Re: [Nfsen-discuss] problem with more than 10 sources with the latest snapshot
Netflow visualisation and investigation tool
Brought to you by:
phaag
|
From: Peter H. <ha...@sw...> - 2006-08-10 09:17:04
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------- Original Message --------
From: Yann Berthier <yb...@ba...>
To: Peter Haag <ha...@sw...>
Subject: Re:[Nfsen-discuss] problem with more than 10 sources with the latest snapshot
Date: Thu Aug 10 2006 11:13:49 GMT+0200 (CEST)
> Hi Peter,
>
> On Thu, 10 Aug 2006, at 09:40, Peter Haag wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi Yann,
>> I installed latest nfdump/nfsen snapshots on a debian Sarge laptop, and configured 20 sources. It runs perfectly well. I know Maurizio has even more on his installation.
>>
>> You may do a test like this:
>>
>> #!/bin/sh
>> for num in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
>> mkdir -p nftest/${num}
>> /usr/local/bin/nfcapd -w -D -I flows -p 123${num} -l nftest/${num} -P nftest/test-${num}.pid
>> sleep 1
>> done
>>
>> Note on the number of Semaphores:
>> On an old FreeBSD-5.4 I have, there is a limit of 10 processes, which get startet. This is due to the max semaphore settings in the FreeBSD I have tested. But this is poperly reported in the syslog
>> file. I don't know, what decent FreeBSDs are configured for.
>
> aye, gotcha. i was misleaded by the shmmax value, but it appears i
> need to bump at least SEMMNI (11 by default). savvy*
>
> And i was fortunate enough to trigger another condition on the linux
> box, where the problem was not due to ipcs thresholds reached, but
> rather to me having bumped the BUFFLEN value to x5 the default.
>
> All is functioning great now that i decreased it to the default.
>
> my next problem will be to find colors that mix well and are readable
> for that many souces ... :)
Well - new NfSen will have a better colour management - thanks to Philippe Bourcier who sent me some code to handle that automatically :)
- Peter
>
> Sorry for the noise Peter, and many thanks, as usual
>
> [* - i'l let everybody guess what movie i've seen recently ;)]
>
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Limmatquai 138, CH-8001 Zurich, Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/security
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRNr5hv5AbZRALNr/AQLzTwP7BqN1+aC9CWQdoaBlhqfljB35CmChXokF
5LheRGnelRxVboMYfJjp3ASGDe3wWUi1oxzRvFzP+PITLu2ESdJVNNKCIXHltixC
QQBkZi+yiP1NJg+UNm18B+XWbvIsQoj7d/BRYOQmR1HCeoN83BCc6HFq5IKqDcXR
VPeX+KB/gI0=
=Jz05
-----END PGP SIGNATURE-----
|