Your system looks like it has plenty of power. The dnsCache.db file has given me problems in the past. Once it starts getting "big" nTop seems to die more and more frequently.
What is your CPU load averages and % util when it's up? Do you have rrd enabled? What is the size of your RCV queue for the netflow udp port when you run 'netstat -a'? Some other things to try: -t 5 = most verbose logging -x and -X: I've doubled the defaults Check out the globaldefines.h TONS of tweaks in there, several that could fix your name resolution failures mentioned below. Not sure why these tweaks aren't available in a runtime config file? That would be nice! Tweaking the defaults all depends on how many hosts your monitoring and how chatty they are. I have 3,000'ish local + internet hosts, so defaults didn't work to well for me. Gary -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of James Sent: Wednesday, October 24, 2007 10:24 AM To: [email protected] Subject: [Ntop] NTOP process dies randomly on debian Hi everybody i have NTOP running with netflow from a cisco 6500 series and for some reason every few hours NTOP dies. I've tried looking at the logs for anything that might have to do anything with it but i don't see anything in syslog or daemon or anything really. It seems the process dies quietly. I set the debug -K on and it still doesn't seems to give anything in the logs. The same thing was happening yesterday and the last few days. It just dies randomly, sometimes it lasts only 20 minutes sometimes it stays alive for a couple hours. I don't have any processes that are running in promiscuous mode on that system either. System is Debian Etch NTOP Version 3.2-8 2 gigs of ram xeon 2.8ghz any help would be appreciated Thanks, James The only entries i see are the following: Oct 23 17:16:11 server ntop[6003]: Addresses in excess won't be resolved - ntop continues Oct 23 22:45:03 server ntop[6003]: **ERROR** Queue of address '???' failed, code -1 [addr queue=4050/max=4097] Oct 23 22:45:03 server ntop[6003]: ntop processing continues, address will not be resolved Oct 24 01:00:18 server ntop[6003]: **ERROR** Queue of address '???' failed, code -1 [addr queue=4053/max=4097] Oct 24 01:00:18 server ntop[6003]: ntop processing continues, address will not be resolved Oct 24 02:41:43 server ntop[6003]: **ERROR** Queue of address '???' failed, code -1 [addr queue=4069/max=4097] Oct 24 02:41:43 server ntop[6003]: ntop processing continues, address will not be resolved Oct 24 02:58:37 server ntop[6003]: **ERROR** Queue of address '???' failed, code -1 [addr queue=4067/max=4097] Oct 24 02:58:37 server ntop[6003]: ntop processing continues, address will not be resolved _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
