NTOP auto stop by iteself

[Guest]

[CTR]

Anyone faced this in 2.5 as well?

NTOP service stopping by itself and will need manual restart via SSH.

[shairozan]

I've run into the same issue. Apparently there was historically an issue with the EFW involving NTOP running on the https port:

old.nabble.com/NTOP-problems-td25299173.html

As such, I went through a lot of work to modify the existing 2.5.1 configuration to use http as a port. When using http, NTOP would stay alive much longer, but would eventually die. My problem is that I cannot find any ntop specific logs on the system, and the monit log in /var/logs provides no useful information. I'm currently running ntop in non-daemon mode to determine what is causing it to die.

[shairozan]

Ironically, I have had no problem when manually invoking the program and NOT running it in daemon mode. Invoking it with :

Code:

ntop --user ntop --db-file-path /var/ntop --interface br0 --trace-level 3 --https-server 0 --http-server 3001 --disable-schedyield --no-fc 

Has had it running for quite a while without any issues. Of course you'll want to specify any other interfaces you want monitored besides the bridge. You just access it with http as opposed to https

[jeremycald]

Thanks for noting this.  I too have been trying to use ntop with continued shutdowns withing seconds of starting it.  I rebooted the server and now it lasts ~1 minute before the interface stop responding.

[kashifmax]

Also try this 
ntop -d -L -u ntop -P /var/ntop --skip-version-check --use-syslog=daemon

[riaanjvr]

Have this issue since version 2.5; and it also happens on the commercial version of Endian. I also see on the web it is happening on other linux distro's as well. Endian blames ntop itself. Maybe its time for something else.

[netruner]

I have this same issue. I use endian firewall 2.5.1 and I had the 1 minute crash at ntop startup to make things a bit better
I deleted the /var/ntop/ *.db and changed in the /etc/init.d/ntop the option field to enable http port at 3001 instead of https port.

Then I get crash every day  but during many hours I can use ntop.


Endian firewall blaming ntop  for this bug I would say it is true well known and well documented bug of ntop version 3.2 and 3.3.

Can I update ntop on my own? since the linux below endian firewall don't have any package management tools and since the provided linux is a custom brand well I would say I can't do anything.

Last endian firewall version was more than a year ago and ntop today in in version 5.0.1...

We find a ntop 3,3 in endian firewall 2.5.1 because they use an old linux version with old libraries and the dependencies of the new ntop will force them to put up to date the whole linux distribution (kernel, linux-base libs, apache, ntop, etc...)

So yes endian firewall use a deprecated linux and deprecated tools full of bugs and they don't tend to put their product up to date.

Is the commercial version is better suited than the abandonned free one? I hope so ... but can't tell.

Endian Firewall free version is abandonned since the actual endian 4i doesn't mention any further free or community version. They don't mention that they use free software for their endian 4i which is a LGPL infrigement but .. who cares ? Since it's free no one can complain right?

For me endian community version was an advertising purpose to sell ready to deploy all in one firewall.

I will try the suggested work around disabling the deamon mode of ntop and see how it works.