cflowd and snmp ("134742016 routers")

From: K.C. Smith (kace@netrail.net)
Date: Thu Jan 11 2001 - 12:15:30 PST

  • Next message: Lars Michael Jogback: "Failed to release buffer lock?"

    I'm running cflowd (version 2-1-b1) on Linux. I've observed a problem where
    cflowd/cfdcollect SNMP polls the routers excessively. So much so, in fact,
    that it often causes cfdcollect to crash/hang, presumably for a lack of
    time. Usually, the message "cfdcollect[pid]: [I] localhost has data for
    134742016 routers." appears in the log file with this crash.
    cflowd/cfdcollect was doing the entire SNMP cycle (all interface
    descriptions and all interface IPs) N times to each router, where N is the
    number of interfaces on that router. cfdcollect has managed to go a week or
    more without crashing while operating in this way.

    I bring it up here because I've seen e-mails here mentioning keep alive
    scripts for cfdcollect and others mentioning the "134742016 routers" log
    message, both of which seem to indicate this same problem.

    As it turns out, this is not hard to work around. First, the router must be
    set so that all of the cflowd datagrams that it sends will use its loopback
    address as the sender's address. Second, cflowd should be reconfigured so
    that the ADDRESSES stanza of CISCOEXPORTER contains only that same one
    address. After making these changes, the amount of time that cfdcollect
    sleeps between collections went way up.

    I'd be interested to hear if anyone else has experienced this problem and,
    if so, on what operating system(s)?

    K.C. Smith

    --
    cflowd mailing list
    cflowd@caida.org
    



    This archive was generated by hypermail 2b29 : Thu Jan 11 2001 - 12:44:41 PST