanks, MAurizio > > - Peter ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
