Re: pflogd consume CPU

[Miwa Susumu <miwarin%gmail.com@localhost>]

hi.

2016-03-05 1:20 GMT+09:00 Miwa Susumu <miwarin%gmail.com@localhost>:
>>>>>>>pflogd process consume CPU.
>>>>>>>Because of that in load average is too high.
>>>>>> Can you ktrace it?
>>>>>this is kdump output.
>>>>>sakura# kdump ktrace.out
>>>>>   974      1 pflogd   EMUL  "netbsd"
>>>>>   974      1 pflogd   CALL  read(3,0xbb912000,0x80000)
>>>>>   974      1 pflogd   RET   read -1 errno 35 Resource temporarily unavailable
>>>> And what does 'fstat -p 974' say about fd 3?
>>>
>>>fd 3 is bpf.
>>>
>>>% fstat -p 974
>>>USER     CMD          PID   FD MOUNT       INUM MODE         SZ|DV R/W
>>>_pflogd  pflogd       974 root /var      389524 drwxr-xr-x     512 r
>>>_pflogd  pflogd       974   wd /var      389524 drwxr-xr-x     512 r
>>>_pflogd  pflogd       974    0 /         380813 crw-rw-rw-    null rw
>>>_pflogd  pflogd       974    1 /         380813 crw-rw-rw-    null rw
>>>_pflogd  pflogd       974    2 /         380813 crw-rw-rw-    null rw
>>>_pflogd  pflogd       974    3* bpf rec=0, dr=0, cap=0, pid=1135,
>>>promisc, seesent, idle
>>>_pflogd  pflogd       974    4 /var     1855883 -rw-------      24 rw
>>>_pflogd  pflogd       974    5* unix stream  0xc4eda9b8 <-> 0xc4edaa08
>>>
>> Seems that there is a general problem with non-blocking fd's on 7.
>> Can you start pflogd with ktrace or gdb and see where it is setting
>> non-blocking I/O on the fd?
>
> fd 3 is libpcap handle. in pflogd.c
>
>     hpcap = pcap_open_live(interface, snaplen, 1, PCAP_TO_MS, errbuf);
>
> hpcap->fd is 3.
>
> It is set to NONBLOCK in pcap_setnonblock().
> but pcap_setnonblock() is not called from anywhe... hmmm
>
>
> http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1447
>
> pcap_setnonblock()
>   ret = p->setnonblock_op(p, nonblock, errbuf
>
> setnonblock_op was set pcap_setnonblock_fd() .
> http://nxr.netbsd.org/xref/src/external/bsd/libpcap/dist/pcap.c#1471

in bpf_open(), open(2) returns descriptor, it have O_NONBLOCK bit.
There is a case to be so. then, consume CPU.

However, open in bpf, not process set NONBLOCK.
http://nxr.netbsd.org/xref/src/sys/net/bpf.c#437

it's function call tree:

main (pflogd)
  init_pcap  (pflogd)
    pcap_open_live  (libpcap)
      pcap_activate_bpf  (pcap-bpf.c)
        bpf_open  (pcap-bpf.c)
          open  <---- open return descriptor, it have NONBLOCK, in rare cases.

-- 
miwarin