Re: pflogd consume CPU

[Miwa Susumu <miwarin%gmail.com@localhost>]

sorry. i'm late.

2016-02-08 1:02 GMT+09:00 Christos Zoulas <christos%astron.com@localhost>:
>>>>>>pflogd process consume CPU.
>>>>>>Because of that in load average is too high.
>>>>> Can you ktrace it?
>>>>this is kdump output.
>>>>sakura# kdump ktrace.out
>>>>   974      1 pflogd   EMUL  "netbsd"
>>>>   974      1 pflogd   CALL  read(3,0xbb912000,0x80000)
>>>>   974      1 pflogd   RET   read -1 errno 35 Resource temporarily unavailable
>>> And what does 'fstat -p 974' say about fd 3?
>>
>>fd 3 is bpf.
>>
>>% fstat -p 974
>>USER     CMD          PID   FD MOUNT       INUM MODE         SZ|DV R/W
>>_pflogd  pflogd       974 root /var      389524 drwxr-xr-x     512 r
>>_pflogd  pflogd       974   wd /var      389524 drwxr-xr-x     512 r
>>_pflogd  pflogd       974    0 /         380813 crw-rw-rw-    null rw
>>_pflogd  pflogd       974    1 /         380813 crw-rw-rw-    null rw
>>_pflogd  pflogd       974    2 /         380813 crw-rw-rw-    null rw
>>_pflogd  pflogd       974    3* bpf rec=0, dr=0, cap=0, pid=1135,
>>promisc, seesent, idle
>>_pflogd  pflogd       974    4 /var     1855883 -rw-------      24 rw
>>_pflogd  pflogd       974    5* unix stream  0xc4eda9b8 <-> 0xc4edaa08
>>
> Seems that there is a general problem with non-blocking fd's on 7.
> Can you start pflogd with ktrace or gdb and see where it is setting
> non-blocking I/O on the fd?

fd 3 is libpcap handle. in pflogd.c

    hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);

hpcap->fd is 3.

It is set to NONBLOCK in pcap_setnonblock().
but pcap_setnonblock() is not called from anywhe... hmmm


http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1447

pcap_setnonblock()
  ret = p->setnonblock_op(p, nonblock, errbuf

setnonblock_op was set pcap_setnonblock_fd() .
http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1471

-- 
miwarin