[Ntop-dev] [Ntop] high CPU load / can't keep up with netflow since upgrade to 3.3.8

[Luca Deri]

Gary
did you start ntop -i none ? (i.e. is't because of NetFlow or any  
other pcap-related issues?)

Luca

On May 11, 2009, at 6:07 PM, Gary Gatten wrote:

> Been running 3.2.1 for years and CPU has always been fine.  Avg,  
> load on FreeBSD 6.0 is around .5, CPU around 40%, and udp port  
> queues (netstat –a) are most always zero, but sometimes a couple get  
> a little backed up for a few mins here and there.
>
> Now running 3.3.8 compiled from ports.  Load now 1.8, CPU 100%,  and  
> most all udp netflow queues are maxed and not emptying, especially  
> within one instance that has many flow exporters – about 160’ish:
>
> $ netstat -a | grep flow
> Ntop Instance 1
> udp4   41200      0  *.netflow-Regn29       *.*
> udp4   41496      0  *.netflow-Regn16       *.*
> udp4   41456      0  *.netflow-Regn15       *.*
> udp4   40904      0  *.netflow-Regn11       *.*
> udp4   41544      0  *.netflow-Regn10       *.*
> udp4   41456      0  *.netflow-Regn02       *.*
> udp4   41552      0  *.netflow-Regn88       *.*
> udp4   40656      0  *.netflow-Regn53       *.*
>
> Ntop Instance 2
> udp4       0      0  *.netflow-Inet         *.*
>
> Ntop Instance 3
> udp4       0      0  *.netflow-LANCore      *.*
>
> 3.2.1 had its issues, but as far as netflow and cpu  load it was  
> fine.  I’d like to get on a more recent version, but keep hitting  
> roadblocks.  Tried this back with 3.3.1 (I think?) with similar  
> results.
>
> Nothing in logs I find interesting.  Only interesting thing on  
> compile what something about “sched.h”:
>
> checking sys/sched.h presence... yes
> configure: WARNING: sys/sched.h: present but cannot be compiled
> configure: WARNING: sys/sched.h:     check for missing prerequisite  
> headers?
> configure: WARNING: sys/sched.h: see the Autoconf documentation
> configure: WARNING: sys/sched.h:     section "Present But Cannot Be  
> Compiled"
> configure: WARNING: sys/sched.h: proceeding with the preprocessor's  
> result
> configure: WARNING: sys/sched.h: in the future, the compiler will  
> take precedence
>
>
> I’m willing to do anything reasonable to help get this resolved.   
> Any help would be greatly appreciated!!!
>
> TIA!
>
> Gary
>
> "This email is intended to be reviewed by only the intended  
> recipient and may contain information that is privileged and/or  
> confidential. If you are not the intended recipient, you are hereby  
> notified that any review, use, dissemination, disclosure or copying  
> of this email and its attachments, if any, is strictly prohibited.  
> If you have received this email in error, please immediately notify  
> the sender by return email and delete this email from your system."
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

---
If you can not measure it, you can not improve it - Lord Kelvin

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listgateway.unipi.it/pipermail/ntop-dev/attachments/20090512/e334aee5/attachment.htm>