netfilter buglog - May 2012 - [Bug 789] New: ulog_ct loses outputentries

http://bugzilla.netfilter.org/show_bug.cgi?id=789

           Summary: ulog_ct loses outputentries
           Product: ulogd
           Version: SVN (please provide timestamp)
          Platform: i386
        OS/Version: Debian GNU/Linux
            Status: NEW
          Severity: major
          Priority: P5
         Component: ulogd
        AssignedTo: netfilter-buglog at lists.netfilter.org
        ReportedBy: b.laessig at tu-bs.de
   Estimated Hours: 0.0


Created attachment 384
  --> http://bugzilla.netfilter.org/attachment.cgi?id=384
Konfiguration des eingesetzten ulogd2

I am using ulogd2 to create rrd traffic statistics and many more.
I am reading from nfconntrack and dump the entries to a postgres database.
(config is attached). 
Every minute i send SIGUSR2 to ulogd to make it dump all entries in
conntrack_table to postgres database and then flush the counters.

After some weeks of running ulogd2 i discovered, that i had about 400 entries
in /proc/net/ip_conntrack but i only had 10 entries in database. I created some
test-tcp-connections, they appeared in conntrack table, but i got no entries in
postgres database. Since then i restart ulogd2 every day at 5:24. After
restarting the ulogd get all entries.

Here you can see count of entries in database before restart and after restart.
Figures before and after are approximately equal. Counters in conntrack table
are always flushed for all connections.

timestamp                  |      flow_count
2012-05-25 05:23:01.529365 |      142
2012-05-25 05:25:01.539308 |      356

I am using:
Debian Kernel 2.6.32-5-686 (i386)
ulogd2 git 4bc3b22e426db1e592071ec2853fbd81525d4a61 (5.3.2012)

-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=789

--- Comment #1 from Bj?rn L?ssig <b.laessig at tu-bs.de> 2012-05-25
10:34:35 CEST ---
using libnetfilter-conntrack3            0.9.1-1

-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.

http://bugzilla.netfilter.org/show_bug.cgi?id=789

Jan Engelhardt <jengelh at medozas.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jengelh at medozas.de
         AssignedTo|netfilter-buglog at lists.netf |pablo at netfilter.org
                   |ilter.org                   |

-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.
You are watching the assignee of the bug.

http://bugzilla.netfilter.org/show_bug.cgi?id=789

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #2 from Pablo Neira Ayuso <pablo at netfilter.org> 2012-06-09
02:39:18 CEST ---
Could you try to reproduce the problem with some text-based output plugin?

I'd like to know if this is an issue with our postgresql plugin or the NFCT
plugin itself.

-- 
Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
You are watching the assignee of the bug.