Understanding the Sniffer's Performance Log

Messages from GNU GPL sniffer sensor service

Voipmonitor by default uses 'daemon' facility of syslog to store status messages. By default it is stored to **/var/log/syslog**(debian/ubuntu) or to **/var/log/messages**(centos/rh)

You can find useful to store status info from voipmonitor to different file: For rsyslog use this in /etc/rsyslog.conf

if $programname == 'voipmonitor' and $syslogseverity <= '7' then /var/log/voipmon.log
& ~

==

status line in a detail

SQLq

C=CDR_queue 
M=Message_queue
R=Register_queue
L=LiveSniffer_queue
Cl=Cleanspool queue

tarQ

number of files in a queue

tarB

MBs in tar buffer

tarCPU

threads used for taring - its consumption

t2CPU

pb:10.5/	- packetbuffer - out of the buffer
d:39.2/		- structs create for processing in t2
s:24.6/		- SIP - parse
e:17.3/		- SIP - calls/messages search, struct creation
c:6.8/		              - process_packets - calls/messages
g:6.4/                       - process_packets - registers
r:7.3/		              - process_packets - RTP

rm:24.6/	- packets shift, prepare for processing
rh:16.7/	- RTP - search hash
rd:19.3/	- RTP - move to read queue

Adding new thread is automatic

'd' is running after pb,
if 'd' > 50%, new thread 's' (reasembles, sip parse) 
if 's' > 50%, new thread 'e' (callid seach + structs create for calls), 
if 'e' > 50%, new thread 'c' (calls)
if 'c' > 50%, new thread 'g' (registers)
if 'g' > 50%, new thread 'r' (rtp)

Threads removing

if 'r' < N remove 'r' 
if 'g' < N remove 'g' 
if 'c' < N remove 'c'
if 'e' < N remove 'e'
if 's' < N remove 's'