Nothing useful in the log - not with almost 2 minutes elapsed between the last message and the end. Even --trace-level 4 probably won't help.
Run it under gdb - instructions are in docs/FAQ and capture the failure point and post that. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Joe Goldberg > Sent: Monday, July 19, 2004 10:38 PM > To: [EMAIL PROTECTED] > Subject: [Ntop] Web Server Dies when eth0 drops out of Promiscuous Mode > > > I am new to NTop and have checked the FAQ but I cannot seem to find the > issue I am having. > > I am running NTop 3.0 stable with a Gig Ethernet interface plugged into a > span port on a Cisco 6509. There is about 150Mbps of traffic > being mirrored > to the port. > > What happens is that NTop starts and works great but then after about 5 > minutes I get kernel: device eth0 left promiscuous mode in the log and the > web server is no longer accessible (I access this through another > interface > on the server). > > I turned the trace level to 4 and here is the tail of my log file if it > helps. By the way, I tried version 2.2 first (accidentally > downloaded that > one) and it worked fine for several days before I upgraded. By the way, > this is a RedHat 9 server running on a Dell 400SC with a Gig of RAM. > > Any help you can provide would be much appreciated. > > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking for IP address <-> > Country Code mapping file > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking './p2c.opt.table.gz' > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking './p2c.opt.table' > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Checking > '/etc/ntop/p2c.opt.table.gz' > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: ...Found > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: Loading file > '/etc/ntop/p2c.opt.table.gz' > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 10000 records read > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 20000 records read > Jul 19 20:50:36 netflow ntop[4385]: IP2CC: .... 30000 records read > Jul 19 20:50:37 netflow ntop[4385]: IP2CC: .... 40000 records read > Jul 19 20:50:37 netflow ntop[4385]: IP2CC: .... 50000 records read > Jul 19 20:50:37 netflow ntop[4385]: IP2CC: Closing file > Jul 19 20:50:37 netflow ntop[4385]: IP2CC: ...found 52395 lines > Jul 19 20:50:37 netflow ntop[4385]: GDVERCHK: Guessing at libgd version > Jul 19 20:50:37 netflow ntop[4385]: **WARNING** GDVERCHK: Unable to load > gd, message is 'libgd.so: cannot open shared object file: No such file or > directory' > Jul 19 20:50:37 netflow ntop[4385]: GDVERCHK: ... as 1.8.x > Jul 19 20:50:37 netflow ntop[4385]: Initializing external applications > Jul 19 20:50:37 netflow ntop[4385]: Initializing semaphores, mutexes and > threads > Jul 19 20:50:37 netflow ntop[4385]: NOTE: atfork() handler > registered for > mutexes, rc 0 > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Packet processor thread > running... > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread > (1116957488) for network packet analyser > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Fingerprint scan thread > running... > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread > (1125350192) for fingerprinting > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Idle host scan thread > running... > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread > (1133742896) for idle hosts detection > Jul 19 20:50:37 netflow ntop[4385]: Starting Plugins > Jul 19 20:50:37 netflow ntop[4385]: Calling plugin start functions (if > any) > Jul 19 20:50:37 netflow ntop[4385]: Plugins started... continuing with > initialization > Jul 19 20:50:37 netflow ntop[4385]: MEMORY: Base memory load is 4.03MB > (2459320+1757184) > Jul 19 20:50:37 netflow ntop[4385]: MEMORY: Base interface structure (no > hashes loaded) is 0.27MB each > Jul 19 20:50:37 netflow ntop[4385]: MEMORY: or 0.27MB for 1 > interfaces > Jul 19 20:50:37 netflow ntop[4385]: MEMORY: ipTraffixMatrix > structure (no > TrafficEntry loaded) is 1.41MB > Jul 19 20:50:37 netflow ntop[4385]: Sniffying... > Jul 19 20:50:37 netflow ntop[4385]: INIT: Created pid file > (/var/run/ntop.pid) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Checking current > ntop version > at version.ntop.org/version.xml > Jul 19 20:50:37 netflow ntop[4385]: Listening on [eth0] > Jul 19 20:50:37 netflow ntop[4385]: Now running as requested user 'root' > (0:0) > Jul 19 20:50:37 netflow ntop[4385]: Loading Plugins > Jul 19 20:50:37 netflow ntop[4385]: Searching for plugins in > /usr/lib/ntop/plugins > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/lastSeenPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: LASTSEEN: Welcome to > LastSeenWatchPlugin. (C) 1999 by Andrea Marangoni > Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'ip or > (vlan and ip)' > on interface eth0 > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/icmpPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: ICMP: Welcome to > icmpWatchPlugin. (C) > 1999-2004 by Luca Deri > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/netflowPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: NETFLOW: Welcome to NetFlow.(C) > 2002-04 by Luca Deri > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/nfsPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: NFS: Welcome to nfsWatchPlugin. (C) > 1999-2004 by Luca Deri > Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'port 2049' on > interface eth0 > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/pdaPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: PDA: Welcome to PDAPlugin. (C) > 2001-2004 by L.Deri and W.Brock > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/rrdPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: RRD: Welcome to rrdPlugin. > (C) 2002-04 > by Luca Deri. > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/sflowPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: SFLOW: Welcome to sFlowPlugin. (C) > 2002-04 by Luca Deri > Jul 19 20:50:37 netflow ntop[4385]: Compiling filter 'ip' on interface > eth0 > Jul 19 20:50:37 netflow ntop[4385]: Loading plugin > '/usr/lib/ntop/plugins/xmldumpPlugin.so' > Jul 19 20:50:37 netflow ntop[4385]: XML: Welcome to xmldump plugin. (C) > 2003-2004 by Burton Strauss > Jul 19 20:50:37 netflow ntop[4385]: Starting Plugins > Jul 19 20:50:37 netflow ntop[4385]: Calling plugin start functions (if > any) > Jul 19 20:50:37 netflow ntop[4385]: Starting 'xmldump plugin' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'sFlowPlugin' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'rrdPlugin' > Jul 19 20:50:37 netflow ntop[4385]: RRD: Welcome to the RRD plugin > Jul 19 20:50:37 netflow ntop[4385]: RRD: Mask for new > directories is 0700 > Jul 19 20:50:37 netflow ntop[4385]: RRD: Mask for new files is 0066 > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: rrd thread (1150528304) > started > Jul 19 20:50:37 netflow ntop[4385]: RRD: Started thread (1150528304) for > data collection. > Jul 19 20:50:37 netflow ntop[4385]: Starting 'PDAPlugin' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'nfsWatchPlugin' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'NetFlow' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'icmpWatchPlugin' > Jul 19 20:50:37 netflow ntop[4385]: Starting 'LastSeenWatchPlugin' > Jul 19 20:50:37 netflow ntop[4385]: Plugins started... continuing with > initialization > Jul 19 20:50:37 netflow ntop[4385]: SSL is present but https is > disabled: > use -W <https port> for enabling it > Jul 19 20:50:37 netflow ntop[4385]: Device 0. eth0 > (active) > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Merging > interfaces, reporting > device forced to 0 > Jul 19 20:50:37 netflow ntop[4385]: Note: Reporting device > initally set to > 0 [eth0] (merged) > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initializing web server > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initializing tcp/ip socket > connections for web server > Jul 19 20:50:37 netflow ntop[4385]: Initializing socket, port 3000, > address (any) > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Work-around > activated > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 0, > '/tmp/ntop-000004385-0' > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 0 - > '/tmp/ntop-000004385-0'(1) > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 1, > '/tmp/ntop-000004385-1' > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 1 - > '/tmp/ntop-000004385-1'(10) > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Creating 2, > '/tmp/ntop-000004385-2' > Jul 19 20:50:37 netflow ntop[4385]: FILEDESCRIPTORBUG: Created file 2 - > '/tmp/ntop-000004385-2'(11) > Jul 19 20:50:37 netflow kernel: application bug: ntop(4385) has > SIGCHLD set > to SIG_IGN but calls wait(). > Jul 19 20:50:37 netflow kernel: (see the NOTES section of 'man 2 wait'). > Workaround activated. > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Created a new socket (12) > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Initialized socket, port > 3000, address (any) > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Waiting for HTTP > connections > on port 3000 > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Starting web server > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: web connections thread > (4385) started... > Jul 19 20:50:37 netflow ntop[4385]: Note: SIGPIPE handler set (ignore) > Jul 19 20:50:37 netflow ntop[4385]: WEB: ntop's web server is now > processing requests > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread > (1158921008) for web server > Jul 19 20:50:37 netflow ntop[4385]: INITWEB: Server started... > continuing > with initialization > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: pcap dispatch thread > running... > Jul 19 20:50:37 netflow ntop[4385]: THREADMGMT: Started thread > (1167313712) for network packet sniffing on eth0 > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Sending request: GET > /version.xml HTTP/1.0^M Host: version.ntop.org^M User-Agent: > ntop/3.0+SourceForge+RPM host/i686-pc-linux-gnu distro/redhat release/9 > kernrlse/2.4.20-30.9smp GCC/3.2.2 config(host=; build=; target=; > programprefix=; execprefix=; bindir=; sbindir=; datadir=; includedir=; > libdir=; libexecdir=; localstatedir=; sharedstatedir=; mandir=; infodir=; > optimize; bindir=; datadir=; sslv3; i18n) run(user; dbfilepath; interface; > nomac; usesyslog=; tracelevel; tracklocalhosts; httpserver; > numericipaddresses; sessions; localsubnets; daemon) gdbm/1.8.0 gd/1.8.x > openssl/0.9.7a zlib/1.1.4 access/http interfaces(eth)^M Accept: */*^M ^M > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: http response: 200 > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: Version file is from > 'version.ntop.org' > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: as of date is > '2004-03-22T04:30:00' > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: obsolete is '2.2c ' > (202000300) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: unsupported is '2.2c ' > (202000300) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: stable is '3.0 ' > (300000000) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: development is '3.0.050 ' > (300050000) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: version is '3.0 > SourceForge RPM' (300000000) > Jul 19 20:50:37 netflow ntop[4385]: CHKVER: This version of ntop is the > CURRENT stable version > Jul 19 20:50:47 netflow ntop[4385]: SECURITY: Loading items table > Jul 19 20:51:37 netflow ntop[4385]: IDLE_PURGE: FINISHED > selection, 0 [out > of 1505] hosts selected > Jul 19 20:51:37 netflow ntop[4385]: IDLE_PURGE: Device 0: no > hosts deleted > Jul 19 20:53:17 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked > 514, resolved 514 > Jul 19 20:53:37 netflow ntop[4385]: IDLE_PURGE: FINISHED > selection, 0 [out > of 3199] hosts selected > Jul 19 20:53:37 netflow ntop[4385]: IDLE_PURGE: Device 0: no > hosts deleted > Jul 19 20:55:38 netflow ntop[4385]: IDLE_PURGE: FINISHED > selection, 0 [out > of 4677] hosts selected > Jul 19 20:55:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no > hosts deleted > Jul 19 20:55:52 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked > 178, resolved 178 > Jul 19 20:57:38 netflow ntop[4385]: IDLE_PURGE: FINISHED > selection, 0 [out > of 5263] hosts selected > Jul 19 20:57:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no > hosts deleted > Jul 19 20:58:23 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked > 70, resolved 70 > Jul 19 20:59:38 netflow ntop[4385]: IDLE_PURGE: FINISHED > selection, 0 [out > of 5600] hosts selected > Jul 19 20:59:38 netflow ntop[4385]: IDLE_PURGE: Device 0: no > hosts deleted > Jul 19 21:00:54 netflow ntop[4385]: OSFP: scanFingerprintLoop() checked > 39, resolved 39 > Jul 19 21:01:39 netflow ntop[4385]: IDLE_PURGE: FINISHED selection, 79 > [out of 6402] hosts selected > Jul 19 21:01:39 netflow ntop[4385]: IDLE_PURGE: Device 0 > [eth0]: 79 hosts > deleted, elapsed time is 0.194950 seconds (0.002468 per host) > Jul 19 21:03:14 netflow kernel: device eth0 left promiscuous mode > > > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
