not sure what dump flows is...but i tried with it disabled and still rrd
was filling the disk..
I tried again this morning (while dump flows was still enabled), from
8:30 AM to 10 AM, rrd has created 5 gigabytes of files on the disk.
Then i disabled dumpFlows, shutdown ntop, deleted everything in the rrd
database folder (i zapped everything, just to be sure), and started it
again.
In under 10 minutes ntop had created ~500 megabytes of rrd files, for
practically any host that it saw, ignoring the hosts filter:
Nov 9 10:56:47 oberon ntop[4064]: RRD: Welcome to the RRD plugin
Nov 9 10:56:47 oberon ntop[4064]: RRD: Mask for new directories is 0700
Nov 9 10:56:47 oberon ntop[4064]: RRD: Mask for new files is 0066
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: Parameters:
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpInterval 300 seconds
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpShortInterval 10
seconds
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpHours 72 hours
by 300 seconds
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDays 90 days by hour
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpMonths 36 months
by day
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDomains no
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpFlows no
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpSubnets no
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpHosts yes
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpInterfaces yes
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpASs no
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpMatrix no
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDetail high
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: hostsFilter
192.168.0.0/255.255.0.0
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: rrdPath
/var/ntop/ntop_data/rrd [normal]
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: rrdPath
/var/ntop/ntop_data/rrd [dynamic/volatile]
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: umask 0066
Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: DirPerms 0700
Gary Gatten wrote:
What's the dump flows? Is that supposed to be enabled?
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
adi
Sent: Thursday, November 08, 2007 1:11 AM
To: [email protected]
Subject: Re: [Ntop] problem: ntop is creating RRD files on disk for all
hostseven if told not to do it
oh, and another thing, now even though the rrd plugin is disabled ntop
tries to use it even so.
I decided to stop using it for now, since it fills the logs with:
at ntop startup:
Nov 8 09:03:21 oberon ntop[3655]: RRD: Welcome to Round-Robin
Databases. (C) 2002-07 by Luca Deri.
Nov 8 09:03:48 oberon ntop[3655]: RRD: Mask for new directories is
0700
Nov 8 09:03:48 oberon ntop[3655]: RRD: Mask for new files is 0066
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: Parameters:
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpInterval 300
seconds
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpShortInterval 10
seconds
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpHours 72 hours
by 300 seconds
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDays 90 days by
hour
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpMonths 36 months
by day
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDomains no
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpFlows yes
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpSubnets no
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpHosts yes
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpInterfaces yes
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpASs no
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpMatrix no
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDetail high
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: hostsFilter
192.168.0.0/255.255.0.0
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: rrdPath
/var/ntop/ntop_data/rrd [normal]
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: rrdPath
/var/ntop/ntop_data/rrd [dynamic/volatile]
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: umask 0066
Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: DirPerms 0700
YES, even if it is marked as not active, it still tries to configure it.
And then later on in the log....
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called
'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820
@rrdPlugin.c:2414]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called
with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called
'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820
@rrdPlugin.c:2414]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called
with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called
'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820
@rrdPlugin.c:2414]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called
with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called
'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820
@rrdPlugin.c:2414]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called
with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458]
Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called
'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820
@rrdPlugin.c:2414]
and so on.... ad nauseam
adi wrote:
Hello list and Luca,
I posted this message a few days ago on the ntop-dev list, but i
haven't received any replies yet... is anyone still using that list?
Anyway.... here it is copy&pasted again (and all times i mention there
are relative to november 6th).
In the meantime i have disabled the rrd plugin, it was getting
annoying to clean its mess daily.
-----
Starting since the svn releases of a week or two ago (can't determine
exactly since what svn revision update), ntop is ignoring my hosts
filter for rrd and has started to create rrd files for all hosts that
it sees.
I have defined the rrd hosts filter to only create rrd files for
192.168.0.0/255.255.0.0 but i see that ntop is creating rrd files for
any host, ignoring this setting.
Is there a recent change that i've missed? How can i tell it not to
create any rrd files at all except for the hosts mentioned?
Yesterday i was alerted by logwatch which found that i had an almost
full /var partition, and i tracked it down to ntop, its rrd files
alone were eating up about 30 gigabytes. I trimmed them manually to
only have 192.168.x.x in that list, and i also kept the ones for the
local ethernet mac addresses. This way it got down to ~80 megabytes,
for only the hosts i need. Down from 30GBytes that's quite a change.
This morning i found the rrd files have gained weight again, the rrd
databases had already swollen up to 1,8 GBytes, and since this morning
they shot up to3.2GBytes, that's almost another 1,5 gigabyte in less
than three hours!
Ntop is otherwise working fine, no lockups or anything, except for the
rrd thing. What is going on with the rrd storage?
# ./ntop --version
Tue Nov 6 09:24:33 2007 NOTE: Interface merge enabled by default
Tue Nov 6 09:24:33 2007 Initializing gdbm databases
Welcome to ntop v.3.3.4
[Configured on Nov 5 2007 13:57:31, built on Nov 5 2007 15:52:24]
This is the latest one from SVN, revision 3346.
O.S. is fedora 7 with latest updates applied, kernel is
2.6.23.1-21.fc7
i configured ntop as (and yes i know some options are obsolete or
redundant, but if autogen/configure don't complain about them i keep
them around. )
./autogen.sh --prefix=/var/ntop --enable-dependency-tracking
--with-pic --without-ssl --disable-ssl --disable-sslv3
--enable-largerrdpop --enable-jumbo-frames --with-rrd-home=/usr
and ntop is started as:
#!/bin/sh
/var/ntop/bin/ntop -n -e 512 -d -4 -M -m 192.168.0.0/24 -i eth1 -u
ntop -w 192.168.0.15:1083 -Q /var/ntop/ntop_data -P
/var/ntop/ntop_data -O /var/ntop/ntop_data/logs -a
/var/ntop/ntop_data/logs/access.log >>
/var/ntop/ntop_data/logs/logfile.log
Adi
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in
1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
