On Sun, Mar 25, 2012 at 5:02 AM, Paolo Lucente <[email protected]> wrote:
> Hi,
>
> It would be intersting to know more about the "on occasion" part - ie.
> can you establish any patterns? Also, is it precisely 18 times more or
> approx or it was an average? Are you using sampled NetFlow (and if yes
> which version)? I don't see any reference to sampling in the partial
> config file you posted. To start with i would recommend to add to the
> aggregation method the peer_src_ip primitive: it would tell if there
> is a specific router contributing to the traffic skew or it is more of
> a generic (?) issue. Let me know.
>
No patterns relating to the traffic however there is a pattern with errors
in the logs. The spike is approximately 16-18x more. Un-sampled V5
netflow is used and only one exporter is involved.
When a spike occurs there is a message about missing data with a suggestion
to increase the shared memory, buffer size, and/or socket size. When the
process starts the two plugins in_asn and out_asn report only obtaining
2048 / 8000. If the other two plugins are removed there is no message
about an undersized pipe. How can I increase this value when using all
four plugins simultaneously ? Adjusting the pipe_size and buffer_size in
the config have no effect so it seems to be an OS limitation.
On start
nfacctd[1532]: INFO ( link1_in/pgsql ): Pipe size obtained: 8000 / 8000.
nfacctd[1532]: INFO ( link1_out/pgsql ): Pipe size obtained: 8000 / 8000.
nfacctd[1532]: INFO ( link1_asn_in/pgsql ): Pipe size obtained: 2048 / 8000.
nfacctd[1532]: INFO ( link1_asn_out/pgsql ): Pipe size obtained: 2048 /
8000.
On start with debug flag
nfacctd[1624]: INFO ( link1_in/pgsql ): 65535 bytes are available to
address shared memory segment; buffer size is 216 bytes.
nfacctd[1624]: INFO ( link1_in/pgsql ): Trying to allocate a shared memory
segment of 1769256 bytes.
nfacctd[1624]: INFO ( link1_out/pgsql ): 65535 bytes are available to
address shared memory segment; buffer size is 932 bytes.
nfacctd[1624]: INFO ( link1_out/pgsql ): Trying to allocate a shared memory
segment of 7634012 bytes.
nfacctd[1624]: INFO ( link1_asn_in/pgsql ): 65535 bytes are available to
address shared memory segment; buffer size is 216 bytes.
nfacctd[1624]: INFO ( link1_asn_in/pgsql ): Trying to allocate a shared
memory segment of 1769256 bytes.
nfacctd[1624]: INFO ( link1_asn_out/pgsql ): 65535 bytes are available to
address shared memory segment; buffer size is 932 bytes.
nfacctd[1624]: INFO ( link1_asn_out/pgsql ): Trying to allocate a shared
memory segment of 7634012 bytes.
The system is FreeBSD with the following settings:
kern.ipc.maxsockbuf: 16777216
ipcs -T
msginfo:
msgmax: 16384 (max characters in a message)
msgmni: 40 (# of message queues)
msgmnb: 2048 (max characters in a message queue)
msgtql: 40 (max # of messages in system)
msgssz: 8 (size of a message segment)
msgseg: 2048 (# of message segments in system)
shminfo:
shmmax: 1048576000 (max shared memory segment size)
shmmin: 1 (min shared memory segment size)
shmmni: 192 (max number of shared memory identifiers)
shmseg: 128 (max shared memory segments per process)
shmall: 1048576 (max amount of shared memory in pages)
seminfo:
semmap: 1024 (# of entries in semaphore map)
semmni: 10 (# of semaphore identifiers)
semmns: 60 (# of semaphores in system)
semmnu: 30 (# of undo structures in system)
semmsl: 60 (max # of semaphores per id)
semopm: 100 (max # of operations per semop call)
semume: 10 (max # of undo entries per process)
semusz: 152 (size in bytes of undo structure)
semvmx: 32767 (semaphore maximum value)
semaem: 16384 (adjust on exit max value)
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
