I have a similar problem (EFW 2.5.1).
The NTOP error is:
Tue May 7 12:02:45 2013 **WARNING** RRD: [path=/var/ntop/rrd/interfaces/eth0][error=13/Permission denied]
Tue May 7 12:02:45 2013 **WARNING** RRD: mkdir(/var/ntop/rrd/interfaces/eth0/), error 13 Permission denied
Tue May 7 12:02:45 2013 **WARNING** RRD: rrd_create(/var/ntop/rrd/interfaces/eth0/knownHostsNum.rrd) error: creating '/var/ntop/rrd/interfaces/eth0/knownHostsNum.rrd': Permission denied
Tue May 7 12:02:45 2013 **WARNING** RRD: rrd_update(/var/ntop/rrd/interfaces/eth0/knownHostsNum.rrd) error: opening '/var/ntop/rrd/interfaces/eth0/knownHostsNum.rrd': Permission denied
Tue May 7 12:02:50 2013 **WARNING** RRD: [path=/var/ntop/interfaces/eth0][error=13/Permission denied]
Tue May 7 12:02:50 2013 **WARNING** RRD: mkdir(/var/ntop/interfaces/eth0/), error 13 Permission denied
I'm not using eth0 at all, only eth1 and eth2.
