From owner-freebsd-performance@FreeBSD.ORG Wed Jul 26 01:04:30 2006 Return-Path: X-Original-To: freebsd-performance@freebsd.org Delivered-To: freebsd-performance@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0130116A4DE for ; Wed, 26 Jul 2006 01:04:30 +0000 (UTC) (envelope-from owensr@comcast.net) Received: from alnrmhc11.comcast.net (alnrmhc14.comcast.net [206.18.177.54]) by mx1.FreeBSD.org (Postfix) with ESMTP id D13B443D5D for ; Wed, 26 Jul 2006 01:04:15 +0000 (GMT) (envelope-from owensr@comcast.net) Received: from desky64 (c-69-243-17-124.hsd1.va.comcast.net[69.243.17.124]) by comcast.net (alnrmhc14) with SMTP id <20060726010414b140046su1e>; Wed, 26 Jul 2006 01:04:14 +0000 Message-ID: <000701c6b04f$70c9b4d0$0501a8c0@desky64> From: "Raymond Owens" To: Date: Tue, 25 Jul 2006 21:04:25 -0400 MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0003_01C6B02D.E94A5EE0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2869 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869 X-Mailman-Approved-At: Wed, 26 Jul 2006 01:57:33 +0000 X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Subject: question concerning proper usage of kernel variables net.bpf.bufsize and vm_kmem_size_max X-BeenThere: freebsd-performance@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Performance/tuning List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2006 01:04:30 -0000 This is a multi-part message in MIME format. ------=_NextPart_000_0003_01C6B02D.E94A5EE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable System: Dell 2850 dual dual-core 3 Ghz Xeon processors FreeBSD 6.1 amd64=20 6Gb Ram Problem: System crashes when net.bpf.bufsize kernel variable is altered to value = above 67Mb Situation: Box performs packet capture using Bro IDS application. It was seen that = the larger the net.bpf.bufsize variable was made the more traffic that = was captured. Unfortunately when the net.bpf.bufsize and = net.bpf.maxbufsize variables exceed certain limits, the box immediately = crashes sometimes rebooting sometimes falling to single user mode. There = are a number of identical systems and the precise value at which this = crash occurs varies, one box crashes when the variable is set to over = 8Mb, others can be set successfully to 67Mb. Crash logs seem to = consistently give messages that 'kmem_map too small'. The = 'VM_KMEM_SIZE_MAX' variable is set by default apparently to 400Mb. Questions: Is there a limit to the value that net.bpf.bufsize and = net.bpf.maxbufsize can be set to? Is there a limit to the value that VM_KMEM_SIZE_MAX can be set to? Can VM_KMEM_SIZE_MAX be set manually with sysctl? Will increasing the value of VM_KMEM_SIZE_MAX have any chance of = preventing the crash? Thanks ------=_NextPart_000_0003_01C6B02D.E94A5EE0--