Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. NTop>
  3. Misc
Even there are 16 child processes, ntopng only uses 2
sacha at akainix
Sep 13, 2016, 9:32 AM
Post #1 of 3 (1131 views)
Permalink
Hi!

I'm starting to use ntopng that is receiving flows from a Cisco switch 4507 thru netflow.

I start nprobe and ntop in the same server (Dell R720, 24 cores, 128GB RAM, 1TB HD), and I can enter to the GUI, but as soon as I try to look into one specific host (http://server:4000/lua/host_details.lua?host=192.168.200.104), two child processes of ntopng takes 100% of one core each (so, two out of 24) and it takes forever this simple task.

Now, after 45 minutes since I click on that link, nothing happened and the browser is still "thinking".

So, my questios are:

- Why is taking so much CPU for that simple task

- Why it doesn't use more CPU if there are 16 child processes and is only using two



I'm using ntopng Pro [Small Business Edition] v.2.5.160816, running on Centos 7.1 x64 installed with yum using /etc/yum.repos.d/ntop.repo.



This is how I run nprobe:

# nprobe --collector-port 2055 --zmq "tcp://*:5888" --redis 127.0.0.1:6379 -n none



This is how I run ntopng:

# ntopng -i tcp://127.0.0.1:5888 --redis 127.0.0.1:6379 -w 4000 -m 192.168.0.0/16





This is what I see in stdout where I wun ntopng:

13/Sep/2016 13:02:09 [Lua.cpp:5420] WARNING: Script failure [/usr/share/ntopng/scripts/lua/find_host.lua][attempt to index a userdata value]





Sacha Yunusic | Gerente Técnico | Pentagon Security & Akainix

Av. Kennedy 4700, Piso 10, Of. 1002, Edificio New Century, Vitacura | Código Postal (ZIP Code) 7630454

Central: (56-2) 2246 1050 | Directo: (56-2) 2246 2620 | Cel: (56-9) 9883 4752 | www.penta-sec.com <http://www.penta-sec.com/> & www.akainix.com <http://www.akainix.com/>

Attached Files:

Re: Even there are 16 child processes, ntopng only uses 2 [ In reply to ]
deri at ntop
Sep 13, 2016, 10:33 AM
Post #2 of 3 (1124 views)
Permalink
Sacha,
can you please file a ticket on github and attach the current status (# of hosts and flows etc) so we can trck this issue?

Luca
> On 13 Sep 2016, at 18:32, Sacha Yunusic <sacha@akainix.com> wrote:
>
> Hi!
> I’m starting to use ntopng that is receiving flows from a Cisco switch 4507 thru netflow.
> I start nprobe and ntop in the same server (Dell R720, 24 cores, 128GB RAM, 1TB HD), and I can enter to the GUI, but as soon as I try to look into one specific host (http://server:4000/lua/host_details.lua?host=192.168.200.104 <http://server:4000/lua/host_details.lua?host=192.168.200.104>), two child processes of ntopng takes 100% of one core each (so, two out of 24) and it takes forever this simple task.
> Now, after 45 minutes since I click on that link, nothing happened and the browser is still “thinking”.
> So, my questios are:
> - Why is taking so much CPU for that simple task
> - Why it doesn’t use more CPU if there are 16 child processes and is only using two
>
> I’m using ntopng Pro [Small Business Edition] v.2.5.160816, running on Centos 7.1 x64 installed with yum using /etc/yum.repos.d/ntop.repo.
>
> This is how I run nprobe:
> # nprobe --collector-port 2055 --zmq "tcp://*:5888 <tcp://*:5888>" --redis 127.0.0.1:6379 -n none
>
> This is how I run ntopng:
> # ntopng -i tcp://127.0.0.1:5888 <tcp://127.0.0.1:5888> --redis 127.0.0.1:6379 -w 4000 -m 192.168.0.0/16
>
>
> This is what I see in stdout where I wun ntopng:
> 13/Sep/2016 13:02:09 [Lua.cpp:5420] WARNING: Script failure [/usr/share/ntopng/scripts/lua/find_host.lua][attempt to index a userdata value]
>
> <image001.png>
> Sacha Yunusic | Gerente Técnico | Pentagon Security & Akainix
> Av. Kennedy 4700, Piso 10, Of. 1002, Edificio New Century, Vitacura | Código Postal (ZIP Code) 7630454
> Central: (56-2) 2246 1050 | Directo: (56-2) 2246 2620 | Cel: (56-9) 9883 4752 | www.penta-sec.com <http://www.penta-sec.com/> & www.akainix.com <http://www.akainix.com/>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
Re: Even there are 16 child processes, ntopng only uses 2 [ In reply to ]
sacha at akainix
Sep 13, 2016, 12:37 PM
Post #3 of 3 (1123 views)
Permalink
For some reason, after 1 hour of nothing happening, everything goes fine now…

I’ll wait to happened again before open that ticket.. thanks.



From: ntop-misc-bounces@listgateway.unipi.it [mailto:ntop-misc-bounces@listgateway.unipi.it] On Behalf Of Luca Deri
Sent: martes, 13 de septiembre de 2016 14:34
To: ntop-misc@listgateway.unipi.it
Subject: Re: [Ntop-misc] Even there are 16 child processes,ntopng only uses 2



Sacha,

can you please file a ticket on github and attach the current status (# of hosts and flows etc) so we can trck this issue?



Luca

On 13 Sep 2016, at 18:32, Sacha Yunusic <sacha@akainix.com> wrote:



Hi!

I’m starting to use ntopng that is receiving flows from a Cisco switch 4507 thru netflow.

I start nprobe and ntop in the same server (Dell R720, 24 cores, 128GB RAM, 1TB HD), and I can enter to the GUI, but as soon as I try to look into one specific host (http://server:4000/lua/host_details.lua?host=192.168.200.104 <http://server:4000/lua/host_details.lua?host=192.168.200.104> ), two child processes of ntopng takes 100% of one core each (so, two out of 24) and it takes forever this simple task.

Now, after 45 minutes since I click on that link, nothing happened and the browser is still “thinking”.

So, my questios are:

- Why is taking so much CPU for that simple task

- Why it doesn’t use more CPU if there are 16 child processes and is only using two



I’m using ntopng Pro [Small Business Edition] v.2.5.160816, running on Centos 7.1 x64 installed with yum using /etc/yum.repos.d/ntop.repo.



This is how I run nprobe:

# nprobe --collector-port 2055 --zmq "tcp://*:5888 <tcp://*:5888> " --redis 127.0.0.1:6379 -n none



This is how I run ntopng:

# ntopng -i tcp://127.0.0.1:5888 <tcp://127.0.0.1:5888> --redis 127.0.0.1:6379 -w 4000 -m 192.168.0.0/16





This is what I see in stdout where I wun ntopng:

13/Sep/2016 13:02:09 [Lua.cpp:5420] WARNING: Script failure [/usr/share/ntopng/scripts/lua/find_host.lua][attempt to index a userdata value]



<image001.png>

Sacha Yunusic | Gerente Técnico | Pentagon Security & Akainix

Av. Kennedy 4700, Piso 10, Of. 1002, Edificio New Century, Vitacura | Código Postal (ZIP Code) 7630454

Central: (56-2) 2246 1050 | Directo: (56-2) 2246 2620 | Cel: (56-9) 9883 4752 | www.penta-sec.com <http://www.penta-sec.com/> & www.akainix.com <http://www.akainix.com/>



_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
http://listgateway.unipi.it/mailman/listinfo/ntop-misc <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal