[Oisf-users] Lot of warnings with flow under 4.1beta1

Wed May 16 10:40:46 UTC 2018

On Wed, May 16, 2018 at 11:22 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
> Hi all,
>
>  I am testing 4.1beta1 release under a CentOS 7.5 host and I am seeing a lot
> of warnings with flows:
>
> 16/5/2018 -- 11:16:21 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462181, ts.tv_usec:94913)
> flow_spare_q status(): 32% flows at the queue
> 16/5/2018 -- 11:16:26 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462186, ts.tv_usec:82346)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:16:31 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462191, ts.tv_usec:93119)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:16:37 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462197, ts.tv_usec:88600)
> flow_spare_q status(): 32% flows at the queue
> 16/5/2018 -- 11:16:43 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462203, ts.tv_usec:83851)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:16:49 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462209, ts.tv_usec:95635)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:16:55 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462215, ts.tv_usec:85085)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:01 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462221, ts.tv_usec:101711)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:07 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462227, ts.tv_usec:82684)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:12 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462232, ts.tv_usec:84280)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:18 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462238, ts.tv_usec:85470)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:25 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462245, ts.tv_usec:89824)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:31 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462251, ts.tv_usec:81384)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:37 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462257, ts.tv_usec:103593)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:43 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462263, ts.tv_usec:89000)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:49 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462269, ts.tv_usec:87872)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:17:54 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462274, ts.tv_usec:87745)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:00 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462280, ts.tv_usec:85263)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:06 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462286, ts.tv_usec:86075)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:11 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462291, ts.tv_usec:90606)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:17 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462297, ts.tv_usec:90824)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:23 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462303, ts.tv_usec:86891)
> flow_spare_q status(): 32% flows at the queue
> 16/5/2018 -- 11:18:28 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462308, ts.tv_usec:91294)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:33 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462313, ts.tv_usec:81452)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:38 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462318, ts.tv_usec:87690)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:44 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462324, ts.tv_usec:83974)
> flow_spare_q status(): 32% flows at the queue
> 16/5/2018 -- 11:18:50 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462330, ts.tv_usec:84077)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:18:55 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462335, ts.tv_usec:83732)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:19:00 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462340, ts.tv_usec:92671)
> flow_spare_q status(): 31% flows at the queue
> 16/5/2018 -- 11:19:06 - <Info> - Flow emergency mode over, back to normal...
> unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1526462346, ts.tv_usec:82626)
> flow_spare_q status(): 31% flows at the queue
>
>  Do I need to do some tuning with flows?
>
> Thanks.

It seems the engine enters emergency mode.
Was the flow config section insuricata yaml the same as before you
upgraded to 4.1beta1?

Thank you

-- 
Regards,
Peter Manev