Nothing obvious jumps out at me... well, I don't like this: "18/Apr/2002
19:13:44 [webInterface.c:1056] Started thread (0) for web server.". I
thought that had been fixed in the changes prior to 12Apr2002's snapshot.
So, you are going to have to do some detective work on your machine to find
the data we need to see...
The two questions are:
1. Which thread is using all the CPU?
2. Where does it bomb?
The rub is that the thread # listed below ("Started thread (1026)") isn't
the Linux process number. The easiest way to map those is through gdb...
You will have to run under gdb - instructions are at
http://snapshot.ntop.org - see http://snapshot.ntop.org/faq.php#80. Let
ntop run until it dies, then end the end of the gdb log plus the info stack
output...
Remember, you should use your NORMAL ntop startup for set args, except
add -K, change -u whatever to -u root and don't use -d to daemonize.
After it bombs, do "info stack", but also do "info threads".
This will give you the thread # to process mapping, so that you can (from
ps -axf) figure out which ntop process is using all the CPU.
-----Burton
-----Original Message-----
From: Devon Harding - GTHLA [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 4:04 PM
To: 'Burton M. Strauss III'; [EMAIL PROTECTED]
Subject: RE: [Ntop] Ntop Dies
Here's what I'm getting in /var/log/messages when ntop is started with the
following command from 4/12 snapshot. Ntop seems to be using ~90% processor
time and I cannot connect to web page:
[root@server /root]# ntop -u ntop -n -r 300 -p /etc/ntop/protocol.list -i
eth1 -t 5 -P /etc/ntop -S 2 -b localhost:4000
18/Apr/2002 19:13:44 [sql.c:50] Open channel with ntop SQL client running @
localhost:4000
Wait please: ntop is coming up...
18/Apr/2002 19:13:44 [initialize.c:119] Initializing IP services...
SSL is present but https is disabled: use -W <https port> for enabling it
18/Apr/2002 19:13:44 [initialize.c:460] Initializing GDBM...
18/Apr/2002 19:13:44 [initialize.c:724] Initializing network devices...
18/Apr/2002 19:13:44 [main.c:737] ntop v.2.0.99 MT (SSL) [i686-pc-linux-gnu]
(04/15/02 04:16:26 PM build)
18/Apr/2002 19:13:44 [main.c:756] Listening on [eth1]
18/Apr/2002 19:13:44 [main.c:757] Copyright 1998-2002 by Luca Deri
<[EMAIL PROTECTED]>
18/Apr/2002 19:13:44 [main.c:758] Get the freshest ntop from
http://www.ntop.org/
18/Apr/2002 19:13:44 [main.c:759] Initializing...
18/Apr/2002 19:13:44 [initialize.c:1087] Truncated network size to 1024
hosts (real netmask 255.255.0.0)
18/Apr/2002 19:13:44 [plugin.c:324] Loading plugins (if any)...
18/Apr/2002 19:13:44 [plugin.c:342] Searching plugins in
/usr/local/lib/ntop/plugins
18/Apr/2002 19:13:44 [icmpPlugin.c:466] Welcome to icmpWatchPlugin. (C) 1999
by Luca Deri.
18/Apr/2002 19:13:44 [lastSeenPlugin.c:411] Welcome to LastSeenWatchPlugin.
(C) 1999 by Andrea Marangoni.
18/Apr/2002 19:13:44 [nfsPlugin.c:352] Welcome to nfsWatchPlugin. (C) 1999
by Luca Deri.
18/Apr/2002 19:13:44 [plugin.c:179] WARNING: unable to load plugin
'/usr/local/lib/ntop/plugins/rmonPlugin.so'
[undefined symbol: numDevices]
18/Apr/2002 19:13:44 [plugin.c:179] WARNING: unable to load plugin
'/usr/local/lib/ntop/plugins/wapPlugin.so'
[undefined symbol: actualDeviceId]
18/Apr/2002 19:13:44 [plugin.c:179] WARNING: unable to load plugin
'/usr/local/lib/ntop/plugins/libpep.so'
[undefined symbol: newSock]
18/Apr/2002 19:13:44 [sflowPlugin.c:1938] Welcome to sFlowPlugin. (C) 2002
by Luca Deri.
18/Apr/2002 19:13:44 [netflowPlugin.c:452] Welcome to NetFlow. (C) 2002 by
Luca Deri.
18/Apr/2002 19:13:44 [pdaPlugin.c:319] Welcome to PDAPlugin. (C) 2001-2002
by L.Deri and W.Brock
18/Apr/2002 19:13:44 [ntop.c:429] Processing protocol file:
'/etc/ntop/protocol.list', size: 328
18/Apr/2002 19:13:44 [initialize.c:352] Resetting traffic statistics...
18/Apr/2002 19:13:44 [initialize.c:604] Started thread (1026) for network
packet analyser.
18/Apr/2002 19:13:44 [initialize.c:612] Started thread (2051) for host
traffic statistics.
18/Apr/2002 19:13:44 [initialize.c:620] Started thread (3076) for throughput
update.
18/Apr/2002 19:13:44 [initialize.c:628] Started thread (4101) for idle hosts
detection.
18/Apr/2002 19:13:44 [initialize.c:638] Started thread (5126) for DB update.
18/Apr/2002 19:13:44 [plugin.c:412] Initializing plugins (if any)...
18/Apr/2002 19:13:44 [netflowPlugin.c:93] NetFlow export disabled
18/Apr/2002 19:13:44 [webInterface.c:1025] Waiting for HTTP connections on
port 3000...
18/Apr/2002 19:13:44 [webInterface.c:1056] 18/Apr/2002 19:13:44 [main.c:850]
Sniffying...
Started thread (0) for web server.
18/Apr/2002 19:13:44 [initialize.c:1242] Started thread (7176) for network
packet sniffing on eth1.
18/Apr/2002 19:13:44 [hash.c:647] Extending hash size
[newSize=64][deviceId=0]
18/Apr/2002 19:13:44 [hash.c:647] Extending hash size
[newSize=128][deviceId=0]
18/Apr/2002 19:13:44 [ntop.c:852] Cleaning up...
18/Apr/2002 19:13:44 [ntop.c:915] Waiting until threads terminate...
18/Apr/2002 19:13:47 [hash.c:308] Freeing hash host instances... (1
device(s) to save)
__________________
Devon Harding
System Administrator
Gilat Latin America
954-858-1600
[EMAIL PROTECTED]
-----Original Message-----
From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]]
Sent: Thursday, April 18, 2002 12:09 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: RE: [Ntop] Ntop Dies
It's the standard system log - in /var/log/system.log or /var/log/messages
or something similar.
Once again,
WHICH snapshot?
Please provide ALL the information I've asked for in the HOWTO, plus the
relevant lines from the log with --trace-level 3...
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Devon
Harding - GTHLA
Sent: Wednesday, April 17, 2002 12:32 PM
To: '[EMAIL PROTECTED]'; [EMAIL PROTECTED]
Cc: Devon Harding - GTHLA; [EMAIL PROTECTED]
Subject: RE: [Ntop] Ntop Dies
How do I turn on logging and where is the log file created?
-Devon
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 17, 2002 10:53 AM
To: [EMAIL PROTECTED]
Cc: Devon Harding - GTHLA; 'Burton M. Strauss III'; [EMAIL PROTECTED]
Subject: RE: [Ntop] Ntop Dies
WHICH snapshot - a date perhaps... there were problems
in snapshots between 05Apr and 11Apr that were fixed in
the 12Apr snapshots.
If it's outside that window:
* What's in the log?
* Have you turned on debug?
* Set a higher trace-level?
Please provide ALL the information I've asked for in the
HOWTO...
-----Burton
If my cat allowed me to have an
opinion, it would be here...
> Ok, I'm running ntop on a RedHat Linux 7.2 system with 512MB and 10GB free
> space. It's listening on a 10/100 ethernet span port. This is how my
ntop
> is invoked:
>
> /usr/local/bin/ntop -S 1 -E -d -P /home/ntop
>
> While running, all 12 processes would then sporadically die (at different
> time periods) with no errors in /var/log/messages.
>
> Ntop was compiled from source (snapshot.ntop.org) with NO errors
>
> Hope this helps,
>
> -Devon
>
> -----Original Message-----
> From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, April 11, 2002 9:05 AM
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: RE: [Ntop] Ntop Dies
>
> Well, you don't give us much information do you?
>
> Please see "HOWTO ask for help" in the FAQs at http://snapshot.ntop.org/
>
> -----Burton
>
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Devon
> Harding - GTHLA
> Sent: Thursday, April 11, 2002 7:14 AM
> To: [EMAIL PROTECTED]
> Subject: [Ntop] Ntop Dies
>
>
> What causes ntop processes to die periodically? I don't see any error in
> the log files.
>
> _______________________________________________
> Ntop mailing list
> [EMAIL PROTECTED]
> http://listmanager.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listmanager.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listmanager.unipi.it/mailman/listinfo/ntop
