I suggest you cat /proc/meminfo and check out your Vmalloc values. It
sounds like you are almost out of vmalloc space. Also look in
/proc/net/pf_ring/ to see if you have any rings presently allocated
eating up your vmalloc space.
If you are on an i386 platform, vmalloc space is more cramped due to the
memory architecture. Tweaking /etc/grub.conf with uppermem and vmalloc
directive has helped me. Here is an example snippet from me /etc/grub.conf
title CentOS (2.6.18-164.11.1.el5PAE)
root (hd0,0)
uppermem 384000
kernel /vmlinuz-2.6.18-164.11.1.el5PAE ro
root=/dev/VolGroup00/LogVolRoot vmalloc=512M
initrd /initrd-2.6.18-164.11.1.el5PAE.img
Note experimenting with those values can prevent the system from
successfully booting so make sure you are positioned to revert to the
previous grub settings if you need to.
Of course, the other way to conserve vmalloc space is to only use
PF_RING for the apps that really need it.
Kevin
On 2/15/2010 10:55 AM, Peter Bates wrote:
Hello again all...
I had a few problems over the weekend relating to memory
allocation - which resulted in Snort spinning out and filling my disk.
I have this configuration:
# cat /proc/net/pf_ring/info
PF_RING Version : 4.1.2 ($Revision: 4132$)
Ring slots : 4096
Slot version : 10
Capture TX : Yes [RX+TX]
IP Defragment : No
Transparent mode : No
Total rings : 0
Total plugins : 0
but haven't so far moved to using a NIC driver patched for PF_RING
as I don't have the physical hardware present.
My problem seems to be that I have 1 application that runs for
30 minutes at a time and then dumps its output to file (ipaudit)
and Snort, which I restart every night to include updated rules
and also rotate logfiles.
This worked fine until this happening (the application rotates every
30 minutes):
Feb 14 06:30:01 netman3 kernel: [334273.434054] [PF_RING] removed
/proc/net/pf_r
ing/19029-eth1.82
Feb 14 06:30:01 netman3 kernel: [334273.472691] [PF_RING] successfully
allocated
880640 bytes at 0xffe5c000
Feb 14 06:30:01 netman3 kernel: [334273.472696] [PF_RING] allocated
4113 slots [
slot_len=214][tot_mem=880640]
Feb 14 06:30:01 netman3 kernel: [334273.475961] allocation failed: out of
vmalloc space - use vmalloc=<size> to increase size.
Feb 14 06:30:01 netman3 kernel: [334273.475967] [PF_RING] ERROR: not
enough
memory for ring
Feb 14 06:30:01 netman3 kernel: [334273.475969] [PF_RING] ring_mmap():
unable to
allocate memory
Both of my applications (Snort/ipaudit) are using PF_RING fine so should
the kernel module be configured differently - or do I require the NIC
driver?
I know can't run any PF_RING-aware application because it is unable
to allocate the memory - do I have to reboot to cure this issue?
Thanks.
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
