Kernel: pid 55776 (ntop), uid 0: exited on signal 11 (core dumped)



  • Hello!

    I've got problems with the stability of ntop on my install (pf 1.2.2). It sometimes run for a couple of minutes or maybe up to an hour.

    "kernel: pid 55776 (ntop), uid 0: exited on signal 11 (core dumped)".
    Can I find more revealing information than the above? ntop logs?

    Hw info:
    Processors  1
    Model Intel(R) Pentium(R) 4 CPU 1.80GHz
    CPU Speed 1.8 GHz
    PCI Devices

    • atapci0: Intel ICH4 UDMA100 controller
    • ehci0: Intel 82801DB/L/M (ICH4) USB 2.0 controller
    • isab0: PCI-ISA bridge
    • pcib1: ACPI PCI-PCI bridge
    • rl0: RealTek 8139 10/100BaseTX
    • uhci0: Intel 82801DB (ICH4) USB controller USB-A
    • uhci1: Intel 82801DB (ICH4) USB controller USB-B
    • uhci2: Intel 82801DB (ICH4) USB controller USB-C
    • vgapci0: VGA-compatible display
    • vr0: VIA VT6105 Rhine III 10/100BaseTX
      IDE Devices
    • acd0: HL-DT-ST DVDRAM GSA-4120B/A102
    • ad0: Maxtor 6Y060L0 YAR41VW0 (Capacity: 60.08 GB)
      SCSI Devices none
      USB Devices none

    Memory Usage
    Type Percent Capacity Free Used Size
    Physical Memory   18% 822.50 MB 180.90 MB 1003.40 MB

    • Kernel + applications   10%   99.74 MB
    • Buffers   8%   79.66 MB
    • Cached   0%   1.49 MB
      Disk Swap   0% 1024.00 MB 0.00 KB 1024.00 MB

    A loooong log (reverse order, newest at top) from the time it was up last time:

    
    Jan 22 09:57:34 	kernel: pid 55776 (ntop), uid 0: exited on signal 11 (core dumped)
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Throughput data collection: Thread running [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Throughput data collection: Thread running [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Throughput data collection: Thread starting [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Throughput data collection: Thread starting [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683679744]: RRD: Data collection thread running [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683679744]: RRD: Data collection thread running [p55776]
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Started thread for throughput data collection
    Jan 22 09:51:29 	ntop[55776]: THREADMGMT[t683680256]: RRD: Started thread for throughput data collection
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676928]: DNSAR(2): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676928]: DNSAR(2): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Idle host scan thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Idle host scan thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Idle host scan thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Idle host scan thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676672]: DNSAR(1): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676672]: DNSAR(1): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(rl0): pcapDispatch thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(rl0): pcapDispatch thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(rl0): pcapDispatch thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(rl0): pcapDispatch thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677184]: DNSAR(3): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677184]: DNSAR(3): Address resolution thread running
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683679744]: RRD: Data collection thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683679744]: RRD: Data collection thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Fingerprint scan thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Fingerprint scan thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Fingerprint scan thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Fingerprint scan thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: WEB: ntop's web server is now processing requests
    Jan 22 09:51:19 	ntop[55776]: WEB: ntop's web server is now processing requests
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: WEB: Server connection thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: WEB: Server connection thread running [p55776]
    Jan 22 09:51:19 	ntop[55776]: Note: SIGPIPE handler set (ignore)
    Jan 22 09:51:19 	ntop[55776]: Note: SIGPIPE handler set (ignore)
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: WEB: Server connection thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: WEB: Server connection thread starting [p55776]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(1): Started thread for network packet sniffing [rl0]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683680000]: NPS(1): Started thread for network packet sniffing [rl0]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683675904]: ntop RUNSTATE: RUN(4)
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683675904]: ntop RUNSTATE: RUN(4)
    Jan 22 09:51:19 	ntop[55776]: Note: Reporting device initally set to 0 [rl0]
    Jan 22 09:51:19 	ntop[55776]: Note: Reporting device initally set to 0 [rl0]
    Jan 22 09:51:19 	ntop[55776]: Now running as requested user 'root' (0:0)
    Jan 22 09:51:19 	ntop[55776]: Now running as requested user 'root' (0:0)
    Jan 22 09:51:19 	ntop[55776]: INIT: Created pid file (/var/run/ntop.pid)
    Jan 22 09:51:19 	ntop[55776]: INIT: Created pid file (/var/run/ntop.pid)
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT: RRD: Started thread (t683679744) for data collection
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT: RRD: Started thread (t683679744) for data collection
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: DirPerms 0700
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: DirPerms 0700
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: umask 0066
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: umask 0066
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: rrdPath /var/db/ntop/rrd [dynamic/volatile]
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: rrdPath /var/db/ntop/rrd [dynamic/volatile]
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: rrdPath /var/db/ntop/rrd [normal]
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: rrdPath /var/db/ntop/rrd [normal]
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: hostsFilter
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: hostsFilter
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDetail medium
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDetail medium
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpMatrix no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpMatrix no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpASs no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpASs no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpInterfaces yes
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpInterfaces yes
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpHosts no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpHosts no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpSubnets no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpSubnets no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpFlows no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpFlows no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDomains no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDomains no
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpMonths 36 months by day
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpMonths 36 months by day
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDays 90 days by hour
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpDays 90 days by hour
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpHours 72 hours by 300 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpHours 72 hours by 300 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpShortInterval 10 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpShortInterval 10 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpInterval 300 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: dumpInterval 300 seconds
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: Parameters:
    Jan 22 09:51:19 	ntop[55776]: RRD_DEBUG: Parameters:
    Jan 22 09:51:19 	ntop[55776]: RRD: Mask for new files is 0066
    Jan 22 09:51:19 	ntop[55776]: RRD: Mask for new files is 0066
    Jan 22 09:51:19 	ntop[55776]: RRD: Mask for new directories is 0700
    Jan 22 09:51:19 	ntop[55776]: RRD: Mask for new directories is 0700
    Jan 22 09:51:19 	ntop[55776]: RRD: Welcome to the RRD plugin
    Jan 22 09:51:19 	ntop[55776]: RRD: Welcome to the RRD plugin
    Jan 22 09:51:19 	ntop[55776]: Calling plugin start functions (if any)
    Jan 22 09:51:19 	ntop[55776]: Calling plugin start functions (if any)
    Jan 22 09:51:19 	ntop[55776]: SFLOW: Welcome to sFlow.(C) 2002-04 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: SFLOW: Welcome to sFlow.(C) 2002-04 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: RRD: Welcome to Round-Robin Databases. (C) 2002-07 by Luca Deri.
    Jan 22 09:51:19 	ntop[55776]: RRD: Welcome to Round-Robin Databases. (C) 2002-07 by Luca Deri.
    Jan 22 09:51:19 	ntop[55776]: Remote: Welcome to Remote. (C) 2006-07 by L.Deri
    Jan 22 09:51:19 	ntop[55776]: Remote: Welcome to Remote. (C) 2006-07 by L.Deri
    Jan 22 09:51:19 	ntop[55776]: PDA: Welcome to PDA. (C) 2001-2005 by L.Deri and W.Brock
    Jan 22 09:51:19 	ntop[55776]: PDA: Welcome to PDA. (C) 2001-2005 by L.Deri and W.Brock
    Jan 22 09:51:19 	ntop[55776]: NETFLOW: Welcome to NetFlow.(C) 2002-08 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: NETFLOW: Welcome to NetFlow.(C) 2002-08 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: LASTSEEN: Welcome to Host Last Seen. (C) 1999 by Andrea Marangoni
    Jan 22 09:51:19 	ntop[55776]: LASTSEEN: Welcome to Host Last Seen. (C) 1999 by Andrea Marangoni
    Jan 22 09:51:19 	ntop[55776]: ICMP: Welcome to ICMP Watch. (C) 1999-2005 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: ICMP: Welcome to ICMP Watch. (C) 1999-2005 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: CPACKET: Welcome to cPacket.(C) 2008 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: CPACKET: Welcome to cPacket.(C) 2008 by Luca Deri
    Jan 22 09:51:19 	ntop[55776]: Searching for plugins in /usr/local/lib/ntop/plugins
    Jan 22 09:51:19 	ntop[55776]: Searching for plugins in /usr/local/lib/ntop/plugins
    Jan 22 09:51:19 	ntop[55776]: Loading Plugins
    Jan 22 09:51:19 	ntop[55776]: Loading Plugins
    Jan 22 09:51:19 	ntop[55776]: Listening on [rl0]
    Jan 22 09:51:19 	ntop[55776]: Listening on [rl0]
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: INITWEB: Started thread for web server
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677440]: INITWEB: Started thread for web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Starting web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Starting web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Waiting for HTTP connections on port 3000
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Waiting for HTTP connections on port 3000
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initialized socket, port 3000, address (any)
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initialized socket, port 3000, address (any)
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initializing TCP/IP socket connections for web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initializing TCP/IP socket connections for web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initializing web server
    Jan 22 09:51:19 	ntop[55776]: INITWEB: Initializing web server
    Jan 22 09:51:19 	ntop[55776]: SSL is present but https is disabled: use -W <https port="">for enabling it
    Jan 22 09:51:19 	ntop[55776]: SSL is present but https is disabled: use -W <https port="">for enabling it
    Jan 22 09:51:19 	ntop[55776]: Calling plugin start functions (if any)
    Jan 22 09:51:19 	ntop[55776]: Calling plugin start functions (if any)
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677184]: DNSAR(3): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683677184]: DNSAR(3): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676928]: DNSAR(2): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676928]: DNSAR(2): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676672]: DNSAR(1): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676672]: DNSAR(1): Started thread for DNS address resolution
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Started thread for idle hosts detection
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676416]: SIH: Started thread for idle hosts detection
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Started thread for fingerprinting
    Jan 22 09:51:19 	ntop[55776]: THREADMGMT[t683676160]: SFP: Started thread for fingerprinting
    Jan 22 09:51:19 	ntop[55776]: Initializing external applications
    Jan 22 09:51:19 	ntop[55776]: Initializing external applications
    Jan 22 09:51:19 	ntop[55776]: Database support not compiled into ntop
    Jan 22 09:51:19 	ntop[55776]: Database support not compiled into ntop
    Jan 22 09:51:19 	ntop[55776]: IP2CC: ...found 52395 lines
    Jan 22 09:51:19 	ntop[55776]: IP2CC: ...found 52395 lines
    Jan 22 09:51:18 	ntop[55776]: IP2CC: Loading file '/usr/local/etc/ntop/p2c.opt.table.gz'
    Jan 22 09:51:18 	ntop[55776]: IP2CC: Loading file '/usr/local/etc/ntop/p2c.opt.table.gz'
    Jan 22 09:51:18 	ntop[55776]: IP2CC: Checking for IP address <-> Country Code mapping file
    Jan 22 09:51:18 	ntop[55776]: IP2CC: Checking for IP address <-> Country Code mapping file
    Jan 22 09:51:18 	ntop[55776]: ASN: ....Used 3780 KB of memory (12 per entry)
    Jan 22 09:51:18 	ntop[55776]: ASN: ....Used 3780 KB of memory (12 per entry)
    Jan 22 09:51:18 	ntop[55776]: ASN: ...found 111435 lines
    Jan 22 09:51:18 	ntop[55776]: ASN: ...found 111435 lines
    Jan 22 09:51:17 	ntop[55776]: ASN: Loading file '/usr/local/etc/ntop/AS-list.txt.gz'
    Jan 22 09:51:17 	ntop[55776]: ASN: Loading file '/usr/local/etc/ntop/AS-list.txt.gz'
    Jan 22 09:51:17 	ntop[55776]: ASN: Checking for Autonomous System Number table file
    Jan 22 09:51:17 	ntop[55776]: ASN: Checking for Autonomous System Number table file
    Jan 22 09:51:17 	ntop[55776]: THREADMGMT[t683675904]: Now running as a daemon
    Jan 22 09:51:17 	ntop[55776]: THREADMGMT[t683675904]: Now running as a daemon
    Jan 22 09:51:16 	ntop[55775]: THREADMGMT[t683675904]: ntop RUNSTATE: INIT(2)
    Jan 22 09:51:16 	ntop[55775]: THREADMGMT[t683675904]: ntop RUNSTATE: PREINIT(1)</https></https> 
    


  • Bump? Anyone? Or is this problem documented and I've missed it?



  • i have this problem.

    any solution?

    thx.

    juanjoA



  • I'm seeing the same error.  It seems to dump when I monitor an interface that has VLAN's present.

    Idea's anyone?

    Thanks, Steve



  • I'm getting this too, and it's very sad. Please help. :(



  • Anybody?



  • I've had this problem also, from everything i've read it appears to be memory. Ntop is very very ram hungry. I would say you would need 1-2gigs of ram for 10,000 states. Don't take that for fact, i've never been able to keep ntop running for more then a couple of hours, but i always assumed i didn't have enough memory.

    The next version of ntop 3.3.9 has some fixes for low memory so it doesn't crash.



  • Thanks for the reply, but I don't think that's my problem: the machine we have has 4 gigs of memory so that pfSense will read the maximum it can handle. :(



  • @cookiecaper:

    Thanks for the reply, but I don't think that's my problem: the machine we have has 4 gigs of memory so that pfSense will read the maximum it can handle. :(

    How many states are doing? Are you tracking both local and remote hosts?



  • Ive found P2P has a huge impact on NTOP on pfsense as well and is part of the reason it crashed for me, since I banned P2P on my network and up'd more memory, I havent had a crash since.

    Slam



  • i've got the same problem, when will the update be ready for pfsense?


Log in to reply