I cannot offer insight to mVLAN, but the other two problems you are
having (NULL host and EPIPE) are also both happening to me.
The NULL host detection seems to be occuring when NTOP hits it's
defined MAX_HOSTS limit, which is 8192 by default, or can be user set
with the -x flag I believe. It would seem that this error message pops
up when NTOP tries to add a host, cannot allocate memory for it, and
as such just leaves it at NULL. This is fully my opinion, and I would
expect that you are under exactly the same circumstances, however I'm
not sure if it is detrimental or not in either of our cases, I would
also like to know if there is a way to stop this error.
In terms of the EPIPE, I think it seems to occur if the NTOP server is
under considerable load (like ~50%) and you attempt to access the web
interface or otherwise place the CPU under load while accessing the
web interface. It seems that when CPU is topping out at 100% because
of web access, it reports these errors. This may be posing a problem,
because when the EPIPE occurs (if it is infact because of 100% CPU,
then there will be dropped packets as well). It just means something
has failed (epipe is similar to broken pipe if i remember correctly),
when sending the HTTP request.
Would still like to know if there is a resolution for the NULL host.
Nick
Quoting Hailu Meng <[email protected]>:
Hi All,
I have ntop setup recently in ubuntu 10.04 server. After running 3 days, I
got some logs from ntop:
Mon Jun 28 08:32:57 2010 **ERROR** NULL host detected
Mon Jun 28 08:33:23 2010 **ERROR** NULL host detected
Mon Jun 28 08:34:00 2010 **ERROR** NULL host detected
Mon Jun 28 08:35:21 2010 **ERROR** NULL host detected
Mon Jun 28 08:36:44 2010 **ERROR** mVLAN: Host (identical IP/MAC)
found on multiple VLANs
Mon Jun 28 08:36:44 2010 mVLAN: ntop continues but will consolidate
and thus probably overcount this traffic
Mon Jun 28 08:38:54 2010 **ERROR** NULL host detected
Mon Jun 28 08:40:53 2010 EPIPE during sending of page to web client
Mon Jun 28 08:40:58 2010 EPIPE during sending of page to web client
Mon Jun 28 08:41:01 2010 EPIPE during sending of page to web client
Mon Jun 28 08:41:10 2010 EPIPE during sending of page to web client
Mon Jun 28 08:41:14 2010 EPIPE during sending of page to web client
Mon Jun 28 08:41:17 2010 EPIPE during sending of page to web client
Mon Jun 28 08:41:21 2010 EPIPE during sending of page to web client
Mon Jun 28 08:43:16 2010 **ERROR** NULL host detected
Mon Jun 28 08:45:11 2010 **ERROR** NULL host detected
Mon Jun 28 08:45:35 2010 **ERROR** NULL host detected
Mon Jun 28 08:48:13 2010 **ERROR** NULL host detected
Here, I think I have couple issues with ntop:
1. NULL host detected. What does it mean?
2. mVLAN issue. That means ntop find the same host in different vlans? I
checked my log, I did change the SPAN in switch at that time. I guess that's
why I have this message in the host.
3. EPIPE during sending of page to web client. This means the ntop has
problem to send the traffic to the web client (That's me!) ?
Do I need do something to get rid of "NULL host detected" message? It seems
pop up every second.
Thanks for your input!!
Lou
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
