Rabins and netflow 5 failure

[Richard Rothwell via Argus-info]

Hi Carter,

Regarding my report on  rabins shutting down after 20 minutes;

Previously:
When using Neflow 5 there are 2 problems:
1.       The timestamps of the rabins Argus records seem to be wrong. They are piled up in a narrow range of time.
2.       Rabins dies after about 20 minutes of processing.

It seems the issue is a radium problem rather than a rabins problem.
When radium is supplied with a netflow 5 stream by nprobe, nothing much happens.
But when ra or rabins connects to radium, after a few minutes there is an endless stream of this message:

radium[24752]: 08:19:58.019078 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608062
radium[24752]: 08:19:58.019138 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608062
radium[24752]: 08:19:58.019181 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608063
radium[24752]: 08:19:58.019220 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608063
radium[24752]: 08:19:58.019260 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608064
radium[24752]: 08:19:58.019299 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608064
radium[24752]: 08:19:58.019340 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608065
radium[24752]: 08:19:58.019378 ArgusWriteOutSocket(0x8128bb0) max queue exceeded 608065

Memory consumption by radium then just keeps on climbing.
I suspect that eventually radium runs out of ram and stops
Then ra or rabins stops receiving stuff and shuts itself down.

It got to 75% ram after a couple of hours, before I stopped it.

I can’t tell yet if this is due to something that nprobe is doing or is just a radium problem.

I will investigate further to see if nprobe providing a data stream directly to the Perl code,
_bypassing all Argus clients, can provide data with valid timestamps.

Regards


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20160712/a28d5565/attachment.html>