flowd_aggregate (Insight Aggregator) stopping constantly. Is this normal?

[nigelw]

I finally got around to setting up Monit monitoring for the flowd_aggregate service. I've wanted to do this because I often find when I go to the Dashboard that the service has stopped. I'm now getting spammed by monit because it's constantly picking up the service down and restarting it.

I've noticed a pattern, though. The 'down' detections seem to happen on the hour - almost every hour. This has led me to question whether the flowd_aggregate is even supposed to stay running? Does anyone have any information on that? Am I monitoring something as a 'failure' when it's 'by design'??

Also, I've had issues with flowd_aggregate in the past with logs created because of crashes. There are no logs this time (other than monit, and the vacuum messages after restart).

[AdSchellevis]

It should stay active, so probably the daemon crashed somewhere half way. If this happens very frequently, it might be good to collect some metrics about what's going on there.

The system log may already contain some info,  but if you can keep a console open until it crashes, it might be worth dumping the output of the following commands (which in your case likely crashes in an hour or so).

Code: [Select]

# service flowd_aggregate stop
# /usr/local/opnsense/scripts/netflow/flowd_aggregate.py --console

(this first command should stop the daemon, the next one start it up again in a console without detaching).

Best regards,

Ad

[nigelw]

Will do this and report. Thanks.

[roylaprattep]

You did find solution for this issue? I am having the same problem.