Peter,
I've used those specific grub.conf tweaks on i386 systems with 1 to 4GB
of memory.
I'm really not a memory guru, so I don't have a feel for what other
kinds of things use vmalloc memory or how to diagnose memory leaks.
You have to use the pf_ring kernel module, but you don't have to patch
your kernel to make it work as was necessary in the past. Also, the
PF_RING-aware network drivers are optional but desirable for
performance. You cannot use transparent mode unless you use a
PF_RING-aware network driver. At least when I tried using PF_RING with
transparent mode ON but no PF_RING network driver, my PF_RING-linked
apps would run and allocate rings but never see any packets. I
recommend you get things working satisfactorily with transparent mode
OFF and without a PF_RING network driver. Then add the driver in and
try out transparent mode. Such a starting configuration would look
something like this for your options line in modprobe.conf
options pf_ring num_slots=4096 transparent_mode=0
(each ring will allocate memory for 4096 packets, transparent mode is off)
I am not aware of any problems caused by having some applications use
PF_RING and others not.
Would somebody else please weigh in on what transparent mode is for?
Kevin
On 2/16/2010 7:11 AM, Peter Bates wrote:
Hello all...
--On 15 February 2010 15:58 -0500 The Branches <[email protected]>
wrote:
I suggest you cat /proc/meminfo and check out your Vmalloc values. It
sounds like you are almost out of vmalloc space. Also look in
/proc/net/pf_ring/ to see if you have any rings presently allocated
eating up your vmalloc space.
/proc/net/pf_ring is clear as the applications aren't running any more.
meminfo unfortunately shows:
VmallocTotal: 122564 kB
VmallocUsed: 121700 kB
If you are on an i386 platform, vmalloc space is more cramped due to the
memory architecture. Tweaking /etc/grub.conf with uppermem and vmalloc
directive has helped me. Here is an example snippet from me
/etc/grub.conf
title CentOS (2.6.18-164.11.1.el5PAE)
root (hd0,0)
uppermem 384000
kernel /vmlinuz-2.6.18-164.11.1.el5PAE ro
root=/dev/VolGroup00/LogVolRoot vmalloc=512M
initrd /initrd-2.6.18-164.11.1.el5PAE.img
How much physical RAM do you have on the box in question?
Of course, the other way to conserve vmalloc space is to only use
PF_RING
for the apps that really need it.
Yes - this is part of my confusion, although I've read the PF_RING web
page
and userguide - I'm still unsure as to the setting of 'Transparent
mode' and
whether I should be using a NIC driver patched for PF_RING or not.
I was still seeing packet loss with Snort using PF_RING so clearly my
box (a P4 system) just isn't up to the task.
The memory exhaustion I presumed was down to the other application I
was running using PF_RING but restarting every 30 minutes with the
memory not being freed properly - until it eventually fell over.
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
