Subject: RE: [Jkflow-users] Performance Issues
From: Jurgen Kobierczynski (jurgen.kobierczynski@pandora.be)
Date: Wed Jun 23 2004 - 18:18:53 CDT
The included flowscan file was the official FlowScan 1.006, merged with the flowscan instance fork patch appeared earlier on the flowscan mailing list. The original Flowscan doesn't support the flow-tools dump layout, and I didn't included it (yet?). A question: Is there an official release location of Flowscan supporting flow-tools? Jurgen On Wed, 2004-06-23 at 19:48, Anderson, Jordan T. wrote: > I'm having these issues with my test JKFlow SMP setup. I'm wondering what these error messages mean: > > 2004/06/23 12:52:19 PID 17726 working on file /var/local/flows/ft-v05.2004-06-23.123500-0500... > /var/local/flows/ft-v05.2004-06-23.123500-0500: Invalid index in cflowd flow file: 0xCF100203! Version 5 flow-export is required with *all* fields being saved. > 2004/06/23 12:52:19 flowscan-1.020 JKFlow: Cflow::find took 0 wallclock secs ( 0.00 usr + 0.00 sys = 0.00 CPU) for 0 flow file bytes, flow hit ratio: 0/0 > 2004/06/23 12:52:20 flowscan-1.020 JKFlow: report took 1 wallclock secs ( 0.36 usr + 0.06 sys = 0.42 CPU) > Queue file /var/local/queue/17726-results doesn't exist! > > First of all, is this new JKFlow version meant only for cflowd? Also, why does JKFlow not create the queue file it needs? I have created the directory for it to go in and given full r/w permission. > > Thanks > > Jordan > > > > -----Original Message----- > From: jkflow-users-admin@lists.sourceforge.net > [mailto:jkflow-users-admin@lists.sourceforge.net]On Behalf Of Jurgen > Kobierczynski > Sent: Saturday, June 19, 2004 5:19 PM > To: joe.borg@datastream.com.mt > Cc: jkflow users > Subject: Re: [Jkflow-users] Performance Issues > > > Hi! > > I have a multiprocessor Flowscan version with JKFlow version3.2.2 > created. It's currently only located on my homesite > http://users.telenet.be/jurgen.kobierczynski/jkflow yet, but I will > update http://jkflow.sourceforge.net shortly. > > screenshot: > http://users.telenet.be/jurgen.kobierczynski/jkflow/flowscansmp.jpg > > Jurgen Kobierczynski > > On Fri, 2004-06-18 at 13:50, Joe Borg wrote: > > Hi, > > > > IâEUR(tm)ve recently installed JKFlow (3.2.1) and IâEUR(tm)ve found it to be > > extremely useful. However, IâEUR(tm)m facing a couple of performance issues > > and was therefore hoping someone could help me. > > > > My collector machine is a dual Xeon 1.8GHz (with Hyperthreading) and > > 512MB Ram, running Fedora core 2 (N.B. The smp kernel actually sees 4 > > CPUâEUR(tm)s due to hyperthreading). IâEUR(tm)m collecting netflow data from the > > central router (only) in a hub and spoke configuration (I am not > > interested in traffic that does not pass through the hub router). My > > XML config file is simply based on defined sites and directions (i.e. > > no routergroups etc.). > > > > > > > > Even with this amount of processing power, the collector doesnâEUR(tm)t seem > > to be coping with the amount of netflow data (I do have a lot of sites > > defined). IâEUR(tm)ve noticed, however, that only one of the four CPUâEUR(tm)s is > > actually being loaded by Flowscan. Is there any way in which I can > > configure JKFlow/Flowscan to make use of all the available CPUâEUR(tm)s? > > > > > > > > Secondly, even with 512MB Ram, memory utilisation is at 98%. I read in > > a previous post that thereâEUR(tm)s an issue with perl not releasing memory. > > Is there any workaround for this? > > > > > > > > Finally, would anyone have any suggestions as to how I can optimise my > > xml config so that itâEUR(tm)s more efficient (I do not have access to the > > spoke routersâEUR¦)? > > > > Sincerely, > > > > Joe Borg > > > > > > > > ------------------------------------------------ > > Mr. Joseph Borg > > Network Engineer > > DataStream Ltd. > > Office Direct: 2567 7245 > > Office General: 2567 7000 > > URL: <http://www.datastream.com.mt/> > > > > This Email is confidential and intended solely for the use of the > > individual to whom it is addressed. Any views or opinions represented > > are solely those of the author and do not necessarily represent those > > of Datastream Ltd. If you are not the intended recipient, be advised > > that you have received this e-mail in error and that any use, > > dissemination, forwarding,printing or copying of this Email is > > strictly prohibited. Please notify the sender immediately by e-mail if > > you have received this e-mail by mistake or call +356 21482000 and > > delete this e-mail from your system. E-mail transmission cannot be > > guaranteed to be secure or free of errors as information could be > > intercepted, corrupted, lost, destroyed, delayed or incomplete, and/or > > contain viruses. The sender therefore does not accept liability for > > any errors or omissions in the contents of this message, which arise > > as a result of Email Transmission. > > > > > > > > > > > > ------------------------------------------------------- > This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference > Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer > Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA > REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND > _______________________________________________ > Jkflow-users mailing list > Jkflow-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/jkflow-users > > > ------------------------------------------------------- > This SF.Net email sponsored by Black Hat Briefings & Training. > Attend Black Hat Briefings & Training, Las Vegas July 24-29 - > digital self defense, top technical experts, no vendor pitches, > unmatched networking opportunities. Visit www.blackhat.com > _______________________________________________ > Jkflow-users mailing list > Jkflow-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/jkflow-users -- Jurgen Kobierczynski <jurgen.kobierczynski@pandora.be> -- Help mailto:majordomo@net.doit.wisc.edu and say "help" in message body Unsubscribe mailto:majordomo@net.doit.wisc.edu and say "unsubscribe flowscan" in message body Archive http://net.doit.wisc.edu/~plonka/list/flowscan/archive/
This archive was generated by hypermail 2b25 : Wed Jun 23 2004 - 18:25:24 CDT