[Nfdump-discuss] Process_v9: output buffer size error. Abort v9 record processing

[Adam A. <ada...@gm...>]

Hello,

I have a nfcapd running that is turning out a bunch of the following
in daemon.log:

Nov 20 12:41:15 gtisc2 nfcapd[19406]: Failed to write output buffer to
disk: 'Bad file descriptor'
Nov 20 12:41:15 gtisc2 nfcapd[19406]: Process_v9: output buffer size
error. Abort v9 record processing


and failing to write out captured netflow records. A restart of nfcapd
seems to get it going again, but it eventually stops working. There's
no indication of resource exhaustion on the machine (out of memory,
high disk io, etc.), and nfcapd will still be happily running in these
cases. I don't anything like logrotate moving files out from under
nfcapd (I let it do 5 minute rotation on its own). I noticed from the
list archives and in the source code that in the v5 and v7 error text
has a comment suggesting a full disk, but this is not my case:

Filesystem                                              Size  Used
Avail Use% Mounted on
rootfs                                                  7.3T  2.5T  4.8T  34% /

I'm somewhat at a loss as to where to start troubleshooting.

Any help or suggestions would be appreciated.



Adam