argus-3.0.0 ArgusWriteOutSocket

[Carter Bullard]

Hey Michael,
Your argus is generating more records than your radium
is reading, (your argus output queue is getting too long)
This is an indication that the remote client is either too
slow, has gone away, or your argus is overloaded and
can't write records out fast enough.  argus  closes the
connection and throws the records away.

You reported that this probe is running above 90%, so I
suspect you need a faster machine for the link you are
monitoring.

Carter



Michael Hornung wrote:

> I'm running the most recent argus code on x86 Linux (Fedora Core 6).  
> I have debug logging set to level 1 and saw this:
>
> argus[17957]: 19 Jun 07 10:01:57.110399 ArgusWriteOutSocket(0x8fbd8bc) 
> max queue exceeded 100001
> argus[17957]: 19 Jun 07 10:01:57.111840 ArgusWriteOutSocket(0x8fbd8bc) 
> max queue exceeded 100001
> argus[17957]: 19 Jun 07 10:04:01.513001 connect from XX.XX.XX.XX
>
> It looks like something happened and the remote radium listener got 
> disconnected and then re-connected a few minutes later.  Is this 
> something to be concerned about?  Can it be fixed by system tuning?  I 
> have never seen this message before.  I would say any loss of captured 
> data is worth concern.  I don't have a pcap from when this occurred.
>
> -Mike
>