Re: [Ntop-dev] NTOP 2.2c and 3.0 crash with Netflow

Sat, 17 Jul 2004 10:02:07 -0700

Still having problems with this. I have only one router pointing at the box running ntop right now. Why is it that the netflow plugin uses so much memory? I have the latest version I just grabbed from CVS about a half hour ago and recompiled it. With having just one router sending netflow information to ntop, it hasn't crashed yet with out of memory errors, but I think it's just a matter of time. With just this one router, ntop is consuming 2GB of RAM, and that's not my busiest router. I have a feeling if it keeps growing, it'll just crash. What is it that is needed in memory that consumes this much RAM? Why doesn't it write it to disk other than speed issues. I've seen other ntop software that is more memory efficient and stores the information in MySQL. Is the netflow plugin just not designed to work on mid sized networks? I only have a couple of DS3's and a fast ethernet trunk to several dozen vlans that is being exported. Is that way too much to expect to work with ntop? Any help would be appreciated! :) Thanks!

At 05:06 AM 7/14/2004, you wrote:
Vinny,
I have rewritten a lot of code part of the NF plugin. Please fetch ntop from CVS, compile it and let me know if it works for you. Make sure you canfigure both ntop and the NF plugin properly for your environment.

Regards, Luca

Vinny Abello wrote:

Hello,

Please forgive me if this has been discussed and there is a solution to this somewhere. I couldn't not find an answer, only more people with the same problem. I cannot get NTOP to run for more than a few minutes without crashing once I have the Netflow plugin active and a router or routers sending netflow data to it. I'm running this on Gentoo Linux kernel 2.4.26-gentoo-r5 on a P4 2.8GHz CPU (SMP currently disabled). Both 2.2c and 3.0 were installed from the Gentoo portage collection with emerge. Below is the error output I get from 3.0:

Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(8976) @ pbuf.c:122 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **WARNING** ntop packet capture STOPPED
Tue Jul 13 13:19:28 2004 NOTE: ntop web server remains up
Tue Jul 13 13:19:28 2004 NOTE: Shutdown gracefully and restart with more memory
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **FATAL_ERROR** malloc(3776) @ hash.c:1013 returned NULL [no more memory?]
Tue Jul 13 13:19:28 2004 **WARNING** THREADMGMT: netFlow thread(114696) terminated
Tue Jul 13 13:19:28 2004 THREADMGMT: pcap dispatch thread terminated...
Tue Jul 13 13:19:46 2004 THREADMGMT: Idle Scan thread (49156) terminated
Tue Jul 13 13:19:52 2004 **WARNING** THREADMGMT: Address resolution thread terminated...
Tue Jul 13 13:21:39 2004 THREADMGMT: Fingerprint Scan thread (32771) terminated


Both 2.2c and 3.0 generally give the same error when they crash (just displayed differently). Is there a known fix for this? Should I be compiling with a different option manually instead of using Gentoo's portage? I keep seeing references to there being no more memory... I know this isn't referring to the physical system as it has a total of 4GB of RAM plus swap and doesn't even touch it. The only thing I'm really trying to do with it currently is run NTOP. It doesn't do much else. If any more information is needed, I'll gladly provide it. Thanks in advance for any help, and again - if this is already answered somewhere, please point me to the information. No further explanations needed. I just couldn't find the solution. Thanks! :)

Vinny Abello
Network Engineer
Server Management
[EMAIL PROTECTED]
(973)300-9211 x 125
(973)940-6125 (Direct)
PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0  E935 5325 FBCB 0100 977A

Tellurian Networks - The Ultimate Internet Connection
http://www.tellurian.com (888)TELLURIAN

There are 10 kinds of people in the world. Those who understand binary and those that don't.

_______________________________________________
Ntop-dev mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev




--
Luca Deri <[EMAIL PROTECTED]>       http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman

_______________________________________________
Ntop-dev mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev



Vinny Abello
Network Engineer
Server Management
[EMAIL PROTECTED]
(973)300-9211 x 125
(973)940-6125 (Direct)
PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0  E935 5325 FBCB 0100 977A

Tellurian Networks - The Ultimate Internet Connection
http://www.tellurian.com (888)TELLURIAN

There are 10 kinds of people in the world. Those who understand binary and those that don't.

_______________________________________________
Ntop-dev mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev

Reply via email to