Hello, What will happen when the system load is very high, and flowd can''t process incomming flows? will these flows be dropped? If they are dropped, is there a way to discover how many flows are dropped? greetings, gijs
Gijs Molenaar wrote:> Hello, > > What will happen when the system load is very high, and flowd can''t > process incomming flows? will these flows be dropped? If they are > dropped, is there a way to discover how many flows are dropped?There is a small kernel-maintained input queue where some will be stored if flowd can''t keep up, after that they are dropped, but if the system load is too high for something light like flowd then this will fill up pretty quickly. You can figure out if there have been drops by looking at "flow_sequence" in the FLOW_ENGINE_INFO section (obviously you have to direct flowd to store it). -d
Damien Miller wrote:> There is a small kernel-maintained input queue where some will be stored > if flowd can''t keep up, after that they are dropped, but if the system > load is too high for something light like flowd then this will fill up > pretty quickly. > > You can figure out if there have been drops by looking at > "flow_sequence" in the FLOW_ENGINE_INFO section (obviously > you have to direct flowd to store it).Sorry for the late reply, I was busy with a lot of other projects. Wouldn''t it be a nice feature to be build in to flowd? For example ipflow and flow-tools will log how many flows are dropped to syslog. I don''t exactly know how they determine this. I understand and totally respect the minimalistic approach of the flowd philosophy (only dump logs fast), but isn''t this something that flowd should do? gr, gijs