Ntop reaching max sessions then stops logging [solved]

[njcwotx]

I have been running ntop for about a year now on the company network, its helped me solve many issues. I never had any trouble, but I recently re-emerged world and updated all libraries and went to the newest version of gcc. Ntop upgraded to version 3.2.

My trouble is that before this, I could run without modifying the -X or -x (--max-sessions) option. By default 32768 has worked fine. However, I started to get an error in the log that says I have reached my max-sessions. By changing to 65535 it will last a couple of days.

Before this, I could run with -c (--sticky-hosts) and never run out of sessions after several weeks without trouble. Now, it fails withing a few hours on default and a couple of days if I double it.
_________________
Drinking from the fountain of knowldege.
Sometimes sipping.
Sometimes gulping.
Always thirsting.

[njcwotx]

Here is what I came up with....

Version 3.0 would set --disable-instantsessionpurge set to a default of 'No'
Version 3.2 sets the same setting to 'yes' and there is no way to change it back to 'no'

I had been using the -c sticky hosts option previously and the combination of -c and --disable-instantsessionpurge did not mix well.

I also had a new system installed that does hundreds/thousands of small sessions withing small timeframes.

From what I got back from the ntop mailing list, is that ntop only purges so many sessions at a time.

So when I went to the new version, my -c, the new app, the change of --disable-instantsessionpurge to a default of yes (with no way to change back) and the way ntop clears sessions all combined to crash ntop.

To resolve:
I found that by not using the -c sticky hosts it relieves the pressure on the sessions not being cleared fast enough. Changing the instant session purge option may have helped if I could change that back, also there is another flag to disable session tracking altogether, but I did not try it as session tracking is useful to me (-z).
_________________
Drinking from the fountain of knowldege.
Sometimes sipping.
Sometimes gulping.
Always thirsting.