Mailing List Archive: Fail to rmmod pf

Fail to rmmod pf_ring

Jul 10, 2017, 1:57 AM

Post #1 of 7 (2175 views)

Hi,

I'm in a situation where I try to remove the pf_ring kernel module.
"rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
"lsmod | grep pf_ring" gives "pf_ring 1234009 20"
In this case, I try to find which process uses pf_ring, in order to
stop/kill it.
I run "ls -l /proc/net/pf_ring/" to hopefully get the list of process-ids
of the relevant processes. The problem is that the list gives only "dev"
(subdir) "info" (file) and "stats" (subdir). There are no files like (for
example) "/proc/net/pf_ring/12345-eth0.23" that can give me an indication
who uses the pf_ring kernel module.
Any advice on how can I force removing it or at least know who uses it?

Thanks,
Amir

Re: Fail to rmmod pf_ring [ In reply to ]

akaduri75 at gmail

Jul 10, 2017, 2:00 AM

Post #2 of 7 (2175 views)

Permalink

OS CentOS 7
pf_ring version: 6.6.0

On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com> wrote:

> Hi,
>
> I'm in a situation where I try to remove the pf_ring kernel module.
> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
> In this case, I try to find which process uses pf_ring, in order to
> stop/kill it.
> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of process-ids
> of the relevant processes. The problem is that the list gives only "dev"
> (subdir) "info" (file) and "stats" (subdir). There are no files like (for
> example) "/proc/net/pf_ring/12345-eth0.23" that can give me an indication
> who uses the pf_ring kernel module.
> Any advice on how can I force removing it or at least know who uses it?
>
> Thanks,
> Amir
>

Re: Fail to rmmod pf_ring [ In reply to ]

cardigliano at ntop

Jul 10, 2017, 2:42 AM

Post #3 of 7 (2174 views)

Permalink

Hi Amir
did you load a ZC driver perhaps?

Alfredo

2017-07-10 11:00 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:

> OS CentOS 7
> pf_ring version: 6.6.0
>
> On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com> wrote:
>
>> Hi,
>>
>> I'm in a situation where I try to remove the pf_ring kernel module.
>> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
>> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
>> In this case, I try to find which process uses pf_ring, in order to
>> stop/kill it.
>> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of process-ids
>> of the relevant processes. The problem is that the list gives only "dev"
>> (subdir) "info" (file) and "stats" (subdir). There are no files like (for
>> example) "/proc/net/pf_ring/12345-eth0.23" that can give me an
>> indication who uses the pf_ring kernel module.
>> Any advice on how can I force removing it or at least know who uses it?
>>
>> Thanks,
>> Amir
>>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>

Re: Fail to rmmod pf_ring [ In reply to ]

akaduri75 at gmail

Jul 10, 2017, 4:22 AM

Post #4 of 7 (2174 views)

Permalink

No, not using ZC. But if it could be a reason and maybe I'm doing something
wrong during load, how can I check about zc?
Anyway, the background for this issue is that I'm trying to replace the
igb.ko during machine installation and I'm trying to overcome the special
situation that its used by the management interface.
To debug the situation, I fiddle with the machine so I'm not sure what
exactly brought me to the situation described above, so I probably
interested in a tweak (just to remove the pf_ring module) rather than a
proper solution.

Amir

On Mon, Jul 10, 2017 at 12:42 PM, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi Amir
> did you load a ZC driver perhaps?
>
> Alfredo
>
> 2017-07-10 11:00 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>
>> OS CentOS 7
>> pf_ring version: 6.6.0
>>
>> On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com>
>> wrote:
>>
>>> Hi,
>>>
>>> I'm in a situation where I try to remove the pf_ring kernel module.
>>> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
>>> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
>>> In this case, I try to find which process uses pf_ring, in order to
>>> stop/kill it.
>>> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of
>>> process-ids of the relevant processes. The problem is that the list gives
>>> only "dev" (subdir) "info" (file) and "stats" (subdir). There are no files
>>> like (for example) "/proc/net/pf_ring/12345-eth0.23" that can give me
>>> an indication who uses the pf_ring kernel module.
>>> Any advice on how can I force removing it or at least know who uses it?
>>>
>>> Thanks,
>>> Amir
>>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>

Re: Fail to rmmod pf_ring [ In reply to ]

cardigliano at ntop

Jul 10, 2017, 6:22 AM

Post #5 of 7 (2174 views)

Permalink

Hi Amir
you are "trying to replace the igb.ko" with?
Please send us the output from dmesg.

Alfredo

2017-07-10 13:22 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:

> No, not using ZC. But if it could be a reason and maybe I'm doing
> something wrong during load, how can I check about zc?
> Anyway, the background for this issue is that I'm trying to replace the
> igb.ko during machine installation and I'm trying to overcome the special
> situation that its used by the management interface.
> To debug the situation, I fiddle with the machine so I'm not sure what
> exactly brought me to the situation described above, so I probably
> interested in a tweak (just to remove the pf_ring module) rather than a
> proper solution.
>
> Amir
>
> On Mon, Jul 10, 2017 at 12:42 PM, Alfredo Cardigliano <
> cardigliano@ntop.org> wrote:
>
>> Hi Amir
>> did you load a ZC driver perhaps?
>>
>> Alfredo
>>
>> 2017-07-10 11:00 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>>
>>> OS CentOS 7
>>> pf_ring version: 6.6.0
>>>
>>> On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com>
>>> wrote:
>>>
>>>> Hi,
>>>>
>>>> I'm in a situation where I try to remove the pf_ring kernel module.
>>>> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
>>>> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
>>>> In this case, I try to find which process uses pf_ring, in order to
>>>> stop/kill it.
>>>> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of
>>>> process-ids of the relevant processes. The problem is that the list gives
>>>> only "dev" (subdir) "info" (file) and "stats" (subdir). There are no files
>>>> like (for example) "/proc/net/pf_ring/12345-eth0.23" that can give me
>>>> an indication who uses the pf_ring kernel module.
>>>> Any advice on how can I force removing it or at least know who uses it?
>>>>
>>>> Thanks,
>>>> Amir
>>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>

Re: Fail to rmmod pf_ring [ In reply to ]

akaduri75 at gmail

Jul 12, 2017, 9:34 AM

Post #6 of 7 (2162 views)

Permalink

I've managed to rmmov the "used" pfring.ko by removing first the ixgbe.ko
and igb.ko drivers. Not sure how its related (since no process really uses
pf_ring) but currently its good enough for me.

Thanks

On Mon, Jul 10, 2017 at 4:22 PM, Alfredo Cardigliano <cardigliano@ntop.org>
wrote:

> Hi Amir
> you are "trying to replace the igb.ko" with?
> Please send us the output from dmesg.
>
> Alfredo
>
> 2017-07-10 13:22 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>
>> No, not using ZC. But if it could be a reason and maybe I'm doing
>> something wrong during load, how can I check about zc?
>> Anyway, the background for this issue is that I'm trying to replace the
>> igb.ko during machine installation and I'm trying to overcome the special
>> situation that its used by the management interface.
>> To debug the situation, I fiddle with the machine so I'm not sure what
>> exactly brought me to the situation described above, so I probably
>> interested in a tweak (just to remove the pf_ring module) rather than a
>> proper solution.
>>
>> Amir
>>
>> On Mon, Jul 10, 2017 at 12:42 PM, Alfredo Cardigliano <
>> cardigliano@ntop.org> wrote:
>>
>>> Hi Amir
>>> did you load a ZC driver perhaps?
>>>
>>> Alfredo
>>>
>>> 2017-07-10 11:00 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>>>
>>>> OS CentOS 7
>>>> pf_ring version: 6.6.0
>>>>
>>>> On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com>
>>>> wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> I'm in a situation where I try to remove the pf_ring kernel module.
>>>>> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
>>>>> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
>>>>> In this case, I try to find which process uses pf_ring, in order to
>>>>> stop/kill it.
>>>>> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of
>>>>> process-ids of the relevant processes. The problem is that the list gives
>>>>> only "dev" (subdir) "info" (file) and "stats" (subdir). There are no files
>>>>> like (for example) "/proc/net/pf_ring/12345-eth0.23" that can give me
>>>>> an indication who uses the pf_ring kernel module.
>>>>> Any advice on how can I force removing it or at least know who uses it?
>>>>>
>>>>> Thanks,
>>>>> Amir
>>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop-misc mailing list
>>>> Ntop-misc@listgateway.unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>

Re: Fail to rmmod pf_ring [ In reply to ]

cardigliano at ntop

Jul 12, 2017, 2:00 PM

Post #7 of 7 (2161 views)

Permalink

Hi Amir
please note our ZC drivers (igb, ixgbe, etc) have a dependency on the
pf_ring kernel module,
thus you should remove the drivers *before* removing pf_ring. This is
automatically done by
our init.d script.

Alfredo

2017-07-12 18:34 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:

> I've managed to rmmov the "used" pfring.ko by removing first the ixgbe.ko
> and igb.ko drivers. Not sure how its related (since no process really uses
> pf_ring) but currently its good enough for me.
>
> Thanks
>
> On Mon, Jul 10, 2017 at 4:22 PM, Alfredo Cardigliano <cardigliano@ntop.org
> > wrote:
>
>> Hi Amir
>> you are "trying to replace the igb.ko" with?
>> Please send us the output from dmesg.
>>
>> Alfredo
>>
>> 2017-07-10 13:22 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>>
>>> No, not using ZC. But if it could be a reason and maybe I'm doing
>>> something wrong during load, how can I check about zc?
>>> Anyway, the background for this issue is that I'm trying to replace the
>>> igb.ko during machine installation and I'm trying to overcome the special
>>> situation that its used by the management interface.
>>> To debug the situation, I fiddle with the machine so I'm not sure what
>>> exactly brought me to the situation described above, so I probably
>>> interested in a tweak (just to remove the pf_ring module) rather than a
>>> proper solution.
>>>
>>> Amir
>>>
>>> On Mon, Jul 10, 2017 at 12:42 PM, Alfredo Cardigliano <
>>> cardigliano@ntop.org> wrote:
>>>
>>>> Hi Amir
>>>> did you load a ZC driver perhaps?
>>>>
>>>> Alfredo
>>>>
>>>> 2017-07-10 11:00 GMT+02:00 Amir Kaduri <akaduri75@gmail.com>:
>>>>
>>>>> OS CentOS 7
>>>>> pf_ring version: 6.6.0
>>>>>
>>>>> On Mon, Jul 10, 2017 at 11:57 AM, Amir Kaduri <akaduri75@gmail.com>
>>>>> wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> I'm in a situation where I try to remove the pf_ring kernel module.
>>>>>> "rmmod pf_ring" gives "rmmod: ERROR: Module pf_ring is in use"
>>>>>> "lsmod | grep pf_ring" gives "pf_ring 1234009 20"
>>>>>> In this case, I try to find which process uses pf_ring, in order to
>>>>>> stop/kill it.
>>>>>> I run "ls -l /proc/net/pf_ring/" to hopefully get the list of
>>>>>> process-ids of the relevant processes. The problem is that the list gives
>>>>>> only "dev" (subdir) "info" (file) and "stats" (subdir). There are no files
>>>>>> like (for example) "/proc/net/pf_ring/12345-eth0.23" that can give
>>>>>> me an indication who uses the pf_ring kernel module.
>>>>>> Any advice on how can I force removing it or at least know who uses
>>>>>> it?
>>>>>>
>>>>>> Thanks,
>>>>>> Amir
>>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Ntop-misc mailing list
>>>>> Ntop-misc@listgateway.unipi.it
>>>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop-misc mailing list
>>>> Ntop-misc@listgateway.unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop-misc mailing list
>>> Ntop-misc@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>>
>>
>>
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>>
>
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>