ArgusWriteOutSocket errors

[Peter Van Epp]

	My first suggestion would be get a bigger hammer :-). Increase CPU 
speed, boost memory, faster disks (7200 RPM UDMA 66 IDEs seem to work well,
remember to install a UIDE capable 80 pin cable so you get the additional
speed). Use multiple disk controllers and spread the I/O load across them.
Consider a multiCPU machine, and/or one of the bigger mother boards with
interleaved memory. You don't say which operating system, but I seem to remember
Linux in which case you may want to try the 2.4 kernel's zero copy bpf code
(which would need a libpcap change to use from what Carter said). I assume 
you have boosted the bpf buffer size already (it sounds like argus is the
piece having trouble not necessarily bpf in this case). Running vmstat and sar
to see where the bottleneck is (CPU, memory, disk etc.) would be a good idea.
Essentially you want to get as much CPU time and memory bandwith for argus 
(by reducing all other use as far as possible) since it is essentially a 
zero sum game on a given config (i.e. if bpf is eating memory bandwith and
CPU that isn't available for argus to process with, which is why the zero
copy mods may help). You may need to move to a largish Solaris machine to get
the necessary horsepower. You can do this most cheaply by identifying what
you are running out of (at this time) and boosting that until something else
gets to be the bottleneck.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada

> 
> Greetings,
> 
>   I'm trying to monitor a line thats pretty constantly pegged at 30mb/s of
> traffic.  Argus seems to be having problems keeping up, as evidenced by these
> messages:
> 
> Nov 14 13:37:17 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 206866 
> Nov 14 13:37:47 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 212568 
> Nov 14 13:38:17 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 218592 
> Nov 14 13:38:47 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 224659 
> Nov 14 13:39:17 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 230371 
> Nov 14 13:39:47 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 236349 
> Nov 14 13:40:17 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 242248 
> Nov 14 13:40:47 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 248163 
> Nov 14 13:41:17 dcfe-fw argus[15222]: ArgusWriteOutSocket(0x153000) Queue Count
> 254152 
> Nov 14 13:41:19 dcfe-fw argus[15222]: ArgusWriteSocket(0x153000, 0x142020, 164)
> ArgusCalloc returned error Cannot allocate memory 
> 
> My question is, is there any strategy for tuning argus to handle these high
> bandwidth connections?  Is the only alternative to run ra in a loop so that it
> immediately reconnects?  Any ideas?  Thanks!
> 
> 
>