I did some extra test, which show diffrenece on P4 2.8G with the transfer rate 100Mbit/s between iptables chains couters and ulogd logemu records - 2% - seems it's ulogd misses, not netlink subsystem, and it's directly depends on the ulogd processing load - db inserts are slow... Do you think it's fixable in viewable future atleast on the ulog level, that we know what amount of data we have missed? On Sunday 11 May 2008 21:18, Eric Leblond wrote: > Hello, > > On Saturday, 2008 May 10 at 17:50:37 +0500, Anton wrote: > > Something wrong quite definitelly, > > in 700Mb of the data it logs only 43Mb > > I've done some test on my system and I've got similar > results. Sole difference is the ratio between logged > packets and unlogged packets. > > I've downloaded a 48Mo at a rate of 348.28K/s and I have > the following result : > Iptables : 33625 packets, 50383786 bits > Ulogd2 : 33272 packets 49856076 bits > > As usual, size does not matter. The problem is due to > some packets not being loggued. It recall me results of > Pablo's conntrackd benchmark. After a given rate, the > netlink subsystem is not able to transmit messages. > > IMHO, the main issue is that the lost (or the overrun) > does not seem to be logged somewhere. > > BR, -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
