On Wed, 2011-04-13 at 09:39 +0100, Gavin McCullagh wrote: > Hi, > > I have a Vyatta router here that's reasonably busy. About 150Mbit/sec all > in. Sflow sampling at 100. I've been trying to get sflow stuff working and > have had some success with sflowtrend. > > However, ntop crashes as soon as I enable the sflow monitor on the correct > port. If I restart it crashes again almost immediately unless I disable > the sflow from being sent to the machines running ntop. > > On my Ubuntu Maverick desktop (ntop v3.3.3) I get: > > gavinmc@ceartgoleor:~$ sudo /etc/init.d/ntop restart > Stopping network top daemon: No ntop found running; none killed. > ntop > Starting network top daemon: Tue Apr 12 13:54:32 2011 NOTE: Interface > merge enabled by default > Tue Apr 12 13:54:32 2011 Initializing gdbm databases > ntop > gavinmc@ceartgoleor:~$ flow_sample_element length error (expected 8, found > 16) > flow_sample_element length error (expected 82, found -87752664) > flow_sample length error (expected 152, found -87752600)
I'd suggest checking the sflow "flow" with tcpdump but there are still some holes there. At first blush that sounds like something is off by a byte or four somewhere. Certainly I've had a few of those while I've been trying to flesh-out tcpdump's support of sflow printing. > Any thoughts on what to do? ulimit -c unlimited?-) At least that is what I've done on the off chance I'll get another crash. Thusfar I'm just getting the "attempt to write a second time with the same timestamp" messages from RRD. (where I suspect if the interval is ever just a skosh less than one second that will happen... although I thought I saw it at least once when I had the "store every" settings above one second) rick jones _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
