Mailing List Archive

Hi Jonas,

I don't recall seeing this problem before. I tried your config and I was
not able to reproduce it.
Can you try restarting sampled and see if it fixes the problem. You can
also try deactivating the forwarding-options sampling config.
Also, check /var/log/sampled and see if there is anything that looks
suspicious.

Thanks,
Yulianto

On Wed, 25 Feb 2004, Jonas Frey (Probe Networks) wrote:

> Hi,
>
> ive setup sampling some time ago but have removed all sampling
> configurations since then. Now when i apply some packet filtering rule
> to an interface, the cpu usage of the RE jumps to 100%, all used up by
> sampled:
> PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
> 9785 root 88 15 18460K 17896K RUN 5:04 96.29% 96.29% sampled
>
> I even have
> forwarding-options {
> sampling {
> disable;
> }
> }
>
> but still the same effect.
>
> My filter rule looks like:
> firewall {
> filter fw {
> term term1 {
> from {
> address {
> some-block-here/prefix;
> }
> }
> then {
> discard;
> }
> }
> term term2 {
> then accept;
> }
> }
> }
>
>
> Running JunOS 6.0R1.6.
>
> Regards,
> Jonas
>
> _______________________________________________
> juniper-nsp mailing list juniper-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/juniper-nsp
>

Hi Yulianto,

the high usage went away after 2-3 minutes. Thanks for everyone who
pointed this out. Strange anyway.

Jonas

On Wed, 2004-02-25 at 20:32, Yulianto Ko wrote:
> Hi Jonas,
>
> I don't recall seeing this problem before. I tried your config and I was
> not able to reproduce it.
> Can you try restarting sampled and see if it fixes the problem. You can
> also try deactivating the forwarding-options sampling config.
> Also, check /var/log/sampled and see if there is anything that looks
> suspicious.
>
> Thanks,
> Yulianto
>
> On Wed, 25 Feb 2004, Jonas Frey (Probe Networks) wrote:
>
> > Hi,
> >
> > ive setup sampling some time ago but have removed all sampling
> > configurations since then. Now when i apply some packet filtering rule
> > to an interface, the cpu usage of the RE jumps to 100%, all used up by
> > sampled:
> > PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND
> > 9785 root 88 15 18460K 17896K RUN 5:04 96.29% 96.29% sampled
> >
> > I even have
> > forwarding-options {
> > sampling {
> > disable;
> > }
> > }
> >
> > but still the same effect.
> >
> > My filter rule looks like:
> > firewall {
> > filter fw {
> > term term1 {
> > from {
> > address {
> > some-block-here/prefix;
> > }
> > }
> > then {
> > discard;
> > }
> > }
> > term term2 {
> > then accept;
> > }
> > }
> > }
> >
> >
> > Running JunOS 6.0R1.6.
> >
> > Regards,
> > Jonas
> >
> > _______________________________________________
> > juniper-nsp mailing list juniper-nsp@puck.nether.net
> > http://puck.nether.net/mailman/listinfo/juniper-nsp
> >

On Thu, Feb 26, 2004 at 02:15:08AM +0100, Jonas Frey (Probe Networks) wrote:
> Hi Yulianto,
>
> the high usage went away after 2-3 minutes. Thanks for everyone who
> pointed this out. Strange anyway.

Yeah I see that one all the time, but usually after first turning on
sampling. Anyone from jnpr want to tell us why? :)

--
Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

When first starting sampling, it is necessary for rpd and sampled
to get "in sync". Depending on how many routes you have, it can
take a couple minutes or so for sampled to learn which routes go
with which AS.

-----Original Message-----
From: juniper-nsp-bounces@puck.nether.net
[mailto:juniper-nsp-bounces@puck.nether.net]On Behalf Of Richard A
Steenbergen
Sent: Wednesday, February 25, 2004 6:18 PM
To: Jonas Frey (Probe Networks)
Cc: juniper-nsp@puck.nether.net
Subject: Re: [j-nsp] sampled problem


On Thu, Feb 26, 2004 at 02:15:08AM +0100, Jonas Frey (Probe Networks) wrote:
> Hi Yulianto,
>
> the high usage went away after 2-3 minutes. Thanks for everyone who
> pointed this out. Strange anyway.

Yeah I see that one all the time, but usually after first turning on
sampling. Anyone from jnpr want to tell us why? :)

--
Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
_______________________________________________
juniper-nsp mailing list juniper-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/juniper-nsp

On Wed, Feb 25, 2004 at 06:25:23PM -0800, Paul Goyette wrote:
> When first starting sampling, it is necessary for rpd and sampled
> to get "in sync". Depending on how many routes you have, it can
> take a couple minutes or so for sampled to learn which routes go
> with which AS.

Ah, I was wondering when this part was being done (I had thought sampled
was just querying rpd per flow rather than copying data). Thanks for
clearing that one up. :)

I don't suppose you guys would see any value in adding a "cflowd x.x.x.x
autonomous-system-type none" for those of us who don't rely on
router-populated origin/peer AS data and would like to save some cycles?

--
Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)