I'm running cflowd (version 2-1-b1) on Linux. I've observed a problem where
cflowd/cfdcollect SNMP polls the routers excessively. So much so, in fact,
that it often causes cfdcollect to crash/hang, presumably for a lack of
time. Usually, the message "cfdcollect[pid]: [I] localhost has data for
134742016 routers." appears in the log file with this crash.
cflowd/cfdcollect was doing the entire SNMP cycle (all interface
descriptions and all interface IPs) N times to each router, where N is the
number of interfaces on that router. cfdcollect has managed to go a week or
more without crashing while operating in this way.
I bring it up here because I've seen e-mails here mentioning keep alive
scripts for cfdcollect and others mentioning the "134742016 routers" log
message, both of which seem to indicate this same problem.
As it turns out, this is not hard to work around. First, the router must be
set so that all of the cflowd datagrams that it sends will use its loopback
address as the sender's address. Second, cflowd should be reconfigured so
that the ADDRESSES stanza of CISCOEXPORTER contains only that same one
address. After making these changes, the amount of time that cfdcollect
sleeps between collections went way up.
I'd be interested to hear if anyone else has experienced this problem and,
if so, on what operating system(s)?
K.C. Smith
-- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Thu Jan 11 2001 - 12:44:41 PST