Try changing from high level detail to medium. Also, don't dump domains - at least for a test.
What about some of the configure switches? Maybe they freaked something out? Maybe retry autogen and make with defaults? Gary -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of adi Sent: Friday, November 09, 2007 4:08 AM To: [email protected] Subject: Re: [Ntop] problem: ntop is creating RRD files on disk forall hostseven if told not to do it not sure what dump flows is...but i tried with it disabled and still rrd was filling the disk.. I tried again this morning (while dump flows was still enabled), from 8:30 AM to 10 AM, rrd has created 5 gigabytes of files on the disk. Then i disabled dumpFlows, shutdown ntop, deleted everything in the rrd database folder (i zapped everything, just to be sure), and started it again. In under 10 minutes ntop had created ~500 megabytes of rrd files, for practically any host that it saw, ignoring the hosts filter: Nov 9 10:56:47 oberon ntop[4064]: RRD: Welcome to the RRD plugin Nov 9 10:56:47 oberon ntop[4064]: RRD: Mask for new directories is 0700 Nov 9 10:56:47 oberon ntop[4064]: RRD: Mask for new files is 0066 Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: Parameters: Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpInterval 300 seconds Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpShortInterval 10 seconds Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpHours 72 hours by 300 seconds Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDays 90 days by hour Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpMonths 36 months by day Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDomains no Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpFlows no Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpSubnets no Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpHosts yes Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpInterfaces yes Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpASs no Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpMatrix no Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: dumpDetail high Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: hostsFilter 192.168.0.0/255.255.0.0 Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: rrdPath /var/ntop/ntop_data/rrd [normal] Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: rrdPath /var/ntop/ntop_data/rrd [dynamic/volatile] Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: umask 0066 Nov 9 10:56:47 oberon ntop[4064]: RRD_DEBUG: DirPerms 0700 Gary Gatten wrote: > What's the dump flows? Is that supposed to be enabled? > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > adi > Sent: Thursday, November 08, 2007 1:11 AM > To: [email protected] > Subject: Re: [Ntop] problem: ntop is creating RRD files on disk for all > hostseven if told not to do it > > oh, and another thing, now even though the rrd plugin is disabled ntop > tries to use it even so. > I decided to stop using it for now, since it fills the logs with: > > at ntop startup: > Nov 8 09:03:21 oberon ntop[3655]: RRD: Welcome to Round-Robin > Databases. (C) 2002-07 by Luca Deri. > Nov 8 09:03:48 oberon ntop[3655]: RRD: Mask for new directories is > 0700 > Nov 8 09:03:48 oberon ntop[3655]: RRD: Mask for new files is 0066 > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: Parameters: > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpInterval 300 > seconds > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpShortInterval 10 > > seconds > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpHours 72 hours > by 300 seconds > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDays 90 days by > hour > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpMonths 36 months > > by day > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDomains no > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpFlows yes > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpSubnets no > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpHosts yes > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpInterfaces yes > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpASs no > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpMatrix no > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: dumpDetail high > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: hostsFilter > 192.168.0.0/255.255.0.0 > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: rrdPath > /var/ntop/ntop_data/rrd [normal] > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: rrdPath > /var/ntop/ntop_data/rrd [dynamic/volatile] > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: umask 0066 > Nov 8 09:03:48 oberon ntop[3655]: RRD_DEBUG: DirPerms 0700 > > YES, even if it is marked as not active, it still tries to configure it. > > And then later on in the log.... > > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called > 'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820 > @rrdPlugin.c:2414] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called > with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called > 'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820 > @rrdPlugin.c:2414] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called > with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called > 'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820 > @rrdPlugin.c:2414] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called > with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called > 'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820 > @rrdPlugin.c:2414] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** releaseMutex() called > with an UN-INITIALIZED mutex [t3025259408 m0x83b820 @rrdPlugin.c:2458] > Nov 8 09:05:02 oberon ntop[3655]: **ERROR** accessMutex() called > 'rrd_graph' with an UN-INITIALIZED mutex [t3025259408 m0x83b820 > @rrdPlugin.c:2414] > and so on.... ad nauseam > > adi wrote: > >> Hello list and Luca, >> I posted this message a few days ago on the ntop-dev list, but i >> haven't received any replies yet... is anyone still using that list? >> Anyway.... here it is copy&pasted again (and all times i mention there >> > > >> are relative to november 6th). >> In the meantime i have disabled the rrd plugin, it was getting >> annoying to clean its mess daily. >> >> >> ----- >> >> Starting since the svn releases of a week or two ago (can't determine >> exactly since what svn revision update), ntop is ignoring my hosts >> filter for rrd and has started to create rrd files for all hosts that >> it sees. >> >> I have defined the rrd hosts filter to only create rrd files for >> 192.168.0.0/255.255.0.0 but i see that ntop is creating rrd files for >> any host, ignoring this setting. >> >> Is there a recent change that i've missed? How can i tell it not to >> create any rrd files at all except for the hosts mentioned? >> >> Yesterday i was alerted by logwatch which found that i had an almost >> full /var partition, and i tracked it down to ntop, its rrd files >> alone were eating up about 30 gigabytes. I trimmed them manually to >> only have 192.168.x.x in that list, and i also kept the ones for the >> local ethernet mac addresses. This way it got down to ~80 megabytes, >> for only the hosts i need. Down from 30GBytes that's quite a change. >> >> This morning i found the rrd files have gained weight again, the rrd >> databases had already swollen up to 1,8 GBytes, and since this morning >> > > >> they shot up to3.2GBytes, that's almost another 1,5 gigabyte in less >> than three hours! >> >> Ntop is otherwise working fine, no lockups or anything, except for the >> > > >> rrd thing. What is going on with the rrd storage? >> >> >> >> # ./ntop --version >> Tue Nov 6 09:24:33 2007 NOTE: Interface merge enabled by default >> Tue Nov 6 09:24:33 2007 Initializing gdbm databases >> Welcome to ntop v.3.3.4 >> [Configured on Nov 5 2007 13:57:31, built on Nov 5 2007 15:52:24] >> >> This is the latest one from SVN, revision 3346. >> O.S. is fedora 7 with latest updates applied, kernel is >> > 2.6.23.1-21.fc7 > >> i configured ntop as (and yes i know some options are obsolete or >> redundant, but if autogen/configure don't complain about them i keep >> them around. ) >> ./autogen.sh --prefix=/var/ntop --enable-dependency-tracking >> --with-pic --without-ssl --disable-ssl --disable-sslv3 >> --enable-largerrdpop --enable-jumbo-frames --with-rrd-home=/usr >> >> and ntop is started as: >> #!/bin/sh >> /var/ntop/bin/ntop -n -e 512 -d -4 -M -m 192.168.0.0/24 -i eth1 -u >> ntop -w 192.168.0.15:1083 -Q /var/ntop/ntop_data -P >> /var/ntop/ntop_data -O /var/ntop/ntop_data/logs -a >> /var/ntop/ntop_data/logs/access.log >> >> /var/ntop/ntop_data/logs/logfile.log >> >> >> Adi >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> >> >> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
