[ARGUS] argus 2.0.5 and 2.0.6 ArgusCalloc problems on OpenBSD 3.5

[Carter Bullard]

Hey Richard,
   This is a new one for me, although it may be related
to an earlier reported problem with ra* programs and
FreeBSD, which I've included below.

Carter

On Fri, 2004-04-30 at 01:32:23 -0500, eric proclaimed...

> Ah yes, more fun problems.
>
> During a large spike in traffic, we noticed that rasort dies off
> around 500MB being loaded into memory.
>
> $ ls -l argus.2004.04.30.01.10.00.tmp
> -rw-r-----  1 me flows  329519468 Apr 30 01:10
argus.2004.04.30.01.10.00.tmp
>
> Turns up with...
>
> rasort[99756]: RaCopyArgusRecord(0xbfbfe990) ArgusCalloc(1, 148) error
Cannot
> allocate memory
>

Ha! I solved my own problem.

After looking through the LINT kernel config, I found that I could
increase the hard limits of segment and stack sizes.

options MAXDSIZ="(1380*1024*1024)"      #added for rasort! 20040430
options DFLDSIZ="(1380*1024*1024)"      #added for rasort! 20040430
options MAXSSIZ="(1024*1024*1024)"      #added for rasort! 20040430

1024*1024*1024 == ~1GB

After this, rasort works just fine! Take a look...

  PID USERNAME PRI NICE  SIZE    RES STATE    TIME   WCPU    CPU COMMAND
42869 eric      52   2   634M   634M RUN      0:45 98.09% 88.28% rasort

Wow, thats a lot of memory. :)

Also, doing a ulimit -a shows this.....

data seg size           (kbytes, -d)  1413120
stack size              (kbytes, -s)  1048576

So I appear to be in good shape.

Hopefully if anyone is using FreeBSD and they run into this problem,
they can give it a try.

- Eric


-----Original Message-----
From: owner-argus-info at lists.andrew.cmu.edu
[mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of Richard Johnson
Sent: Monday, May 10, 2004 2:19 AM
To: argus-info at lists.andrew.cmu.edu
Subject: [ARGUS] argus 2.0.5 and 2.0.6 ArgusCalloc problems on OpenBSD 3.5

After a few months of solid interruption-ville, I've finally been able to
make time to do a test install of argus.

I've discovered that on OpenBSD 3.5 (i386), argus 2.0.5 and 2.0.6 both quit
within a minute of launch, logging only the following:

	ArgusNewFlow() ArgusCalloc error Cannot allocate memory.

In each case, argus was built with just plain old optionless ./configure &&
make.  The config file I'm trying is below.

Any quick suggestions on a fix, or am I going to have to make time for
debugging ArgusModeler?


Richard

-------
ARGUS_DAEMON=yes
ARGUS_MAX_INSTANCES=1
ARGUS_SET_PID=yes
ARGUS_PID_FILENAME=/var/run/argus.pid
ARGUS_MONITOR_ID=`hostname`
ARGUS_ACCESS_PORT=561
ARGUS_BIND_IP="172.30.30.83"
ARGUS_INTERFACE=sk0
ARGUS_GO_PROMISCUOUS=yes
ARGUS_FLOW_STATUS_INTERVAL=60
ARGUS_MAR_STATUS_INTERVAL=300
ARGUS_GENERATE_RESPONSE_TIME_DATA=no
ARGUS_GENERATE_JITTER_DATA=no
ARGUS_GENERATE_MAC_DATA=no
ARGUS_CAPTURE_DATA_LEN=0
ARGUS_FILTER_OPTIMIZER=yes
ARGUS_FILTER=""