Um... man ntop???
1. Use the sticky hosts option to eliminate the purge. From man ntop:
-c | --sticky-hosts
Use this parameter to prevent idle hosts from being purged from
mem-
ory.
By default idle hosts are periodically purged from memory. An
idle
host is identified when no packets from or to that host have been
mon-
itored for the period of time defined by the value
of
PARM_HOST_PURGE_MINIMUM_IDLE in globals-defines.h.
If you use this option, all hosts - active and idle - are retained
in
memory for the duration of the ntop run.
P2P users, port scans, popular web servers and other activity
will
cause ntop to record data about a large number of hosts. On an
active
network, this will consume a significant - and always growing -
amount
of memory. It is strongly recommended that you use a
filtering
expression to limit the hosts which are stored if you
use --sticky-
hosts.
The idle purge is a statistical one - a random selection of the
eligi-
ble hosts will be purged during each cycle. Thus it is possible on
a
busy system for an idle host to remain in the ntop tables and
appear
'active' for some considerable time after it is truly idle.
2. Disable the instant completed session purge. From man ntop:
--disable-instantsessionpurge
ntop sets completed sessions as 'timed out' and then purge them
almost
instantly, which is not the behavior you might expect from the
discus-
sions about purge timeouts. This switch makes ntop respect the
time-
outs for completed sessions. It is NOT the default because a busy
web
server may have 100s or 1000s of completed sessions and this
would
significantly increase the amount of memory ntop uses.
3. Adjust the purge interval in globals-defines.h ...
/*
* How long between runs of the idle host purge?
*/
#define PARM_HOST_PURGE_INTERVAL 2*60
/*
* How long must a host be idle to be considered for purge?
*/
#define PARM_HOST_PURGE_MINIMUM_IDLE 10*60
/*
* How long must a session be idle to be considered for purge?
*/
#define PARM_SESSION_PURGE_MINIMUM_IDLE 10*60
/*
* How long before a passive ftp session timesout?
*/
#define PARM_PASSIVE_SESSION_MINIMUM_IDLE 60
Remember, the longer you hold hosts in memory, the more memory you will
probably require.
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Marco
Decker
Sent: Wednesday, November 26, 2003 6:04 AM
To: [EMAIL PROTECTED]
Subject: [Ntop] ntop more time to watch the gui
hi, i have the problem that i want more time to watch the captured netflow
datas. everytime i capture the information i lose this information after
some
minutes. is there a chance to have more time to watch ?
thank you
marco
--
GMX Weihnachts-Special: Seychellen-Traumreise zu gewinnen!
Rentier entlaufen. Finden Sie Rudolph! Als Belohnung winken
tolle Preise. http://www.gmx.net/de/cgi/specialmail/
+++ GMX - die erste Adresse f|r Mail, Message, More! +++
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
