Re: Looking for troubleshooting tips.
I shift deleted my inbox and lost all of the original replies :( anyway... I have another sensor that just started to exhibit this same behavior. This time though, I have some more info: swap_pager_getswapspace(4): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(2): failed pid 75157 (flow-report), uid 1001, was killed: out of swap space What made me notice this time was the zabbix (http://www.zabbix.com/) agent on this host kept bumping online/offline. So it looks like we are loaded enough to affect other processes as well. Is this just a matter of adding more ram? Or do I increase the swap space? Or is there another issue here; I have never ran out of swap space before? Thanks. On Wed, Oct 21, 2009 at 9:58 AM, Paul Halliday paul.halli...@gmail.comwrote: I use Freebsd as the base for my network monitoring sensors. These machines run a netflow probe, act as a netflow collector and spool full content data from a snort process FIFO that is bound to a span port. During peak hours this can be 100MB saturated, its connected to a GB intel NIC on the box (there is a separate uplink). In the background numerous little scripts run to produce summary data. The basic template for these systems has been the same for the past 4 years and things have worked great. Recently, one of these machines started to become a little laggy and I can't seem to identify the issue. This system has always seen a lot of packet loss, I expect this though as it is a busy site but this has never affected its performance. Can an overloaded NIC cause serious performance issues like those I am seeing? This is a recent top: last pid: 98870; load averages: 1.54, 1.41, 1.31 up 1+01:57:10 11:50:24 142 processes: 2 running, 139 sleeping, 1 zombie CPU states: 30.9% user, 0.0% nice, 15.0% system, 1.7% interrupt, 52.4% idle Mem: 450M Active, 328M Inact, 168M Wired, 33M Cache, 110M Buf, 3700K Free Swap: 2048M Total, 5112K Used, 2043M Free 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 To be honest, I don't know which counters are important. Is there anything specific I should be concentrating on to determine the cause? Thanks. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: Looking for troubleshooting tips.
On Tue, Oct 27, 2009 at 8:54 AM, Paul Halliday paul.halli...@gmail.comwrote: I shift deleted my inbox and lost all of the original replies :( anyway... I have another sensor that just started to exhibit this same behavior. This time though, I have some more info: swap_pager_getswapspace(4): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(2): failed pid 75157 (flow-report), uid 1001, was killed: out of swap space What made me notice this time was the zabbix (http://www.zabbix.com/) agent on this host kept bumping online/offline. So it looks like we are loaded enough to affect other processes as well. Is this just a matter of adding more ram? 1. This is what I would do provided 3 is explored appropriately Or do I increase the swap space? 2. This works too, but keep in mind swap space is orders of magnitude slower than RAM. Or is there another issue here; I have never ran out of swap space before? 3. Could be a runaway process/memory leaking consuming all available resources. If that is the case 1 and 2 won't help so check this out first. Thanks. Please don't top-post. -- Adam Vande More ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: Looking for troubleshooting tips.
On Wed, Oct 21, 2009 at 9:58 AM, Paul Halliday paul.halli...@gmail.comwrote: I use Freebsd as the base for my network monitoring sensors. These machines run a netflow probe, act as a netflow collector and spool full content data from a snort process FIFO that is bound to a span port. During peak hours this can be 100MB saturated, its connected to a GB intel NIC on the box (there is a separate uplink). In the background numerous little scripts run to produce summary data. The basic template for these systems has been the same for the past 4 years and things have worked great. Recently, one of these machines started to become a little laggy and I can't seem to identify the issue. This system has always seen a lot of packet loss, I expect this though as it is a busy site but this has never affected its performance. Can an overloaded NIC cause serious performance issues like those I am seeing? This is a recent top: last pid: 98870; load averages: 1.54, 1.41, 1.31 up 1+01:57:10 11:50:24 142 processes: 2 running, 139 sleeping, 1 zombie CPU states: 30.9% user, 0.0% nice, 15.0% system, 1.7% interrupt, 52.4% idle Mem: 450M Active, 328M Inact, 168M Wired, 33M Cache, 110M Buf, 3700K Free Swap: 2048M Total, 5112K Used, 2043M Free 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 To be honest, I don't know which counters are important. Is there anything specific I should be concentrating on to determine the cause? Thanks. The top stats indicate a moderate load, nothing to worry about there. I think you'll need to focus on network specific troubleshooting and you'll need to provide more info than what you've given to start with that. -- Adam Vande More ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
