I misspoke - I do understand that it spawns multiple instances on its own. I just thought it was odd that it could do this as I assumed any instance using the same directory and files would encounter similar file sharing issues I experienced when accidentally starting ntop when an instance with the same runtime parms was already active.
The dnsCache.db issue usually causes ntop to die - on my system it was causing segfaults. I'm not sure if this will have any impact on your issue where ntop seems to replicate itself. That's just really weird behavior. Are you sure there's nothing in cron, login scipts, etc. that could be starting these? G ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wiebel, Rolf Sent: Thursday, April 17, 2008 11:37 AM To: [email protected] Subject: AW: [Ntop] NTOP : Hangs after some days Hello, maybe there is a misunderstanding . I start it only once. Not serveral times. This is done automaticaly during the next days. If I start ntop from command line with /usr/bin/ntop -t 5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 several times, it starts only once ps -ef | grep ntop wwwrun 9049 1 4 18:14 ? 00:00:29 /usr/bin/ntop -t 5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 root 10971 8136 0 18:25 pts/0 00:00:00 grep ntop I've setup 5 systems with Suse 9.3 / Ntop 3.2 and 2 System with Suse 10.2 / Ntop3.3. Only one NTOP 3.3 system has this problem. I've now followed the hint to delete the dnsCache.db ( size was only 4 MB ) and restart NTOP. Keep you informed if this helps Regards Rolf Here is the output with setting the flags /usr/bin/ntop -t 5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 Thu Apr 17 18:14:53 2008 NOTE: Interface merge enabled by default Thu Apr 17 18:14:53 2008 Initializing gdbm databases Thu Apr 17 18:14:53 2008 Opening database '/var/lib/ntop/prefsCache.db' Thu Apr 17 18:14:53 2008 Opening database '/var/lib/ntop/ntop_pw.db' Thu Apr 17 18:14:53 2008 NOTE: Reading preferences file entries Thu Apr 17 18:14:53 2008 NOTE: Processing parameters (pass2) Thu Apr 17 18:14:53 2008 ntop v.3.3 Thu Apr 17 18:14:53 2008 Configured on Sep 22 2007 3:29:05, built on Sep 22 2007 03:29:23. Thu Apr 17 18:14:53 2008 Copyright 1998-2007 by Luca Deri <[EMAIL PROTECTED]> Thu Apr 17 18:14:53 2008 Get the freshest ntop from http://www.ntop.org/ Thu Apr 17 18:14:53 2008 NOTE: ntop is running from '/usr/bin' Thu Apr 17 18:14:53 2008 NOTE: (but see warning on man page for the --instance parameter) Thu Apr 17 18:14:53 2008 NOTE: ntop libraries are in '/usr/lib' Thu Apr 17 18:14:53 2008 Initializing ntop Thu Apr 17 18:14:53 2008 Initializing IP services Thu Apr 17 18:14:53 2008 Initializing network devices Thu Apr 17 18:14:54 2008 Found interface [index=0] 'eth0' Thu Apr 17 18:14:54 2008 Found interface [index=1] 'eth1' Thu Apr 17 18:14:54 2008 Found interface [index=2] 'eth2' Thu Apr 17 18:14:54 2008 Found interface [index=3] 'any' Thu Apr 17 18:14:54 2008 Found interface [index=4] 'lo' Thu Apr 17 18:14:54 2008 Checking requested device 'eth0' Thu Apr 17 18:14:54 2008 Adding network device eth0 Thu Apr 17 18:14:54 2008 Interface 'eth0' (netmask 255.255.255.0) computed network size is 606 hosts Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no TrafficEntry) for interface 'eth0' is 1.45MB Thu Apr 17 18:14:54 2008 Checking eth0 for additional devices Thu Apr 17 18:14:54 2008 Checking eth0:0 Thu Apr 17 18:14:54 2008 Checking eth0:1 Thu Apr 17 18:14:54 2008 Checking eth0:2 Thu Apr 17 18:14:54 2008 Checking eth0:3 Thu Apr 17 18:14:54 2008 Checking eth0:4 Thu Apr 17 18:14:54 2008 Checking eth0:5 Thu Apr 17 18:14:54 2008 Checking eth0:6 Thu Apr 17 18:14:54 2008 Checking eth0:7 Thu Apr 17 18:14:54 2008 Resetting traffic statistics for device eth0 Thu Apr 17 18:14:54 2008 Initializing device eth0 (0) Thu Apr 17 18:14:54 2008 DLT: Device 0 [eth0] is 1, mtu 1514, header 14 Thu Apr 17 18:14:54 2008 Checking requested device 'eth1' Thu Apr 17 18:14:54 2008 Adding network device eth1 Thu Apr 17 18:14:54 2008 Interface 'eth1' (netmask 255.255.255.0) computed network size is 606 hosts Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no TrafficEntry) for interface 'eth1' is 1.45MB Thu Apr 17 18:14:54 2008 Checking eth1 for additional devices Thu Apr 17 18:14:54 2008 Checking eth1:0 Thu Apr 17 18:14:54 2008 Checking eth1:1 Thu Apr 17 18:14:54 2008 Checking eth1:2 Thu Apr 17 18:14:54 2008 Checking eth1:3 Thu Apr 17 18:14:54 2008 Checking eth1:4 Thu Apr 17 18:14:54 2008 Checking eth1:5 Thu Apr 17 18:14:54 2008 Checking eth1:6 Thu Apr 17 18:14:54 2008 Checking eth1:7 Thu Apr 17 18:14:54 2008 Resetting traffic statistics for device eth1 Thu Apr 17 18:14:54 2008 Initializing device eth1 (1) Thu Apr 17 18:14:54 2008 DLT: Device 1 [eth1] is 1, mtu 1514, header 14 Thu Apr 17 18:14:54 2008 Checking requested device 'eth2' Thu Apr 17 18:14:54 2008 Adding network device eth2 Thu Apr 17 18:14:54 2008 Interface 'eth2' (netmask 255.255.255.0) computed network size is 606 hosts Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no TrafficEntry) for interface 'eth2' is 1.45MB Thu Apr 17 18:14:54 2008 Checking eth2 for additional devices Thu Apr 17 18:14:54 2008 Checking eth2:0 Thu Apr 17 18:14:54 2008 Checking eth2:1 Thu Apr 17 18:14:54 2008 Checking eth2:2 Thu Apr 17 18:14:54 2008 Checking eth2:3 Thu Apr 17 18:14:54 2008 Checking eth2:4 Thu Apr 17 18:14:54 2008 Checking eth2:5 Thu Apr 17 18:14:54 2008 Checking eth2:6 Thu Apr 17 18:14:54 2008 Checking eth2:7 Thu Apr 17 18:14:54 2008 Resetting traffic statistics for device eth2 Thu Apr 17 18:14:54 2008 Initializing device eth2 (2) Thu Apr 17 18:14:54 2008 DLT: Device 2 [eth2] is 1, mtu 1514, header 14 Thu Apr 17 18:14:54 2008 Initializing gdbm databases Thu Apr 17 18:14:54 2008 Creating database '/var/lib/ntop/addressQueue.db' Thu Apr 17 18:14:54 2008 Opening database '/var/lib/ntop/dnsCache.db' Thu Apr 17 18:14:54 2008 Opening database '/var/lib/ntop/macPrefix.db' Thu Apr 17 18:14:54 2008 Opening database '/var/lib/ntop/fingerprint.db' Thu Apr 17 18:14:54 2008 VENDOR: Loading MAC address table. Thu Apr 17 18:14:54 2008 VENDOR: Checking for MAC address table file Thu Apr 17 18:14:54 2008 VENDOR: Checking './specialMAC.txt.gz' Thu Apr 17 18:14:54 2008 VENDOR: Checking './specialMAC.txt' Thu Apr 17 18:14:54 2008 VENDOR: Checking '/etc/ntop/specialMAC.txt.gz' Thu Apr 17 18:14:54 2008 VENDOR: ...Found Thu Apr 17 18:14:54 2008 VENDOR: Database created/last modified Thu Apr 17 18:06:56 2008 Thu Apr 17 18:14:54 2008 VENDOR: Input file created/last modified Tue Feb 26 14:27:20 2008 Thu Apr 17 18:14:54 2008 VENDOR: File '/etc/ntop/specialMAC.txt.gz' does not need to be reloaded Thu Apr 17 18:14:54 2008 VENDOR: ntop continues ok Thu Apr 17 18:14:54 2008 VENDOR: Checking for MAC address table file Thu Apr 17 18:14:54 2008 VENDOR: Checking './oui.txt.gz' Thu Apr 17 18:14:54 2008 VENDOR: Checking './oui.txt' Thu Apr 17 18:14:54 2008 VENDOR: Checking '/etc/ntop/oui.txt.gz' Thu Apr 17 18:14:54 2008 VENDOR: ...Found Thu Apr 17 18:14:54 2008 VENDOR: Database created/last modified Thu Apr 17 18:06:56 2008 Thu Apr 17 18:14:54 2008 VENDOR: Input file created/last modified Tue Feb 26 14:27:20 2008 Thu Apr 17 18:14:54 2008 VENDOR: File '/etc/ntop/oui.txt.gz' does not need to be reloaded Thu Apr 17 18:14:54 2008 VENDOR: ntop continues ok Thu Apr 17 18:14:54 2008 Fingerprint: Loading signature file Thu Apr 17 18:14:54 2008 Fingerprint: Checking for Fingerprint file... file Thu Apr 17 18:14:54 2008 Fingerprint: Checking './etter.finger.os.gz' Thu Apr 17 18:14:54 2008 Fingerprint: Checking './etter.finger.os' Thu Apr 17 18:14:54 2008 Fingerprint: Checking '/etc/ntop/etter.finger.os.gz' Thu Apr 17 18:14:54 2008 Fingerprint: ...Found Thu Apr 17 18:14:54 2008 Fingerprint: Loading file '/etc/ntop/etter.finger.os.gz' Thu Apr 17 18:14:54 2008 Fingerprint: ...loaded 1765 records Thu Apr 17 18:14:54 2008 INIT: Parent process is exiting (this is normal) Thu Apr 17 18:14:54 2008 INIT: Bye bye: I'm becoming a daemon... ________________________________ Von: [EMAIL PROTECTED] im Auftrag von Gary Gatten Gesendet: Do 17.04.2008 18:10 An: [email protected] Betreff: Re: [Ntop] NTOP : Hangs after some days I have not seen this before. If I try to start mine more than once I get errors relating to file reads/locks and it aborts. I'm not even sure where to start on this. Does it always try to start more than one instance or just after a reboot? Maybe try the -t 5 and -K flags and see if there's more detailed messages? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Wiebel, Rolf Sent: Thursday, April 17, 2008 8:42 AM To: [email protected] Subject: [Ntop] NTOP : Hangs after some days Hello, I've a problem that NTOP hangs after a while NTOP is running , but several times ps -ef | grep ntop wwwrun 5909 1 51 Mar25 ? 12-00:22:33 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 wwwrun 4043 5909 0 Mar26 ? 00:00:00 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 wwwrun 28053 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 wwwrun 8190 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 wwwrun 13164 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 wwwrun 24066 5909 0 Apr01 ? 00:00:00 /usr/bin/ntop -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000 Any idea why it start several times ? Then on 4.4. it stops getting data. If I stop and start ntop all is working fine. Regards Rolf _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
