OK, similar to other posts but now I've all but ruled out hardware issues.
When running v3.2 on FreeBSD 6.0 I was running 3 instances of ntop with a total of about... 20 netflow interfaces. This was a PIII-750 and load average and cpu was fine (50% and .5) until it ran out of memory and started swapping. When I upgraded to 3.3.3-8 I immediately noticed this system could no longer keep up with the netflow load - even though our traffic remained pretty much the same. I messed with this for some time disabling different features, including GeoIP - but no no avail. So, I upgraded hardware. Now I'm running Solaris 10 x86 on a VMWare VM. I only have one instance of ntop 3.3.10 running, but it see's everything through our core LAN - it now has about 12,000 hosts and 20,000 sessions. I don't know what the physical hardware is, but the sysadmin tells me I have a single 3GHz CPU - obviously MUCH more powerfule than a PIII-750, yet CPU util is still > 90% and load is about 1.3. And I still have 2 other ntop instances to move over to this platform.... So, what can I do to determine what is causing such a drastic increase in 3.3.x cpu requirements? I guess more accurately, how can I determine if ntop is working "correctly", or if there's a bug of some kind causing a race condition, or maybe I linked against some library with problems? I'm half tempted to compile v3.2 on this platform and see what happens, but I'm guess I'll get similar results as the FreeBSD platform. Any help on this would be GREATLY appreciated! If anyone else running 3.3.8+ is monitoring a large number of hosts with many dynamic sessions, maybe you can reply with your CPU info? Oh yea, I restarted this instance last night while traffic was low and it was using < 10% cpu, when I came in this morning it was > 95% again. prstat shows 8 LWP's: (1) zombie (libpcap - don't care), 6 mostly in sleep, and one process in run and consuming 85% of the cpu. I tried to check this out with gdb but it's not workin too well - it's not listing thread 1! Anyway, TIA! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
