Sure, here's the config:
-i zc:eth5 -o /data1/captures -b 3072 -p 1024 -q 1 -S 0 -c 6 -R 8,9,10 -w 7 -z 12 -I -A /data1/index --max-num-files 43000 -P=/var/run/n2disk.pid --event-log /var/log/n2disk.log --index-on-compressor-threads --pcap-compression --remove-ahead --unprivileged-user n2disk --verbose And starting verbose: $ sudo /usr/local/bin/n2disk10g /etc/n2disk/n2disk-eth5.conf 03/Nov/2016 13:26:19 [n2disk.c:4808] Welcome to n2disk10g v.2.6.160917 (r4666) [SandyBridge] 03/Nov/2016 13:26:19 [n2disk.c:4835] Running on 2 node(s) system with 24 core(s). NUMA affinity set to node 1. 03/Nov/2016 13:26:19 [n2disk.c:4864] Using PF_RING for packet capture 03/Nov/2016 13:26:19 [n2disk.c:4890] WARNING: If you are using standard drivers (packet capture via kernel) please disable time-pulse thread 03/Nov/2016 13:26:19 [n2disk.c:4893] Multithread support enabled 03/Nov/2016 13:26:19 [n2disk.c:5007] Dump files max size is set to 1024 MB 03/Nov/2016 13:26:19 [n2disk.c:5024] Buffer memory is set to 3 GB (x 3 pcap files) 03/Nov/2016 13:26:19 [n2disk.c:5059] Using directory /data1/captures for dump files 03/Nov/2016 13:26:19 [n2disk.c:5064] No sub-directories will be created 03/Nov/2016 13:26:19 [n2disk.c:5069] Up to 43000 files will be written before overwriting 03/Nov/2016 13:26:19 [n2disk.c:5079] Dump files max duration is set to 600 sec 03/Nov/2016 13:26:19 [n2disk.c:5095] Dumping data in 0.1 MB chunks 03/Nov/2016 13:26:19 [n2disk.c:5138] Index processing memory is set to 847 MB (x 3 index files) 03/Nov/2016 13:26:22 [n2disk.c:5328] Memory allocated successfully 03/Nov/2016 13:26:22 [n2disk.c:3597] Using time pulse timestamps 03/Nov/2016 13:26:22 [n2disk.c:3630] Started PF_RING packet reader thread for device zc:eth5 $ ________________________________ From: [email protected] <[email protected]> on behalf of Alfredo Cardigliano <[email protected]> Sent: Thursday, November 3, 2016 12:07 PM To: [email protected] Subject: Re: [Ntop-misc] n2disk dumping with RHEL6 Kernel 2.6.32-642.4.2.el6.x86_64 Please provide the n2disk configuration and the output of n2disk running it with -v Thank you Alfredo On 3 Nov 2016, at 17:04, Spransy, Derek <[email protected]<mailto:[email protected]>> wrote: Hi Alfredo, Yes, I made sure all existing modules were removed from the active kernel in /extras/ and /weak-updates/ before re-installing. pfcount works as expected: $ sudo /usr/local/bin/pfcount -i zc:eth5 Using PF_RING v.6.4.1 Capturing from zc:eth5 [mac: 90:E2:BA:11:0C:34][if_index: 13][speed: 10000Mb/s] # Device RX channels: 1 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/57669-eth5.3 ========================= Absolute Stats: [512'824 pkts total][0 pkts dropped][0.0% dropped] [512'824 pkts rcvd][475'093'760 bytes rcvd] ========================= ========================= Absolute Stats: [1'224'990 pkts total][0 pkts dropped][0.0% dropped] [1'224'990 pkts rcvd][1'126'731'269 bytes rcvd][1'224'862.61 pkt/sec][9'012.91 Mbit/sec] ========================= Actual Stats: [712'166 pkts rcvd][1'000.10 ms][712'091.94 pps][5.21 Gbps] ========================= ========================= Absolute Stats: [1'927'685 pkts total][0 pkts dropped][0.0% dropped] [1'927'685 pkts rcvd][1'779'761'096 bytes rcvd][963'757.68 pkt/sec][7'118.41 Mbit/sec] ========================= Actual Stats: [702'695 pkts rcvd][1'000.07 ms][702'644.40 pps][5.22 Gbps] ========================= ========================= Absolute Stats: [2'608'527 pkts total][0 pkts dropped][0.0% dropped] [2'608'527 pkts rcvd][2'406'777'320 bytes rcvd][869'438.57 pkt/sec][6'417.55 Mbit/sec] ========================= Actual Stats: [680'842 pkts rcvd][1'000.06 ms][680'796.38 pps][5.02 Gbps] ========================= ________________________________ From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> on behalf of Alfredo Cardigliano <[email protected]<mailto:[email protected]>> Sent: Thursday, November 3, 2016 11:52 AM To: [email protected]<mailto:[email protected]> Subject: Re: [Ntop-misc] n2disk dumping with RHEL6 Kernel 2.6.32-642.4.2.el6.x86_64 Hi Derek what if you run pfcount -i zc:eth5 ? Just to make sure: did you try manually removing all pf_ring.ko and ixgbe_zc.ko occurrences before reinstalling pf_ring and drivers, to force dkms reinstalling the modules? Alfredo On 3 Nov 2016, at 01:53, Spransy, Derek <[email protected]<mailto:[email protected]>> wrote: Hi Alfredo, As far as I can tell that is the case. I actually removed all pf_ring and n2disk components before I updated them and reinstalled the RPMs from scratch (with no errors reported). lsmod output: pf_ring 691110 2 ixgbe_zc 303005 0 ptp 9614 2 ixgbe_zc,tg3 $ ls -la /lib/modules/2.6.32-642.4.2.el6.x86_64/extra/ total 1900 drwxr-xr-x 2 root root 4096 Nov 2 15:47 . drwxr-xr-x 7 root root 4096 Nov 2 15:48 .. -rw-r--r-- 1 root root 436768 Nov 2 15:42 e1000e_zc.ko -rw-r--r-- 1 root root 519912 Nov 2 15:47 i40e_zc.ko -rw-r--r-- 1 root root 322016 Nov 2 15:41 igb_zc.ko -rw-r--r-- 1 root root 479520 Nov 2 15:45 ixgbe_zc.ko -rw-r--r-- 1 root root 171616 Nov 2 15:43 pf_ring.ko $ cat /proc/net/pf_ring/info PF_RING Version : 6.4.1 (6.4.1-stable:c1fbe364b3cc3f5992f489190ddbb79131109926) Total rings : 0 Standard (non ZC) Options Ring slots : 65534 Slot version : 16 Capture TX : Yes [RX+TX] IP Defragment : No Socket Mode : Standard Total plugins : 0 Cluster Fragment Queue : 0 Cluster Fragment Discard : 0 $ cat /proc/net/pf_ring/dev/eth5/info Name: eth5 Index: 8 Address: 90:E2:BA:11:0C:34 Polling Mode: NAPI/ZC Type: Ethernet Family: Intel ixgbe 82599 Max # TX Queues: 1 # Used RX Queues: 1 Num RX Slots: 32768 Num TX Slots: 32768 Thanks, Derek ________________________________ From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> on behalf of Alfredo Cardigliano <[email protected]<mailto:[email protected]>> Sent: Wednesday, November 2, 2016 6:40 PM To: [email protected]<mailto:[email protected]> Subject: Re: [Ntop-misc] n2disk dumping with RHEL6 Kernel 2.6.32-642.4.2.el6.x86_64 Hi Derek could you double check that all the .ko modules (drivers and pf_ring kernel module) have been reinstalled by DKMS and reloaded? Alternatively, any chance to get ssh access to the machine? Alfredo On 2 Nov 2016, at 21:18, Spransy, Derek <[email protected]<mailto:[email protected]>> wrote: Hello, Today we upgraded our RHEL6 n2disk box to kernel 2.6.32-642.4.2.el6.x86_64 (addresses the dirty cow vulnerability). After the upgrade n2disk is dumping. I went ahead and upgraded n2disk (2.6.161102) and pfring (6.4.1-960) to their latest available stable versions and ran into the same issue. zcount is able to open the zc interface properly. n2disk startup looks like: 02/Nov/2016 16:07:59 [n2disk.c:4809] Welcome to n2disk10g v.2.6.161102 (r4670) [SandyBridge] 02/Nov/2016 16:07:59 [n2disk.c:4836] Running on 2 node(s) system with 24 core(s). NUMA affinity set to node 1. 02/Nov/2016 16:07:59 [n2disk.c:4865] Using PF_RING for packet capture 02/Nov/2016 16:07:59 [n2disk.c:4891] WARNING: If you are using standard drivers (packet capture via kernel) please disable time-pulse thread 02/Nov/2016 16:07:59 [n2disk.c:4894] Multithread support enabled 02/Nov/2016 16:07:59 [n2disk.c:5008] Dump files max size is set to 1024 MB 02/Nov/2016 16:07:59 [n2disk.c:5025] Buffer memory is set to 3 GB (x 3 pcap files) 02/Nov/2016 16:07:59 [n2disk.c:5060] Using directory /data1/captures for dump files 02/Nov/2016 16:07:59 [n2disk.c:5065] No sub-directories will be created 02/Nov/2016 16:07:59 [n2disk.c:5070] Up to 43000 files will be written before overwriting 02/Nov/2016 16:07:59 [n2disk.c:5080] Dump files max duration is set to 600 sec 02/Nov/2016 16:07:59 [n2disk.c:5096] Dumping data in 0.1 MB chunks 02/Nov/2016 16:07:59 [n2disk.c:5139] Index processing memory is set to 847 MB (x 3 index files) 02/Nov/2016 16:08:02 [n2disk.c:5329] Memory allocated successfully 02/Nov/2016 16:08:02 [n2disk.c:3597] Using time pulse timestamps 02/Nov/2016 16:08:02 [n2disk.c:3630] Started PF_RING packet reader thread for device zc:eth5 /var/log/messages then reports: abrt[5405]: Saved core dump of pid 5128 (/usr/local/bin/n2disk10g) to /var/spool/abrt/ccpp-2016- 11-02-16:02:10-5128 (5941956608 bytes) Any ideas? Thanks, Derek ________________________________ This e-mail message (including any attachments) is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this message (including any attachments) is strictly prohibited. If you have received this message in error, please contact the sender by reply e-mail message and destroy all copies of the original message (including attachments). _______________________________________________ Ntop-misc mailing list [email protected]<mailto:[email protected]> http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected]<mailto:[email protected]> http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected]<mailto:[email protected]> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
