new code uploaded - argus cygwin support
Peter Van Epp
vanepp at sfu.ca
Wed Sep 12 22:37:13 EDT 2007
We do seem to be getting closer. The last argus version seems to have
run fine for a long time (a few queue warnings) in a reasonable amount of
memory across times when our link has been busier than it ever has before :-):
hcids:/usr/local/src/argus/argus-3.0.0 # !ps
ps auxwwww | grep argus
root 1084 9.4 9.8 390112 386616 ? RL Sep09 459:02 argus -J -P 560 -i eth0 -i eth1 -U 512 -m -F /scratch/argus.conf
root 12831 0.0 0.0 3132 832 pts/1 S+ 19:27 0:00 grep argus
hcids:/usr/local/src/argus/argus-3.0.0 # kill -HUP 1084
hcids:/usr/local/src/argus/argus-3.0.0 # !ps
ps auxwwww | grep argus
root 12833 0.0 0.0 3132 832 pts/1 S+ 19:27 0:00 grep argus
hcids:/usr/local/src/argus/argus-3.0.0 # cp bin/argus /usr/local/bin
hcids:/usr/local/src/argus/argus-3.0.0 # cd /scratch
hcids:/scratch # ls
argus.conf argus.conf.pcap debug.log rotate.log sequence
argus.conf.nopcap current.html malloc.pl rotate.pl
hcids:/scratch # tail -100 debug.log
ArgusWarning: argus[1084]: 09 Sep 07 10:23:09.278849 started
ArgusWarning: argus[1084]: 09 Sep 07 10:23:09.279047 ArgusGetInterfaceStatus: interface eth1 is up
ArgusWarning: argus[1084]: 09 Sep 07 10:23:09.279090 ArgusGetInterfaceStatus: interface eth0 is up
ArgusInfo: argus[1084]: 09 Sep 07 10:24:06.709582 connect from test4.ucs.sfu.ca
ArgusInfo: argus[1084]: 09 Sep 07 19:48:54.707686 connect from test4.ucs.sfu.ca
ArgusWarning: argus[1084]: 10 Sep 07 16:38:26.341235 ArgusWriteOutSocket(0x11ad5ad0) max queue exceeded 100001
ArgusWarning: argus[1084]: 10 Sep 07 16:38:26.341335 ArgusWriteOutSocket(0x11ad5ad0) max queue exceeded 100001
ArgusInfo: argus[1084]: 11 Sep 07 11:56:48.109155 connect from test4.ucs.sfu.ca
ArgusWarning: argus[1084]: 11 Sep 07 17:31:10.136323 ArgusWriteOutSocket(0x19b4b2b0) max queue exceeded 100001
ArgusWarning: argus[1084]: 11 Sep 07 17:31:10.136415 ArgusWriteOutSocket(0x19b4b2b0) max queue exceeded 100001
ArgusInfo: argus[1084]: 11 Sep 07 18:54:24.709942 connect from test4.ucs.sfu.ca
ArgusInfo: argus[1084]: 12 Sep 07 07:37:52.110885 connect from test4.ucs.sfu.ca
argus: Time 291843.405156 Flows 159285888 Closed 159285888 Sends 244629742 BSends 31152
Updates 4417488174 Cache 4258155634
Total Memory 744490815 Free 744488802 MaxBytes 2147483644
Source: eth1
Total Pkts 2289806745 Rate 7846.011609
Source: eth0
Total Pkts 2126910041 Rate 7287.846850
It shut down correctly on the HUP (the client side died a few times
once because it ran out of disk space) again in 300K of memory for the one
listening to the argus (ones running ra get oinky fast, but I haven't seen
any of the seg faults I was seeing lately).
I just shut it down to install the latest code and we will see what
happens. I see Carter figured out the problem with RaTimeFormat is probably
that "ptr = "xyz";" likely doesn't use malloc (and thus isn't freeable) :-).
I discovered that a while back when I looked my change over in the light of
day but haven't had time to comment :-). I'll try the latest version on
OpenBSD to make sure it is still happy but I expect it will be.
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
More information about the argus
mailing list