Sounds like you made great progress! Luca and friends are around somewhere. Maybe post your results as some sort of bugfix report to both lists.
Did you use gdb to get all your stats? I've been trying to track down high cpu usage on ip/name resolution threads. I know 100% these threads are resolution threads, but If I can get info similar to what you got; the number of times a function is called, etc. - that may help. Anyway, glad you made progress here! G ----- Original Message ----- From: [email protected] <[email protected]> To: [email protected] <[email protected]> Sent: Tue Mar 16 06:49:12 2010 Subject: Re: [Ntop] packets being dropped (libpcap) On 3/15/10, Gary Gatten <[email protected]> wrote: > Run in gdb to see what thread is doing what. I usually use top on just the > ntop process and enable threads to see which thread(s) take the most time. > Then with the thread I'd I can use gdb to see what those threads are doing. > Or, *maybe* if -K and -t 5 is set ntop will write the thread name and I'd to > the log on startup, but I don't recall for sure... I tracked this down to updateASTraffic() (pbuf.c), 80% of the CPU time is spend in this function. I if I prevent updatePacketCount() from calling updateASTraffic() everything works fine. Only a few packets are dropped (0.1%). It looks like updateASTraffic() is called for every packet?!? So for every packet ntop loops over the myGlobals.device[actualDeviceId].asStats list. After a few seconds running my asStats list had ~2000 entries. With 248320 calles to updateASTraffic() the while(stats) loop in updateASTraffic() already looped 10970927 times. Where are these asStats acutally used? IP/Summary/ASs works fine without that updateASTraffic() call. I only could find a reference in the rrd plugin. I guess we should move this to ntop-dev. _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
