Daemon fails to start again with 11/SEGV shortly after being stopped

[jcfarsight]

I'm currently running ntopng 3.3.171203 on my Raspberry Pi 3 Model B and want it to act as a traffic monitor. I've had success with this however I can't restart (or sometimes even start) the daemon without it going into a death loop of seg faults.

It seems to be that if the service is stopped for a long period of time then it will successfully come back up when started, however once it is stopped it won't come back up again for a prolonged period of time and will continue to cycle around crashing and restarting.

The pi is configured to act as a bridge (interface br0) across physical interfaces eth0 and eth1. I've tried listening on interface eth0 as well as br0 and they both appear to cause the same issue.

The daemon is running under the user ntopng which has read permissions to /etc/ntopng, read/write permissions to /var/log/ntopng and read/write to /var/run/ntopng.pid.

Here is a log snippet from /var/log/syslog revealing the logs between faults:

Dec 11 11:45:29 TESTSERV systemd[1]: ntopng.service: Service hold-off time over, scheduling restart.
Dec 11 11:45:29 TESTSERV systemd[1]: Stopped ntopng high-speed web-based traffic monitoring and analysis tool.
Dec 11 11:45:29 TESTSERV systemd[1]: Starting ntopng high-speed web-based traffic monitoring and analysis tool...
Dec 11 11:45:29 TESTSERV systemd[1]: Started ntopng high-speed web-based traffic monitoring and analysis tool.
Dec 11 11:45:29 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:29 [Ntop.cpp:1485] Setting local networks to 10.0.0.0/24
Dec 11 11:45:29 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:29 [Redis.cpp:111] Successfully connected to redis 127.0.0.1:6379@0
Dec 11 11:45:29 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:29 [Redis.cpp:111] Successfully connected to redis 127.0.0.1:6379@0
Dec 11 11:45:30 TESTSERV kernel: [2123955.098754] device br0 entered promiscuous mode
Dec 11 11:45:30 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:30 [PcapInterface.cpp:88] Reading packets from interface br0...
Dec 11 11:45:30 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:30 [Ntop.cpp:1612] Registered interface br0 [id: 1]
Dec 11 11:45:30 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:30 [main.cpp:301] PID stored in file /var/run/ntopng.pid
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Utils.cpp:2406] WARNING: ntopng has not been compiled with libcap-dev
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Utils.cpp:2407] WARNING: Network discovery and other privileged activities will fail
Dec 11 11:45:31 TESTSERV ntopng: [Utils.cpp:2406] WARNING: ntopng has not been compiled with libcap-dev
Dec 11 11:45:31 TESTSERV ntopng: [Utils.cpp:2407] WARNING: Network discovery and other privileged activities will fail
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Utils.cpp:457] User changed to ntopng
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [HTTPserver.cpp:912] Web server dirs [/usr/share/ntopng/httpdocs][/usr/share/ntopng/scripts]
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [HTTPserver.cpp:915] HTTP server listening on port(s) 3000,443s
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [HTTPserver.cpp:919] HTTPS server listening on port 443
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [main.cpp:383] Working directory: /var/tmp/ntopng
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [main.cpp:385] Scripts/HTML pages directory: /usr/share/ntopng
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:385] Welcome to ntopng armv7l v.3.3.171203 - (C) 1998-17 ntop.org
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:395] Built on Raspbian GNU/Linux 9.1 (stretch)
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:677] Adding 10.0.0.230/32 as IPv4 interface address for br0
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:685] Adding 10.0.0.0/24 as IPv4 local network for br0
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:704] Adding fe80::ba27:ebff:fe6c:fa8c/128 as IPv6 interface address for br0
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [Ntop.cpp:713] Adding fe80::ba27:ebff:fe6c:fa8c/64 as IPv6 local network for br0
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [PeriodicActivities.cpp:59] Started periodic activities loop...
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [PeriodicActivities.cpp:100] Each periodic activity script will use 1 threads
Dec 11 11:45:31 TESTSERV ntopng[26493]: 11/Dec/2017 11:45:31 [NetworkInterface.cpp:2326] Started packet polling on interface br0 [id: 1]...
Dec 11 11:45:31 TESTSERV kernel: [2123956.153342] device br0 left promiscuous mode
Dec 11 11:45:31 TESTSERV systemd[1]: ntopng.service: Main process exited, code=killed, status=11/SEGV
Dec 11 11:45:31 TESTSERV systemd[1]: ntopng.service: Unit entered failed state.
Dec 11 11:45:31 TESTSERV systemd[1]: ntopng.service: Failed with result 'signal'.

Contents of the configuration file /etc/ntopng/ntopng.conf:

# * Interfaces to sniff on: one interface per line, prefix with -i=
-i=br0

# * PID file to write for multi-process identification.
-G=/var/run/ntopng.pid

# * Port on which ntopng will listen for the web-UI.
-W=443

# * Flag that the 10 minute enterprise trial should be skipped and community mode entered immediately
--community=

# * Ensure only local hosts have their traffic monitored in depth
-m="10.0.0.0/24"

# * Run as the ntopng user
--user=ntopng

# * Run ntopng as a background daemon
--daemon

# * Remember local hosts even when idle
--sticky-hosts local

I noticed that there were seg faults reported in earlier 3.x releases and were fixed pending release into 3.2. Unfortunately after waiting for a new stable release to the stretch pi package feed and upgrading, it appears I still have the same issue.

[emanuele-f]

Hi, this is probably related to the sticky hosts . Please follow issue #1610