argus error message
MN
m.newton at stanford.edu
Thu Nov 20 21:16:32 EST 2014
Hi Carter - on Ubuntu 14.04.1 LTS, pcap 1.6.2, argus 3.0.8 (I've changed
control characters to ^x to prevent mailers from experiencing too much
anxiety):
ArgusWarning: 18 Nov 14 10:12:43.685476 ArgusCheckClientMessage: received ^x
ArgusWarning: 18 Nov 14 10:12:43.726362 ArgusCheckClientMessage: received ^d^a
ArgusWarning: 18 Nov 14 10:12:43.779023 ArgusCheckClientMessage: received l
ArgusWarning: 18 Nov 14 10:12:43.838211 ArgusCheckClientMessage: received 8HKCEJ:^\q]huo$5^\%
ArgusWarning: 18 Nov 14 10:12:43.929395 ArgusCheckClientMessage: received status
ArgusWarning: 18 Nov 14 10:12:43.978500 ArgusCheckClientMessage: received ^r^a
ArgusWarning: 18 Nov 14 10:12:44.421381 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:44.581236 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:44.760099 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:44.910570 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:45.114734 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:48.294836 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:48.458081 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:48.590864 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:48.730317 ArgusCheckClientMessage: received ^p^a
ArgusWarning: 18 Nov 14 10:12:53.739017 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:12:53.883301 ArgusCheckClientMessage: received
ArgusWarning: 18 Nov 14 10:12:59.022351 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:13:05.210904 ArgusCheckClientMessage: client noname never started: timed out
ArgusWarning: 18 Nov 14 10:13:06.443490 ArgusCheckClientMessage: received ^a
ArgusWarning: 18 Nov 14 10:14:19.888625 ArgusCheckClientMessage: client noname never started: timed out
This happens roughly ever 5 days on our three busiest Argus collectors.
It does not appear to affect flow collection.
Is it just some random TCP connection causing the problem?
Thanks,
- mike
ps: libpcap 1.3.0 and some versions of Argus do not work well - random
crashes every few days on 10gb connections. We switched to 1.6.2 and
these problems went away.
More information about the argus
mailing list