On 10/08/2021 14:30, nfsen-discuss-requ...@lists.sourceforge.net wrote:
Particularly I try to look at top talkers of these files, especially
in the "inet6" domain:
-rw-r--r--. 1 apache apache 3,5G 9. Aug 08:00
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090755
-rw-r--r--. 1 apache apache 2,3G 9. Aug 08:04
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090800
-rw-r--r--. 1 apache apache 891M 9. Aug 08:10
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090805
-rw-r--r--. 1 apache apache 702M 9. Aug 08:15
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090810
-rw-r--r--. 1 apache apache 674M 9. Aug 08:20
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090815
-rw-r--r--. 1 apache apache 737M 9. Aug 08:25
/usr/local/nfsen/profiles-data/live/ixia-poc/2021/08/09/nfcapd.202108090820
2021/08/09/nfcapd.202108090820: Sys: 36.063s
2021/08/09/nfcapd.202108090815: Sys: 38.893s
2021/08/09/nfcapd.202108090810: Sys: 35.795s
2021/08/09/nfcapd.202108090805: Sys: 6141.546s
2021/08/09/nfcapd.202108090800: - still waiting (started 3 hours ago)
I would be inclined to look at the RSS of the nfdump process, and
overall RAM utilisation of your system, while those queries are going
on. (e.g. "top -o RES", "watch free")
My guess is that the RAM usage is going so high that it's sending your
system heavily into swap.
You may find that having a *small* swap partition (e.g. 1GB) is better
than a large one; or just turn off swap entirely. If nfdump runs out of
RAM it will be killed by the OOM killer, but at least your system won't
turn into treacle and freeze.
Can you show the actual nfdump query you were using? What were you
grouping on?
Regards,
Brian.
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
