RE: Problem restarting cflowd after it dies...

From: Martin_Nieuwelaar@infonet-europe.com
Date: Tue Nov 21 2000 - 03:04:50 PST

  • Next message: Martin_Nieuwelaar@infonet-europe.com: "RE: Problem restarting cflowd after it dies..."

    > -----Original Message-----
    > From: Martin Horneffer [mailto:Horneffer@rrz.Uni-Koeln.DE]
    > Sent: Tuesday, 21 November 2000 10:20
    > To: Martin_Nieuwelaar@infonet-europe.com; cflowd@caida.org
    > Subject: Re: Problem restarting cflowd after it dies...
    >
    >
    > On Nov 20, 12:54, Martin_Nieuwelaar@infonet-europe.com wrote:
    >
    > > I'm having some ongoing problems with cflowd. Everything
    > was running
    > > smoothly apparently until I started collecting netmatrix statistics.
    >
    > Just a stupid idea: did you check memory consumption of the cflowd
    > process?

    <snip!>

    Thanks for the reply.

    Indeed, I wondered about memory usage. It seems to hover around 40MB or so,
    which I think is fine as the collectors have 256MB, and don't do anything
    much other than run cflowd. One thing I do every day is run a whole lot of
    aggregation/processing scripts. artsnetagg really uses a lot of memory. I
    have had to increase my swap space frm 128MB to over 512MB. On one
    collector I have over 1GB of swap as I found an artsnetagg process using
    almost 800MB! The upshot is that when artsnetagg runs, the machine tends to
    thrash and things start to run pretty slowly. I wondered if this would
    cause a problem with cflowd. I would hope cflowd would just drop flows it
    couldn't handle, but maybe when it's overloaded (CPU-wise) something "bad"
    happens.

    Funny thing is, the aggregation scripts run in the early hours of the
    morning. The last two times cflowd was found to be dead were at 01:00 and
    15:00 (with a check being performed every hour). I can't think as yet why
    cflowd would die early in the afternoon, when (supposedly) nothing abnormal
    is going on.
     
    I have just checked the load on one of the busiest collectors. It seems to
    hover around 0.5 for most of the time except for some regular peaks where it
    shoots up to almost 2.0, before slowly falling off again towards 0.5. The
    peaks coincide with the writing of the stats to disk every 5 minutes. Maybe
    this much load is enough to cause problems.

    I think I'll watch it some more and see if I can spot a pattern...

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Tue Nov 21 2000 - 03:19:22 PST