From owner-freebsd-questions@FreeBSD.ORG Tue Oct 27 13:54:37 2009 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 00E6B106568B for ; Tue, 27 Oct 2009 13:54:37 +0000 (UTC) (envelope-from paul.halliday@gmail.com) Received: from mail-gx0-f218.google.com (mail-gx0-f218.google.com [209.85.217.218]) by mx1.freebsd.org (Postfix) with ESMTP id B5D878FC18 for ; Tue, 27 Oct 2009 13:54:36 +0000 (UTC) Received: by gxk10 with SMTP id 10so729890gxk.3 for ; Tue, 27 Oct 2009 06:54:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=fwg+/nvbf6FzlhiQy/KuLQY8XBU86YnJTHptlKBlhsM=; b=GS+j4ylpUEjZkseG6lKU6Omix1u1v8X8QRR1oTLpYEfxEv19g0fxrZYVkKLddCQ11B wdqLigE2oRqQQMp0+m5vmR1jZoFuWN1S9zexXf0+2ckpoHrhq3M5nSJr4je2FeMBEwD9 roPxyWpApN7nwVvtuqEtXnS/fmPG39bRl/a7I= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=X7nKq/yaDsSeN5dk79ShY6453r7ApQzcm1n3TaNG1HE56Da7Ijy6/mBJLTS7xIsSN2 G+xkZTasUis/LyRlmVg8k8aWEvr+XPeZ1+IW0tT5rfx3s0MNwYtwyac3fVisN929ARBl 6FpX2I9GF1lSabgbjLJu7I6xo9TG3lqx4kb6Q= MIME-Version: 1.0 Received: by 10.150.17.5 with SMTP id 5mr97585ybq.195.1256651675898; Tue, 27 Oct 2009 06:54:35 -0700 (PDT) Date: Tue, 27 Oct 2009 10:54:35 -0300 Message-ID: <2dab70a30910270654j79c3627bp2f2af88894dce2f2@mail.gmail.com> From: Paul Halliday To: questions@freebsd.org Content-Type: text/plain; charset=ISO-8859-1 Cc: Subject: Re: Looking for troubleshooting tips. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Oct 2009 13:54:37 -0000 I shift deleted my inbox and lost all of the original replies :( anyway... I have another sensor that just started to exhibit this same behavior. This time though, I have some more info: swap_pager_getswapspace(4): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(16): failed swap_pager_getswapspace(2): failed pid 75157 (flow-report), uid 1001, was killed: out of swap space What made me notice this time was the zabbix (http://www.zabbix.com/) agent on this host kept bumping online/offline. So it looks like we are loaded enough to affect other processes as well. Is this just a matter of adding more ram? Or do I increase the swap space? Or is there another issue here; I have never ran out of swap space before? Thanks. On Wed, Oct 21, 2009 at 9:58 AM, Paul Halliday wrote: > I use Freebsd as the base for my network monitoring sensors. These > machines run a netflow probe, act as a netflow collector and spool > full content data from a snort process FIFO that is bound to a span > port. During peak hours this can be 100MB saturated, its connected to > a GB intel NIC on the box (there is a separate uplink). > > In the background numerous little scripts run to produce summary data. > The basic template for these systems has been the same for the past 4 > years and things have worked great. Recently, one of these machines > started to become a little laggy and I can't seem to identify the > issue. > > This system has always seen a lot of packet loss, I expect this though > as it is a busy site but this has never affected its performance. Can > an overloaded NIC cause serious performance issues like those I am > seeing? > > This is a recent top: > > last pid: 98870; load averages: 1.54, 1.41, 1.31 up 1+01:57:10 > 11:50:24 > 142 processes: 2 running, 139 sleeping, 1 zombie > CPU states: 30.9% user, 0.0% nice, 15.0% system, 1.7% interrupt, 52.4% > idle > Mem: 450M Active, 328M Inact, 168M Wired, 33M Cache, 110M Buf, 3700K Free > Swap: 2048M Total, 5112K Used, 2043M Free > > 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 > > To be honest, I don't know which counters are important. Is there > anything specific I should be concentrating on to determine the cause? > > Thanks. >