[netflow-tools] softflowd keeps crashing

[alex k]

> On Fri, 27 Mar 2009, alex k wrote:
>
>> hi there,
>>
>> first of all, softflowd is a cool piece of software.
>> we have it on other linux machines (gateways) and it runs perfectly
>> stable
>> there.
>> i use softflowd to collect data and nfsen to capture and evaluate.
>>
>> but there is one host, where softflowd keeps crashing.
>> i am a bit clueless as instability doesn't seem to be a problem of
>> softflowd.
>> at least i didn't find anything in the web or this list.
>>
>> some information about the host:
>>
>> kernel (64 bit):
>> 2.6.27.7-9-default #1 SMP 2008-12-04 18:10:04 +0100 x86_64 x86_64 x86_64
>> GNU/Linux
>> libpcap version:
>> libpcap0-0.9.8-47.41
>> softflowd version:
>> softflowd-0.9.8 (compiled without problems on that machine)
>>
>> on this host with one network card runs vmware-server with several
>> guests.
>> the guests use bridged networking, every has its own ip address, but as
>> mentioned - there is only one network card.
>>
>> softflowd crashes occasionally. sometimes once in two weeks, sometimes
>> twice a day.
>> the process disappears, the pid file stays.
>>
>> the only thing i recognized is, that at the same time there are often
>> flows with completely wrong date (about 6 weeks in the future).
>> not exactly the same time, of course. when softflowd crashes, the
>> possibly
>> critical data is lost.
>>
>> so my questions are:
>> 1) where does softflowd get its time from?
>> 2) can the wrong time be a problem?
>> 3) what else could cause the crashes
>>
>> especially: how can i find it out.
>> softflowd is _very_ quiet. nothing in the syslog, no message at all.
>
> Try running it manually in debug mode:
>
> nohup flowd -dg &
>
> and see what is in nohup.out if/when it crashes.
>
> -d
>

Hi Damien,
Thank you for the hint.
I don't have a problem with flowd but with _softflowd_. ;)
Anyway.
I started softflowd with:
nohup /usr/local/sbin/softflowd -D -i eth0 -T proto -v 5 -t maxlife=1m -n
127.0.0.1:4711 &

"-D" for softflowd's debugging mode.
It's really chatty then.
And now I wait and watch the nohup.out file growing.

Funny detail: after about 50 days of crashing irregularly, sometimes three
times a day, softflowd runs stable on that host for two weeks now.

xela