Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sampling rate option of nProbe is not working properly #572

Open
ioesoft opened this issue Mar 31, 2023 · 4 comments
Open

Sampling rate option of nProbe is not working properly #572

ioesoft opened this issue Mar 31, 2023 · 4 comments

Comments

@ioesoft
Copy link

ioesoft commented Mar 31, 2023

Even after upgrading nProbe to the latest version(10.3.230302), the memory issue still remains.
So, alternatively, I'm trying to use the sampling rate option(-S="10:1:1") in order to reduce the memory usage.
But, sampling rate is not working properly.
I'm expecting that the Rx/Tx should be the same as before even though nProbe throughput will be reduced to 1/10.
However, the Rx/Tx is increasing almost by 100 times after setting "sample rate" option to "10:1:1".
Do you have any idea about this issue?

Here is the configuration of our nprobe.conf:
-I=nProbe
--zmq="tcp://192.168.0.X:5556"
--zmq-probe-mode
-i=enp3s0
-n=none
-T="@ntopng@"
-b=1
-f="ip proto not 50"
-S="10:1:1"

@ioesoft
Copy link
Author

ioesoft commented Apr 3, 2023

For more details, I'm attaching the historical chart for Rx/Tx after applying the sample rate to 10:1:1.

그림1

@lucaderi
Copy link
Member

lucaderi commented Apr 3, 2023

This is the format [--sample-rate|-S] <pkt rate>:<flow collection rate>:<flow export rate>

As you are collecting packets you need to use -S "10:1:1" as you did. However, from the report, it is unclear if you are using PF_RING. Can you please check that and report it?

Furthermore have run a few tests and everything seems to work. The difference between our lab and you is that you are capturing a lot of traffic without ZC. I have the feeling that you have severe drops. In this case sampling can screw up everything, So I suggest you check drops (add -b=1) and then eventually apply -S. If you do not want to use ZC, please at least enable RSS.

@ioesoft
Copy link
Author

ioesoft commented Apr 4, 2023

I think that we are using PF_RING. Here is the result for command "pf_ringctl status".
image

Regarding RSS, Is the following showing that RSS was enabled properly?
** FYI, we installed the ZC drivers but we don't use ZC for now.

[root@NHFutures_YD_TAS ~]# pf_ringcfg --list-interfaces
Name: eth0 Driver: tg3 RSS: 1 [Linux Driver]
Name: eth1 Driver: tg3 RSS: 1 [Linux Driver]
Name: eth2 Driver: tg3 RSS: 1 [Linux Driver]
Name: eth3 Driver: tg3 RSS: 1 [Linux Driver]
Name: eth4 Driver: igb RSS: 8 [Supported by ZC]
Name: eth5 Driver: igb RSS: 8 [Supported by ZC]
Name: eth6 Driver: igb RSS: 8 [Supported by ZC]
Name: eth7 Driver: igb RSS: 8 [Supported by ZC]

[root@NHFutures_YD_TAS ~]# ethtool -i eth5
driver: igb
version: 5.6.0-k
firmware-version: 1.63, 0x8000105f, 1.2836.0
expansion-rom-version:
bus-info: 0000:37:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

@ioesoft
Copy link
Author

ioesoft commented Apr 4, 2023

Even in the test environment at my office(very small traffic), the sample rate is not working properly. Rx/Tx traffic shows 10 times more than before changing the sample rate to "10:1:1". Doesn't it have the same values?

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants