This often happens when the OS removes promiscuous mode from the interface. Check your cron jobs and see if you are running some kind of monitor and remove it.
-----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf > Of Neil > Sent: Wednesday, March 03, 2004 2:29 PM > To: [EMAIL PROTECTED] > Subject: [Ntop-dev] **FATAL_ERROR** NETFLOW: select() failed(4, > Interrupted system call), terminating netFlow > > > I have NTOP runnig on the following environment : > Sun E450 with solaris 8 with 1 GB of ram and a lot of > space. > Generated by ntop v.3.0pre1 MT [sparc-sun-solaris2.8] > Build: Feb 28 2004 00:22:05. Listening on > [hme0,NetFlow-device] without a kernel (libpcap) > filtering expression > Web report active on interface NetFlow-device > > The Netflow thread seems to crash every so often .. > and ntop stops reporting any Netflow data. > I have 2 cisco 7200 routers reporting to it .. > Any help is greatly appreciated. > > Thnx > -A > > > ntop Log > ------------------------------------------------------------------ > -------------- > > This is a rolling display of upto the last 50 ntop log > messages of priority INFO or higher. Click on the > "log" option, above, to refresh. > > ------------------------------------------------------------------ > -------------- > Tue Mar 02 15:16:18 2004 NOTE: atfork() handler > registered for mutexes, rc 0 > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (4) for network packet analyser > Tue Mar 02 15:16:18 2004 THREADMGMT: Packet processor > thread running... > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (5) for fingerprinting > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (6) for idle hosts detection > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (7) for DNS address resolution > Tue Mar 02 15:16:18 2004 Calling plugin start > functions (if any) > Tue Mar 02 15:16:18 2004 Sniffying... > Tue Mar 02 15:16:18 2004 INIT: Created pid file > (/var/run/ntop.pid) > Tue Mar 02 15:16:18 2004 Listening on [hme0] > Tue Mar 02 15:16:18 2004 Now running as requested > user 'root' (0:1) > Tue Mar 02 15:16:18 2004 Loading Plugins > Tue Mar 02 15:16:18 2004 Searching for plugins in > /usr/local/lib/ntop/plugins > Tue Mar 02 15:16:18 2004 ICMP: Welcome to > icmpWatchPlugin. (C) 1999-2004 by Luca Deri > Tue Mar 02 15:16:18 2004 LASTSEEN: Welcome to > LastSeenWatchPlugin. (C) 1999 by Andrea Marangoni > Tue Mar 02 15:16:18 2004 NETFLOW: Welcome to > NetFlow.(C) 2002-04 by Luca Deri > Tue Mar 02 15:16:18 2004 NFS: Welcome to > nfsWatchPlugin. (C) 1999-2004 by Luca Deri > Tue Mar 02 15:16:18 2004 PDA: Welcome to PDAPlugin. > (C) 2001-2004 by L.Deri and W.Brock > Tue Mar 02 15:16:18 2004 SFLOW: Welcome to > sFlowPlugin. (C) 2002-04 by Luca Deri > Tue Mar 02 15:16:18 2004 **WARNING** Unable to load > plugin '/usr/local/lib/ntop/plugins/rrdPlugin.so' > Tue Mar 02 15:16:18 2004 **WARNING** Message is > 'ld.so.1: ntop: fatal: relocation error: file > /usr/local/lib/ntop/plugins/rrdPlugin.so: symbol > rrd_clear_error: referenced symbol not found' > Tue Mar 02 15:16:18 2004 XML: Welcome to xmldump > plugin. (C) 2003-2004 by Burton Strauss > Tue Mar 02 15:16:18 2004 Calling plugin start > functions (if any) > Tue Mar 02 15:16:18 2004 NETFLOW: White list > initialized to '' > Tue Mar 02 15:16:18 2004 NETFLOW: Black list > initialized to '' > Tue Mar 02 15:16:18 2004 NETFLOW: Created a socket > (10) > Tue Mar 02 15:16:18 2004 NETFLOW: Collector listening > on port 9996 > Tue Mar 02 15:16:18 2004 Creating dummy interface, > 'NetFlow-device' > Tue Mar 02 15:16:18 2004 **WARNING** NETFLOW: > Truncated network size(device NetFlow-device) to 1024 > hosts(real netmask 255.0.0.0). > Tue Mar 02 15:16:18 2004 NETFLOW: Created a socket > (12) > Tue Mar 02 15:16:18 2004 NETFLOW: Export disabled at > user request > Tue Mar 02 15:16:18 2004 Note: Reporting device > initally set to 1 [NetFlow-device] > Tue Mar 02 15:16:18 2004 INITWEB: Initializing web > server > Tue Mar 02 15:16:18 2004 INITWEB: Initializing tcp/ip > socket connections for web server > Tue Mar 02 15:16:18 2004 INITWEB: Initialized socket, > port 443, address (any) > Tue Mar 02 15:16:18 2004 INITWEB: Waiting for HTTP > connections on port 443 > Tue Mar 02 15:16:18 2004 INITWEB: Starting web server > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (10) for web server > Tue Mar 02 15:16:18 2004 THREADMGMT: Started thread > (11) for network packet sniffing on hme0 > Tue Mar 02 15:16:18 2004 THREADMGMT: Fingerprint scan > thread running... > Tue Mar 02 15:16:18 2004 THREADMGMT: Idle host scan > thread running... > Tue Mar 02 15:16:18 2004 THREADMGMT: Address > resolution thread running... > Tue Mar 02 15:16:18 2004 THREADMGMT: netFlow > thread(9) started > Tue Mar 02 15:16:18 2004 THREADMGMT: web connections > thread (1783) started... > Tue Mar 02 15:16:18 2004 Note: SIGPIPE handler set > (ignore) > Tue Mar 02 15:16:18 2004 WEB: ntop's web server is > now processing requests > Tue Mar 02 15:16:18 2004 THREADMGMT: pcap dispatch > thread running... > Tue Mar 02 15:16:18 2004 NOTE: -L | > --use-syslog=facility not specified, child processes > will log to the default (24). > Tue Mar 02 15:19:49 2004 **FATAL_ERROR** NETFLOW: > select() failed(4, Interrupted system call), > terminating netFlow > Tue Mar 02 15:19:49 2004 **WARNING** THREADMGMT: > netFlow thread(9) terminated > > I also get this message everytime i start up . > > Wed Mar 03 10:20:13 2004 **WARNING** Address > resolution queue is full [4294967295 of 4096 slots] > Wed Mar 03 10:20:13 2004 Addresses in excess won't be > resolved > > > > __________________________________ > Do you Yahoo!? > Yahoo! Search - Find what youre looking for faster > http://search.yahoo.com > _______________________________________________ > Ntop-dev mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
