Memory Problems in Argus-1.8

Thu Apr 6 09:05:50 EDT 2000

Gentle People,
   I have a fix for Neil's problem, which is an
interesting Solaris problem that I've run into
myself a few times.  The problem happens when
you kill argus, with a client still attached.
Solaris seems to get confused, and acts as if it
doesn't see the socket closing properly.  As a result,
the OS leaves one half of the client socket in a
FIN_WAIT2 state, and you have to wait 60 seconds
(or more) for the Kernel to finally timeout the
TCP connection.  The result is that you can't put
the listen down on the old port number, because
the kernel still thinks its in use.  Bummer.

The fix is not extensive but it does touch a number
of files, both argus and the common client code.
When preparing the diffs, I realize that we've gotten 
to a point where we've got a number of changes from
the argus-1.8 base code.  As a result, I've generated an
argus-1.8.1 distribution, so its easier to track the 
bulk changes from 1.8.1.

The list of changes are:

   Command line Parser bug fixed.
   raconnections() core dump fixed.
   racount() redefined counters to long long.
   Added -E option for the exception output file.
   Fixed hanging TCP connection with Argus -HUP.
   Added '#include <sys/ioctl.h>' declaration
   Fixed policy parsing error.
   Reverted to argus-1.5 TCP Reset processing strategy.
   Fullra() updated.

   Because this is work in progress, I'm thinking
that frequent minor version number releases
are a reasonable approach to source code control, but
if anyone has a better suggestion, I'd love to hear it.
The only OS that I'm testing on is Solaris, and so
if any of you have any problems with anyother OS, please
send mail.

   I've included the argus-1.8 -> argus-1.8.1 diff
file, and I'll work with Mark to get the 1.8.1 tarfile
onto the FTP site.

Comments are more than very welcome.

Carter

> -----Original Message-----
> From: Neil Long [mailto:neil.long at computing-services.oxford.ac.uk]
> Sent: Thursday, April 06, 2000 4:11 AM
> To: Peter Van Epp; argus at lists.andrew.cmu.edu
> Subject: Re: Memory Problems in Argus-1.8
> 
> 
> On Apr 5,  2:26pm, Peter Van Epp wrote:
> > Subject: Re: Memory Problems in Argus-1.8
> > > 
> > > 
> > > On Wed, 5 Apr 2000 09:53:49 -0700 Carter Bullard 
> > > <cbullard at nortelnetworks.com> wrote:
> > > 
> > > > > 
> > > > >     No - it is argus that gets large - usually starts at 
> > > > > about 3M and grows
> > > > > to about 5M after a few days, then I forget about it and next 
> > > > > time I look it
> > > > > is 88M
> > > > > 
> > 
> > 	Although my scripts are HUPing and restarting it every 
> morning and
> > I'm currently at 4.1megs virtual 3.7 megs rss on FreeBSD, I 
> did before christmas
> > accidentally run one for 22 days or so and don't remember a 
> large memory
> > increase. That of course was one of the 1.8 betas not the 
> release version.
> > I'll start one on a test machine and leave it and see what 
> happens. What
> > operating system is the apparant leak being reported on?
> > 
> > Peter Van Epp / Operations and Technical Support 
> > Simon Fraser University, Burnaby, B.C. Canada
> >-- End of excerpt from Peter Van Epp
> 
> Sun Ultra 10, Solaris 7, hme interface.
> 
> It usually starts up at just over 3M and grows to about 5M
> 
>   403 root       1  24    0 5392K 4824K run    37:27  2.73% argus
> 
> started yesterday (05/04) at 16:12 GMT
> 
> I am going to try and log it daily and see if it is gradual or a step
> up - maybe there is a tie in with something else. This may be 
> a Solaris
> issue - Suns are good value here and on-site response is excellent for
> the rare times they go bump in the night.
> 
> The problem I raised with Carter is that when argus is used remotely
> there is a problem with stop/start scripting since the port cannot
> be re-bound until the connection fully times-out. Again this may be 
> a Solaris issue.
> 
> I will look in to changing the scripts to kill remote ra 
> connects first 
> and then argus but my 'web of trust' prevents that at present for any 
> automated task originating on one host - I hate multiple cron jobs.
> 
> Neil
> 
> -- 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  Dr Neil J Long, Computing Services, University of Oxford
>  13 Banbury Road, Oxford, OX2 6NN, UK Tel:+44 1865 273232 
> Fax:+44 1865 273275
>  EMail:       Neil.Long at computing-services.oxford.ac.uk  
>  PGP:    ID 0xE88EF71F    OxCERT: oxcert at ox.ac.uk PGP: ID 0x4B11561D
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20000406/25e4c0c7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: argus-1.8.1.diffs
Type: application/octet-stream
Size: 47021 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20000406/25e4c0c7/attachment.obj>