High CPU usage ntopng Package - even on idle?

ramup · Oct 26, 2018, 3:48 PM

Hello,
I changed with version 2.4.4 from pfSense in a VM (ESXI on 2vCPU Xeon Dual-CPU) to a standalone server with an AMD GX-424CC CPU Passmark and 8 GB Ram. Intel i350-T4 card, 1 LAN, 1 WAN.

Network is small with ~8 users not doing much network traffic except Windows RDP to a certain IP (RDS Server). I run ntopng package (0.8.13_1 = 3.4.180911) to monitor total traffic used by certain IPs.

Since the change I wondered that the CPU usage is high in IDLE mode. When I have powerd with HIadaptive enabled it never clocks the CPU frequency down. That´s why I enabled adaptive mode where the lock down of frequency to lower states work.

The CPU is in total always changing inbetween 5-10% CPU even when there is no traffic at all, e.g. at night. Reason is ntopng process only according to "top" in shell and all other processes run below 0.5%.

I know that ntopng needs some CPU und promiscous mode, too that needs to be activated with ntopng but e.g. Snort is running with >0.5% and uses promiscous mode, too.

I already tried to modify some settings in ntopng directy to lower the CPU but none of them worked.

So can anyone tell me is the CPU in IDLE that high in general when using ntopng?

Rai80 · Oct 26, 2018, 6:26 PM

I experience the same since pfsense 2.4.4. Running directly on hardware. (No virtualization). CPU is on idle network utilization between 7-15%. When openening NTOP website and downloading it is climbing to 40-50%.

I also have problems starting NTOP (from services) after trying 3-4 times its finally starting. On reboot is not starting automatically. And after a few days its crashing:

pid 99675 (ntopng), uid 0: exited on signal 11 (core dumped)

Right now I uninstalled NTOP. Waiting for an update....

ramup · Oct 27, 2018, 7:31 AM

@Rai80: Thanks for sharing your experience. Due to my change in system setup, can you tell me how high the average CPU idle was with notpng under 2.4.3?

I had (have) the same problem with not instantly starting or later exiting notpng services from the beginning on. I installed watchdog so it restarts the process automatically when it exits due to an error.

Rai80 · Oct 27, 2018, 2:32 PM

On 2.4.3 is was about 2-5%. And with high traffic and webinterface open it was around 15-20%. After closing the webinterface it dropped to 10-15%.
So it seems much more CPU intensive after 2.4.4. and much less stable.

Hope there will be an update soon!

ramup · Oct 29, 2018, 8:49 AM

OK, are there any other users who can confirm this behaviour with high CPU usage of ntopng in IDLE mode? If yes, I would issue a bug in redmine.pfsense.org to examine this behaviour.

Btw. I can`t say that ntopng is less stable under 2.4.4 but since I use watchdog I do not check anymore how often the process exits. But the problem occured already under 2.4.3 and before and as far as I read this happens under FreeBSD regularly so I live with it because it is not really an issue when watchdog restarts the process immediately.

But the hig CPU usage is more a problem that I can`t really estimate (in comparison to 2.4.3) especially since my change of hardware with 2.4.4. Before I used XEON vCPUs and as they are more powerful the CPU usage was not an issue because the server was under a certain load anyway.

Jack150 · Oct 29, 2018, 9:12 PM

i had the same issue with ntopng on a virtualized server
cpu usage went up to 60% on an i5-6200u cpu

deleted the package and the cpu usage went back to 5-8%

ramup · Oct 30, 2018, 1:44 PM

@Jack150 Did you install ntopng under 2.4.4 or in a previous version?
Did 60% occur during idle or load? Were you monitoring while that high CPU usage?

Jack150 · Oct 30, 2018, 8:34 PM

I did install ntopng under 2.4.3 but shortly after the upgrade to 2.4.4 i got the issue.
it happend on idle and i was only watching @ system activity

Jack150 · Nov 4, 2018, 1:20 PM

i just did a reinstall of ntopng, it was running fine
but after i added another port to my bridge the cpu when back up

see screenshot of system activity:
https://ss.dutchs.nl/n4tRP2SBq9dG.png

Rai80 · Dec 18, 2018, 9:29 PM

Now in 2.4.4-p1 I reinstalled NTOPNG, and CPU usage has dropped and stays much more stable (low).
So seems to be fixed.

sadie · Dec 13, 2021, 8:37 AM

I'm using the latest nightly build of ntopng pro and finding it's using a large amount of CPU time constantly, even when the user interface isn't open in a web browser, and even when there's barely any traffic passing through the server.

My configuration file contains:

-G=/var/run/ntopng.pid
--disable-login=1
-F "mysql;localhost;ntopng;flows;username;password"
-w=3050

However the same still occurs even if I remove the mysql line (I suspected it was file IO of writing flows, but apparently now).

Any suggestions to track down what ntopng is doing would be greatly appreciated - the load average on the server I'm running it on is through the roof!

infovish31 · Dec 23, 2022, 4:32 PM

This post is deleted!