If you are merging interfaces (the default) and monitoring multiple NICs, you CAN have situations where ntop sees the same traffic multiple times and will try to update the RRD twice.
Internally it's different 'hosts' because the MAC addresses are different (switches and other networking devices re-write the packets with their own MAC - this is basic Ethernet). So ntop makes them out to be different hosts. (mac1)(ip1) -> (ip2) Vs. (mac2)(ip1) -> (ip2) But rrd files are based solely on (interface)(ipaddr). There were some extensive discussions on this on-list about a two years ago, you may need the ignore MAC address flag. Some of this is in the FAQ. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Gatten Sent: Thursday, September 06, 2007 11:33 AM To: [email protected] Subject: RE: [Ntop] Ntop Error message. The time-stamp Warnings? Hopefully just FYI warnings and nothing serious - but I'm not sure. G -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steven Relf Sent: Thursday, September 06, 2007 10:59 AM To: [email protected] Subject: RE: [Ntop] Ntop Error message. Hi Gary/list Cheers, I have had another look and updated those mentioned. The machine is now out of disk space... :S Any ideas on the RRD errors? Steve -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Gatten Sent: 06 September 2007 16:44 To: [email protected] Subject: RE: [Ntop] Ntop Error message. Check the man page for details on some of the startup switches. When monitoring a bunch of hosts some of the defaults need to be increased. Not sure if that's all your problems but it's a start. Notice in your message it mentions "-x" - that's one I had to change. Gary -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steven Relf Sent: Thursday, September 06, 2007 9:10 AM To: [email protected] Subject: [Ntop] Ntop Error message. Hi Guys/Gals, Quick one, I currently monitoring our outbound and in bound Internet traffic, but am having some issues.. Mainly these 09/06/07 13:34:32 **WARNING** Address resolution queue is full [4096 slots] 09/06/07 13:34:32 Addresses in excess won't be resolved - ntop continues 09/06/07 13:44:43 WARNING: Max num hash entries (12000) reached (see -x) 09/06/07 13:44:43 **ERROR** Sanity check failed (2) [Low memory?] 9/06/07 14:46:23 **WARNING** RRD: rrd_update(\MinGW\ntop-3.2.2\ntop\rrd\interfaces\Realtek RTL8139 Family Fast Ethernet Adapter_1\matrix\10.136.248.31\10.136.249.50\pkts.rrd) error: illegal attempt to update using time 1189086374 when last update time is 1189086374 (minimum one second step) 09/06/07 14:46:23 **WARNING** RRD: rrd_update(\MinGW\ntop-3.2.2\ntop\rrd\interfaces\Realtek RTL8139 Family Fast Ethernet Adapter_1\matrix\10.136.248.31\10.136.249.50\bytes.rrd) error: illegal attempt to update using time 1189086374 when last update time is 1189086374 (minimum one second step) Also when I shut down Ntop all the data that I think should be stored in the RRD doesn't come back when I re-start the service. All except the Network load graph, but none of the host info stays. Any help would be greatly appreciated. Running on Win XP Cheers Steve _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop ======================================================================== === "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
