High CPU usage ntopng Package - even on idle?



  • Hello,
    I changed with version 2.4.4 from pfSense in a VM (ESXI on 2vCPU Xeon Dual-CPU) to a standalone server with an AMD GX-424CC CPU Passmark and 8 GB Ram. Intel i350-T4 card, 1 LAN, 1 WAN.

    Network is small with ~8 users not doing much network traffic except Windows RDP to a certain IP (RDS Server). I run ntopng package (0.8.13_1 = 3.4.180911) to monitor total traffic used by certain IPs.

    Since the change I wondered that the CPU usage is high in IDLE mode. When I have powerd with HIadaptive enabled it never clocks the CPU frequency down. That´s why I enabled adaptive mode where the lock down of frequency to lower states work.

    The CPU is in total always changing inbetween 5-10% CPU even when there is no traffic at all, e.g. at night. Reason is ntopng process only according to "top" in shell and all other processes run below 0.5%.

    I know that ntopng needs some CPU und promiscous mode, too that needs to be activated with ntopng but e.g. Snort is running with >0.5% and uses promiscous mode, too.

    I already tried to modify some settings in ntopng directy to lower the CPU but none of them worked.

    So can anyone tell me is the CPU in IDLE that high in general when using ntopng?



  • I experience the same since pfsense 2.4.4. Running directly on hardware. (No virtualization). CPU is on idle network utilization between 7-15%. When openening NTOP website and downloading it is climbing to 40-50%.

    I also have problems starting NTOP (from services) after trying 3-4 times its finally starting. On reboot is not starting automatically. And after a few days its crashing:

    pid 99675 (ntopng), uid 0: exited on signal 11 (core dumped)

    Right now I uninstalled NTOP. Waiting for an update....



  • @Rai80: Thanks for sharing your experience. Due to my change in system setup, can you tell me how high the average CPU idle was with notpng under 2.4.3?

    I had (have) the same problem with not instantly starting or later exiting notpng services from the beginning on. I installed watchdog so it restarts the process automatically when it exits due to an error.



  • On 2.4.3 is was about 2-5%. And with high traffic and webinterface open it was around 15-20%. After closing the webinterface it dropped to 10-15%.
    So it seems much more CPU intensive after 2.4.4. and much less stable.

    Hope there will be an update soon!



  • OK, are there any other users who can confirm this behaviour with high CPU usage of ntopng in IDLE mode? If yes, I would issue a bug in redmine.pfsense.org to examine this behaviour.

    Btw. I can`t say that ntopng is less stable under 2.4.4 but since I use watchdog I do not check anymore how often the process exits. But the problem occured already under 2.4.3 and before and as far as I read this happens under FreeBSD regularly so I live with it because it is not really an issue when watchdog restarts the process immediately.

    But the hig CPU usage is more a problem that I can`t really estimate (in comparison to 2.4.3) especially since my change of hardware with 2.4.4. Before I used XEON vCPUs and as they are more powerful the CPU usage was not an issue because the server was under a certain load anyway.



  • i had the same issue with ntopng on a virtualized server
    cpu usage went up to 60% on an i5-6200u cpu

    deleted the package and the cpu usage went back to 5-8%



  • @Jack150 Did you install ntopng under 2.4.4 or in a previous version?
    Did 60% occur during idle or load? Were you monitoring while that high CPU usage?



  • I did install ntopng under 2.4.3 but shortly after the upgrade to 2.4.4 i got the issue.
    it happend on idle and i was only watching @ system activity



  • i just did a reinstall of ntopng, it was running fine
    but after i added another port to my bridge the cpu when back up

    see screenshot of system activity:
    https://ss.dutchs.nl/n4tRP2SBq9dG.png