I just found a way to get around all of this. I hacked the flowwatch
program that connects to cflowdmux to write the raw flows to disk. Now I
don't even need to use cflowd! Its much faster and probably more
reliable. I would suggest doing this to anyone who is using Flowscan.
Flowwatch only uses a couple megs of memory compared to 650 Mb with
cflowd. If anyone is interested, let me know.
-Blake
Andrew Fort wrote:
> Oops, sorry I should've posted this to the list, please send any replies
> there
>
> > From: Andrew Fort
> >
> > Blade Caldwell wrote,
> >
> > > Sometimes it will grow
> > > up to 650 Mb in a single day. Because of this I am forced to
> > > restart Cflowd 3
> > > times a day. I know this is more data than cflowd was
> >
> > sounds like a leak; what versions of cflowd and arts++ are in
> > use, on what platform?
> >
> > I had a similar problem, caused by me having cfdcollect and
> > cflowdmux running but NOT cflowd (my collector reads from
> > cflowdmux's shared memory cells). Killing cflowdmux stopped the leak.
> >
> > -afort
> >
-- cflowd mailing list cflowd@caida.org
This archive was generated by hypermail 2b29 : Sat Feb 10 2001 - 16:04:18 PST