On large netflow flows (e.g. >800Mbit/sec) we constantly see following in logs:
Jan 3 12:12:00 radius-minsk2 flow-capture[98939]: STAT: now=1325581920
startup=1324649629 src_ip=172.16.2.23 dst_ip=172.16.2.50 d_ver=5 pkts=77674720
flows=2330241600 lost=22560 reset=3 filter_drops=0
In the same time udp dgrams dropped due to no socjet and due to full socket
constanly increases:
[gawriloff@radius-minsk2 /usr/home/gawriloff]$ netstat -s -p udp
udp:
1378886026 datagrams received
0 with incomplete header
0 with bad data length field
0 with bad checksum
20888 with no checksum
71766750 dropped due to no socket
65910 broadcast/multicast datagrams undelivered
43841072 dropped due to full socket buffers
Recv-Q on flow-capture is always non-zero:
[gawriloff@radius-minsk2 /usr/home/gawriloff]$ sudo netstat -na | grep udp4
866304 0 *.2074 *.*
[gawriloff@radius-minsk2 /usr/home/gawriloff]$ ps ugaxww | grep 2074
root 98945 96.0 0.0 12428 1868 ?? Rs 23Dec11 6227:38.04
/usr/local/bin/flow-capture -w /var/netflow/flows/rtr10 -n 1439 -b big -z 9 -p
/var/run/flow-capture.pid -N 0 -V 5 -S 1 0/0/2074
So I propose to increase FT_SO_RCV_BUFSIZE from 4Mb to 8 in ftlib.h or better
make it configurable through addition parameter.
For example:
-sock 8Mb
Original issue reported on code.google.com by Oleg.Gaw...@gmail.com on 3 Jan 2012 at 9:17
Original issue reported on code.google.com by
Oleg.Gaw...@gmail.com
on 3 Jan 2012 at 9:17