bug + "Queue Exceeded Maximum Limit"

[William Setzer]

I currently have argus 2.0.5 (run on Solaris 2.6) hooked to a firehose
(a very busy 1G link), and lately have been getting this happening
almost constantly:

  Dec  3 06:29:05 argus: ArgusWriteOutSocket(0x154960) Queue Count 232797
  Dec  3 06:29:36 argus: ArgusWriteOutSocket(0x154960) Queue Count 236682
  Dec  3 06:30:09 argus: ArgusWriteOutSocket(0x154960) Queue Count 244167
  Dec  3 06:30:47 argus: ArgusWriteOutSocket(0x154960) Queue Count 245161
  Dec  3 06:31:18 argus: ArgusWriteOutSocket(0x154960) Queue Count 254993
  Dec  3 06:31:20 argus: ArgusWriteOutSocket(0x154960) Queue Exceeded Maximum Limit
  Dec  3 06:31:20 argus: ArgusHandleData: ArgusWriteOutSocket failed Bad file number
  Dec  3 06:31:20 argus: ArgusHandleData: Terminating process 3673

The queue seems to overflow about once an hour.  I've tried adjusting
the MAR timeout and increased the ARGUS_MAXWRITENUM constant in
ArgusUtil.c, but those only seem to stretch the problem out a bit.
Does anyone have any other ideas on how to flush the queue out more
often?  I'm afraid I don't understand the internals of argus to know
when and how often ArgusWriteOutSocket gets called.

(The bug is that the ArgusHandleData error about a Bad file number is
incorrect.  The section of code in ArgusWriteOutSocket that printed
out Queue Exceeded Maximum Limit returns -1, which causes
ArgusHandleData to print out an error based on 'errno', when it wasn't
a system call that caused the error.)

Thanks in advance for any advice.


William