new version of argus-2.0.0l
Peter Van Epp
vanepp at sfu.ca
Mon Oct 2 19:44:44 EDT 2000
While the new 2.0.0l works fine on Solaris at 1 meg, at 100 megs it
hangs pretty consistantly when HUPed (I only got one successful HUP in about
10 tries, and that one worse luck, had a previous no data HUP in the argus log
so the size is a little big, but ra appears to have captured all the packets
successfully at 100 (or more correctly 95 or 96 megabits per second, however
fast tcpreplay could get the data there).
There looks to be a loop in the first task on the HUP note the CPU time
climbing:
skaha# !312
bin/argus_dlpi -i qfe0 -w argus.log &
[1] 5649
skaha# kill -HUP 5649
skaha#
skaha# !ps
ps -ef | grep argus
root 5650 5649 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5651 5650 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5653 534 0 16:34:41 pts/1 0:00 grep argus
root 5649 534 29 16:34:08 pts/1 0:18 bin/argus_dlpi -i qfe0 -w argus.log
skaha# !!
ps -ef | grep argus
root 5655 534 0 16:34:48 pts/1 0:00 grep argus
root 5650 5649 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5651 5650 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5649 534 35 16:34:08 pts/1 0:24 bin/argus_dlpi -i qfe0 -w argus.log
a while later:
skaha# !ps
ps -ef | grep argus
root 5650 5649 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5651 5650 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5657 534 0 16:40:04 pts/1 0:00 grep argus
root 5649 534 50 16:34:08 pts/1 5:40 bin/argus_dlpi -i qfe0 -w argus.log
Then a HUP again:
skaha# !333
kill -HUP 5649
skaha#
[1] Hangup bin/argus_dlpi -i qfe0 -w argus.log
skaha# !ps
ps -ef | grep argus
root 5650 1 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5651 5650 0 16:34:08 pts/1 0:00 bin/argus_dlpi -i qfe0 -w argus.log
root 5659 534 0 16:40:35 pts/1 0:00 grep argus
skaha#
Now I have to kill -9 the last two tasks and the argus.log file isn't
complete. If you have suggestions on what we can do to debug this it looks
easily reproducable :-)
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
>
> Thanks to Peter finding a major gotcha in the Solaris
> port, there is now a new copy of argus at
> ftp://qosient.com/dev/argus/argus-2.0
>
<snip>
More information about the argus
mailing list