Thank you Nick. Your explanation for NULL host makes sense. If someone from ntop can explain it clearly, that would be perfect.
mVLAN log was caused by my SPAN change in switch. It should be ok. EPIPE didn't happen a lot. I hope this is just CPU load problem. I will monitor this later. Lou On Mon, Jun 28, 2010 at 9:33 AM, Nicholas Turner < [email protected]> wrote: > I cannot offer insight to mVLAN, but the other two problems you are having > (NULL host and EPIPE) are also both happening to me. > > The NULL host detection seems to be occuring when NTOP hits it's defined > MAX_HOSTS limit, which is 8192 by default, or can be user set with the -x > flag I believe. It would seem that this error message pops up when NTOP > tries to add a host, cannot allocate memory for it, and as such just leaves > it at NULL. This is fully my opinion, and I would expect that you are under > exactly the same circumstances, however I'm not sure if it is detrimental or > not in either of our cases, I would also like to know if there is a way to > stop this error. > > In terms of the EPIPE, I think it seems to occur if the NTOP server is > under considerable load (like ~50%) and you attempt to access the web > interface or otherwise place the CPU under load while accessing the web > interface. It seems that when CPU is topping out at 100% because of web > access, it reports these errors. This may be posing a problem, because when > the EPIPE occurs (if it is infact because of 100% CPU, then there will be > dropped packets as well). It just means something has failed (epipe is > similar to broken pipe if i remember correctly), when sending the HTTP > request. > > Would still like to know if there is a resolution for the NULL host. > > Nick > > > Quoting Hailu Meng <[email protected]>: > > Hi All, >> >> I have ntop setup recently in ubuntu 10.04 server. After running 3 days, I >> got some logs from ntop: >> >> Mon Jun 28 08:32:57 2010 **ERROR** NULL host detected >> Mon Jun 28 08:33:23 2010 **ERROR** NULL host detected >> Mon Jun 28 08:34:00 2010 **ERROR** NULL host detected >> Mon Jun 28 08:35:21 2010 **ERROR** NULL host detected >> Mon Jun 28 08:36:44 2010 **ERROR** mVLAN: Host (identical IP/MAC) >> found on multiple VLANs >> Mon Jun 28 08:36:44 2010 mVLAN: ntop continues but will consolidate >> and thus probably overcount this traffic >> Mon Jun 28 08:38:54 2010 **ERROR** NULL host detected >> Mon Jun 28 08:40:53 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:40:58 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:41:01 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:41:10 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:41:14 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:41:17 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:41:21 2010 EPIPE during sending of page to web client >> Mon Jun 28 08:43:16 2010 **ERROR** NULL host detected >> Mon Jun 28 08:45:11 2010 **ERROR** NULL host detected >> Mon Jun 28 08:45:35 2010 **ERROR** NULL host detected >> Mon Jun 28 08:48:13 2010 **ERROR** NULL host detected >> >> >> Here, I think I have couple issues with ntop: >> 1. NULL host detected. What does it mean? >> 2. mVLAN issue. That means ntop find the same host in different vlans? I >> checked my log, I did change the SPAN in switch at that time. I guess >> that's >> why I have this message in the host. >> 3. EPIPE during sending of page to web client. This means the ntop has >> problem to send the traffic to the web client (That's me!) ? >> >> Do I need do something to get rid of "NULL host detected" message? It >> seems >> pop up every second. >> >> Thanks for your input!! >> >> Lou >> >> > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop >
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
