Hello,
there is one cronjob (mrtg), starting every 15 minutes , no specific in
the login scripts.
Additional software installed : Nagios / Nagvis
Is it a good idea to reinstall ntop ?
Regards
Rolf
________________________________
Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im
Auftrag von Gary Gatten
Gesendet: Donnerstag, 17. April 2008 20:09
An: [email protected]
Betreff: Re: [Ntop] NTOP : Hangs after some days
I misspoke - I do understand that it spawns multiple instances
on its own. I just thought it was odd that it could do this as I
assumed any instance using the same directory and files would encounter
similar file sharing issues I experienced when accidentally starting
ntop when an instance with the same runtime parms was already active.
The dnsCache.db issue usually causes ntop to die - on my system
it was causing segfaults. I'm not sure if this will have any impact on
your issue where ntop seems to replicate itself. That's just really
weird behavior. Are you sure there's nothing in cron, login scipts,
etc. that could be starting these?
G
________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Wiebel, Rolf
Sent: Thursday, April 17, 2008 11:37 AM
To: [email protected]
Subject: AW: [Ntop] NTOP : Hangs after some days
Hello,
maybe there is a misunderstanding . I start it only once. Not
serveral times. This is done automaticaly during the next days.
If I start ntop from command line with
/usr/bin/ntop -t 5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u
wwwrun -w 205.191.7.249:3000
several times, it starts only once
ps -ef | grep ntop
wwwrun 9049 1 4 18:14 ? 00:00:29 /usr/bin/ntop -t
5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
root 10971 8136 0 18:25 pts/0 00:00:00 grep ntop
I've setup 5 systems with Suse 9.3 / Ntop 3.2 and 2 System with
Suse 10.2 / Ntop3.3. Only one NTOP 3.3 system has this problem.
I've now followed the hint to delete the dnsCache.db ( size was
only 4 MB ) and restart NTOP.
Keep you informed if this helps
Regards
Rolf
Here is the output with setting the flags
/usr/bin/ntop -t 5 -K -P /var/lib/ntop -i eth0,eth1,eth2 -u
wwwrun -w 205.191.7.249:3000
Thu Apr 17 18:14:53 2008 NOTE: Interface merge enabled by
default
Thu Apr 17 18:14:53 2008 Initializing gdbm databases
Thu Apr 17 18:14:53 2008 Opening database
'/var/lib/ntop/prefsCache.db'
Thu Apr 17 18:14:53 2008 Opening database
'/var/lib/ntop/ntop_pw.db'
Thu Apr 17 18:14:53 2008 NOTE: Reading preferences file entries
Thu Apr 17 18:14:53 2008 NOTE: Processing parameters (pass2)
Thu Apr 17 18:14:53 2008 ntop v.3.3
Thu Apr 17 18:14:53 2008 Configured on Sep 22 2007 3:29:05,
built on Sep 22 2007 03:29:23.
Thu Apr 17 18:14:53 2008 Copyright 1998-2007 by Luca Deri
<[EMAIL PROTECTED]>
Thu Apr 17 18:14:53 2008 Get the freshest ntop from
http://www.ntop.org/
Thu Apr 17 18:14:53 2008 NOTE: ntop is running from '/usr/bin'
Thu Apr 17 18:14:53 2008 NOTE: (but see warning on man page for
the --instance parameter)
Thu Apr 17 18:14:53 2008 NOTE: ntop libraries are in '/usr/lib'
Thu Apr 17 18:14:53 2008 Initializing ntop
Thu Apr 17 18:14:53 2008 Initializing IP services
Thu Apr 17 18:14:53 2008 Initializing network devices
Thu Apr 17 18:14:54 2008 Found interface [index=0] 'eth0'
Thu Apr 17 18:14:54 2008 Found interface [index=1] 'eth1'
Thu Apr 17 18:14:54 2008 Found interface [index=2] 'eth2'
Thu Apr 17 18:14:54 2008 Found interface [index=3] 'any'
Thu Apr 17 18:14:54 2008 Found interface [index=4] 'lo'
Thu Apr 17 18:14:54 2008 Checking requested device 'eth0'
Thu Apr 17 18:14:54 2008 Adding network device eth0
Thu Apr 17 18:14:54 2008 Interface 'eth0' (netmask
255.255.255.0) computed network size is 606 hosts
Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no
TrafficEntry) for interface 'eth0' is 1.45MB
Thu Apr 17 18:14:54 2008 Checking eth0 for additional devices
Thu Apr 17 18:14:54 2008 Checking eth0:0
Thu Apr 17 18:14:54 2008 Checking eth0:1
Thu Apr 17 18:14:54 2008 Checking eth0:2
Thu Apr 17 18:14:54 2008 Checking eth0:3
Thu Apr 17 18:14:54 2008 Checking eth0:4
Thu Apr 17 18:14:54 2008 Checking eth0:5
Thu Apr 17 18:14:54 2008 Checking eth0:6
Thu Apr 17 18:14:54 2008 Checking eth0:7
Thu Apr 17 18:14:54 2008 Resetting traffic statistics for
device eth0
Thu Apr 17 18:14:54 2008 Initializing device eth0 (0)
Thu Apr 17 18:14:54 2008 DLT: Device 0 [eth0] is 1, mtu 1514,
header 14
Thu Apr 17 18:14:54 2008 Checking requested device 'eth1'
Thu Apr 17 18:14:54 2008 Adding network device eth1
Thu Apr 17 18:14:54 2008 Interface 'eth1' (netmask
255.255.255.0) computed network size is 606 hosts
Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no
TrafficEntry) for interface 'eth1' is 1.45MB
Thu Apr 17 18:14:54 2008 Checking eth1 for additional devices
Thu Apr 17 18:14:54 2008 Checking eth1:0
Thu Apr 17 18:14:54 2008 Checking eth1:1
Thu Apr 17 18:14:54 2008 Checking eth1:2
Thu Apr 17 18:14:54 2008 Checking eth1:3
Thu Apr 17 18:14:54 2008 Checking eth1:4
Thu Apr 17 18:14:54 2008 Checking eth1:5
Thu Apr 17 18:14:54 2008 Checking eth1:6
Thu Apr 17 18:14:54 2008 Checking eth1:7
Thu Apr 17 18:14:54 2008 Resetting traffic statistics for
device eth1
Thu Apr 17 18:14:54 2008 Initializing device eth1 (1)
Thu Apr 17 18:14:54 2008 DLT: Device 1 [eth1] is 1, mtu 1514,
header 14
Thu Apr 17 18:14:54 2008 Checking requested device 'eth2'
Thu Apr 17 18:14:54 2008 Adding network device eth2
Thu Apr 17 18:14:54 2008 Interface 'eth2' (netmask
255.255.255.0) computed network size is 606 hosts
Thu Apr 17 18:14:54 2008 MEMORY: ipTrafficMatrix base (no
TrafficEntry) for interface 'eth2' is 1.45MB
Thu Apr 17 18:14:54 2008 Checking eth2 for additional devices
Thu Apr 17 18:14:54 2008 Checking eth2:0
Thu Apr 17 18:14:54 2008 Checking eth2:1
Thu Apr 17 18:14:54 2008 Checking eth2:2
Thu Apr 17 18:14:54 2008 Checking eth2:3
Thu Apr 17 18:14:54 2008 Checking eth2:4
Thu Apr 17 18:14:54 2008 Checking eth2:5
Thu Apr 17 18:14:54 2008 Checking eth2:6
Thu Apr 17 18:14:54 2008 Checking eth2:7
Thu Apr 17 18:14:54 2008 Resetting traffic statistics for
device eth2
Thu Apr 17 18:14:54 2008 Initializing device eth2 (2)
Thu Apr 17 18:14:54 2008 DLT: Device 2 [eth2] is 1, mtu 1514,
header 14
Thu Apr 17 18:14:54 2008 Initializing gdbm databases
Thu Apr 17 18:14:54 2008 Creating database
'/var/lib/ntop/addressQueue.db'
Thu Apr 17 18:14:54 2008 Opening database
'/var/lib/ntop/dnsCache.db'
Thu Apr 17 18:14:54 2008 Opening database
'/var/lib/ntop/macPrefix.db'
Thu Apr 17 18:14:54 2008 Opening database
'/var/lib/ntop/fingerprint.db'
Thu Apr 17 18:14:54 2008 VENDOR: Loading MAC address table.
Thu Apr 17 18:14:54 2008 VENDOR: Checking for MAC address table
file
Thu Apr 17 18:14:54 2008 VENDOR: Checking './specialMAC.txt.gz'
Thu Apr 17 18:14:54 2008 VENDOR: Checking './specialMAC.txt'
Thu Apr 17 18:14:54 2008 VENDOR: Checking
'/etc/ntop/specialMAC.txt.gz'
Thu Apr 17 18:14:54 2008 VENDOR: ...Found
Thu Apr 17 18:14:54 2008 VENDOR: Database created/last modified
Thu Apr 17 18:06:56 2008
Thu Apr 17 18:14:54 2008 VENDOR: Input file created/last
modified Tue Feb 26 14:27:20 2008
Thu Apr 17 18:14:54 2008 VENDOR: File
'/etc/ntop/specialMAC.txt.gz' does not need to be reloaded
Thu Apr 17 18:14:54 2008 VENDOR: ntop continues ok
Thu Apr 17 18:14:54 2008 VENDOR: Checking for MAC address table
file
Thu Apr 17 18:14:54 2008 VENDOR: Checking './oui.txt.gz'
Thu Apr 17 18:14:54 2008 VENDOR: Checking './oui.txt'
Thu Apr 17 18:14:54 2008 VENDOR: Checking
'/etc/ntop/oui.txt.gz'
Thu Apr 17 18:14:54 2008 VENDOR: ...Found
Thu Apr 17 18:14:54 2008 VENDOR: Database created/last modified
Thu Apr 17 18:06:56 2008
Thu Apr 17 18:14:54 2008 VENDOR: Input file created/last
modified Tue Feb 26 14:27:20 2008
Thu Apr 17 18:14:54 2008 VENDOR: File '/etc/ntop/oui.txt.gz'
does not need to be reloaded
Thu Apr 17 18:14:54 2008 VENDOR: ntop continues ok
Thu Apr 17 18:14:54 2008 Fingerprint: Loading signature file
Thu Apr 17 18:14:54 2008 Fingerprint: Checking for Fingerprint
file... file
Thu Apr 17 18:14:54 2008 Fingerprint: Checking
'./etter.finger.os.gz'
Thu Apr 17 18:14:54 2008 Fingerprint: Checking
'./etter.finger.os'
Thu Apr 17 18:14:54 2008 Fingerprint: Checking
'/etc/ntop/etter.finger.os.gz'
Thu Apr 17 18:14:54 2008 Fingerprint: ...Found
Thu Apr 17 18:14:54 2008 Fingerprint: Loading file
'/etc/ntop/etter.finger.os.gz'
Thu Apr 17 18:14:54 2008 Fingerprint: ...loaded 1765 records
Thu Apr 17 18:14:54 2008 INIT: Parent process is exiting (this
is normal)
Thu Apr 17 18:14:54 2008 INIT: Bye bye: I'm becoming a
daemon...
________________________________
Von: [EMAIL PROTECTED] im Auftrag von Gary Gatten
Gesendet: Do 17.04.2008 18:10
An: [email protected]
Betreff: Re: [Ntop] NTOP : Hangs after some days
I have not seen this before. If I try to start mine more than
once I
get errors relating to file reads/locks and it aborts. I'm not
even
sure where to start on this. Does it always try to start more
than one
instance or just after a reboot? Maybe try the -t 5 and -K
flags and
see if there's more detailed messages?
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of
Wiebel, Rolf
Sent: Thursday, April 17, 2008 8:42 AM
To: [email protected]
Subject: [Ntop] NTOP : Hangs after some days
Hello,
I've a problem that NTOP hangs after a while
NTOP is running , but several times
ps -ef | grep ntop
wwwrun 5909 1 51 Mar25 ? 12-00:22:33 /usr/bin/ntop
-P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
wwwrun 4043 5909 0 Mar26 ? 00:00:00 /usr/bin/ntop -P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
wwwrun 28053 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
wwwrun 8190 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
wwwrun 13164 5909 0 Mar28 ? 00:00:00 /usr/bin/ntop -P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
wwwrun 24066 5909 0 Apr01 ? 00:00:00 /usr/bin/ntop -P
/var/lib/ntop -i eth0,eth1,eth2 -u wwwrun -w 205.191.7.249:3000
Any idea why it start several times ?
Then on 4.4. it stops getting data.
If I stop and start ntop all is working fine.
Regards
Rolf
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
<font size="1">
<div style='border:none;border-bottom:double windowtext
2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended
recipient
and may contain information that is privileged and/or
confidential.
If you are not the intended recipient, you are hereby notified
that
any review, use, dissemination, disclosure or copying of this
email
and its attachments, if any, is strictly prohibited. If you
have
received this email in error, please immediately notify the
sender by
return email and delete this email from your system."
</font>
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
"This email is intended to be reviewed by only the intended
recipient and may contain information that is privileged and/or
confidential. If you are not the intended recipient, you are hereby
notified that any review, use, dissemination, disclosure or copying of
this email and its attachments, if any, is strictly prohibited. If you
have received this email in error, please immediately notify the sender
by return email and delete this email from your system."
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
