Troubleshooting
Problem
In the KTAP dropped report some traffic is being dropped. In the buff usage monitor report 'nondb-sql' traffic is being captured.
EXAMPLE:
From the ktap_stat.log, seeing there are packets dropped by KTAP:
----- /usr/local/guardium/modules/STAP/11.3.0.0_r110195_1-1632231477/../../..//modules/KTAP/11.3.0.0_r110195_1-1632231477/guard_ktap_stat get /dev/ktap_110195 -----
KTAP Version 11.3.0.0_r110195_v11_3_1
Number of KTAP buffer 1
buffer 0:
total packets so far = 72507082
total 0-16 bytes packets so far = 6994901
total 16-4k bytes packets so far = 54798377
total 4k-16k bytes packets so far = 2096974
total 16k-32k bytes packets so far = 0
total 32k+ bytes packets so far = 8616208
total packet drops so far = 928025
priority packet drops so far = 441856
total bytes so far = 3794115130
total bytes dropped so far = 402526379
items in queue = 3
total buffer init = 0
free requests = 128
maximum concurrent requests = 128
khash entry count = 6619
ioctl requests = 0
time since last reset in seconds = 198592
ktap buffer size = 4194304
ktap started = 1
----- /usr/local/guardium/modules/STAP/11.3.0.0_r110195_1-1632231477/../../..//modules/KTAP/11.3.0.0_r110195_1-1632231477/guard_ktap_stat get /dev/ktap_110195 -----
KTAP Version 11.3.0.0_r110195_v11_3_1
Number of KTAP buffer 1
buffer 0:
total packets so far = 72507082
total 0-16 bytes packets so far = 6994901
total 16-4k bytes packets so far = 54798377
total 4k-16k bytes packets so far = 2096974
total 16k-32k bytes packets so far = 0
total 32k+ bytes packets so far = 8616208
total packet drops so far = 928025
priority packet drops so far = 441856
total bytes so far = 3794115130
total bytes dropped so far = 402526379
items in queue = 3
total buffer init = 0
free requests = 128
maximum concurrent requests = 128
khash entry count = 6619
ioctl requests = 0
time since last reset in seconds = 198592
ktap buffer size = 4194304
ktap started = 1
stap_logs.log
2022.12.16 00:11:08 xxx.xxx.xxx.xxx:0, 1: Not enough space in the S-TAP buffer!!
2022.12.16 00:11:08 xxx.xxx.xxx.xxx:0, 1: Not enough space in the S-TAP buffer!!
snif_nanny_messages.txt.
no segfaults found sniffer did not crash.
Not seeing where sniffer was restarting...Doesn't appear anything wrong on the sniffer side...
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"ARM Category":[{"code":"a8m0z0000001h07AAA","label":"STAP-\u003EK-TAP"}],"ARM Case Number":"TS011593433","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
09 August 2023
UID
ibm17024932