Forums

Resolved
0 votes
I am trying to track internet usage for billing, as something is not adding up. I saw a lot of suggestions to try NTOP, and I installed it using:

yum --enablerepo=clearos-epel install ntop

But it seems to be failing with these errors:

Tue Jul 28 17:25:31 2015 **ERROR** INITWEB: binding problem - 'Bad file descriptor'(9)
Tue Jul 28 17:25:31 2015 Check if another instance of ntop is running
Tue Jul 28 17:25:31 2015 or if the current user (-u) can bind to the specified port
Tue Jul 28 17:25:31 2015 **FATAL_ERROR** Binding problem, ntop shutting down...
Tue Jul 28 17:25:31 2015 CLEANUP[t140356502747456]: ntop caught signal 2 [state=2]
Tue Jul 28 17:25:31 2015 ntop is now quitting...

I did see some earlier thread noting the EPEL version had a problem but I could not find the resolution.

Is this the right tool for me to pursue? And what is the issue above?

Thanks,
Drew
Tuesday, July 28 2015, 10:40 PM
Share this post:
Responses (11)
  • Accepted Answer

    Thursday, July 30 2015, 01:26 PM - #Permalink
    Resolved
    0 votes
    Fantastic! Thanks Nick!

    And thanks Tony, this is all just what I needed!

    BR
    Drew
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, July 30 2015, 12:23 PM - #Permalink
    Resolved
    0 votes
    To reset the database google "man vnstat". To change the day you want for the first day of your billing period, google "man vnstat.conf" and look at the MonthRotate parameter.
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, July 30 2015, 11:59 AM - #Permalink
    Resolved
    0 votes
    Guys,

    Thanks to all! I tried to start and stop NTOP with no luck; always is dead. But I did try vnstat and it works great! So I am happy to stick with that, thanks Tony! Can you or someone answer:

    - How do I reset vnstat to zero, I am trying to monitor over my billing period, which is unfortunately not a calendar month
    - I uninstalled NTOP like this:
    chkconfig ntop off
    rpm -e ntop

    Is that all I have to do? I know it uses a lot of overhead,

    Regards!
    Drew
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, July 30 2015, 11:41 AM - #Permalink
    Resolved
    0 votes
    Try "service ntop stop" then "service ntop status". If you get the same error message, look for the pid file (probably in /var/run, but you can inspect the init script to see) and delete it then try the status again. If that clears the error, start ntop and check the status. If it fails again you have a different problem.
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, July 30 2015, 11:28 AM - #Permalink
    Resolved
    0 votes
    Thanks Tony!

    Yes, I can see that redirect now, thanks.

    I seem to have a different problem with NTOP. I tried the listening command you gave and saw nothing. I then found when I do a "service ntop status" I get:

    ntop dead but subsys locked

    I even rebooted and got the same. Any idea why it might not be running?

    I can try vnstat now also.
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, July 30 2015, 01:52 AM - #Permalink
    Resolved
    0 votes
    The way it seems to work is the first time it runs you can access on http: port 3000
    or https: port 3001 on any of the server's addresses so you can configure. After that
    initial run it will only open ports as per /etc/ntop.conf. You missed that opportunity as
    a result of the start/stop problems. At least that's the way it appeared to me.

    However all is not lost. Just edit /etc/ntop.conf manually. Mine is below. As you can
    see I only allow https: access on one address and only local for http:

    [root@violetta ~]# cat /etc/ntop.conf
    # tells ntop the user id to run as
    --user ntop

    #save messages into the system log
    --use-syslog=daemon

    # sets the directory that ntop runs from
    --db-file-path /var/lib/ntop

    # the amount and severity of messages that ntop will put out
    --trace-level 3

    # limit ntop to listening on a specific interface and port
    --http-server 127.0.0.1:3000 --https-server 192.168.3.27:3001

    # disables "phone home" behavior
    --skip-version-check=yes

    [root@violetta ~]# netstat -nlp | grep 300
    tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN 3363/ntop
    tcp 0 0 192.168.3.27:3001 0.0.0.0:* LISTEN 3363/ntop
    [root@violetta ~]#

    Restart after the edit...

    http://www.sraellis.tk/master.php?topic=vnstat_installv7 now re-directs to a different machine
    Is it working for you now?
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, July 29 2015, 04:22 PM - #Permalink
    Resolved
    0 votes
    Thanks Tony!

    I modified as noted and can now start and stop the script as expected. Great! However, I don't know how to get output. I thought I was supposed to browse to http://serveraddress:3000 or https://serveraddress:3001 but doing either just causes the browser to hang. Any thoughts?

    BR
    Drew
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, July 29 2015, 04:20 PM - #Permalink
    Resolved
    0 votes
    Hi Tony,

    The link you sent appears to be dead...

    Drew

    Tony Ellis wrote:

    Drew, It is a few years since I installed ntop - so am not familiar with any present problems
    and no longer use it, though if I have time will give it a go...

    However, another program you might like to consider is vnStat and a php frontend that will
    integrate with the web-server.

    Instructions are at "http://danda.poweredbyclear.com/master-frame-vnstat.html"

    Examples of output can be found by clinking on "Click here" for the systems in the left-hand
    frame and then clicking on "vnStat with vnStat PHP frontend"
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, July 29 2015, 04:05 AM - #Permalink
    Resolved
    0 votes
    OK - the problem is with /etc/rc.d/init.d/ntop - at least on my systems. I assume
    it will be the same on all ClearOS 6.6...

    It's looking for the pidfile in the wrong location and not finding it thinks it is
    not running and hence no need to stop...

    Just edit /etc/rc.d/init.d/ntop to look like this extract

    ...
    # Source function library.
    . /etc/rc.d/init.d/functions

    # Path to the ntop program
    prog=ntop
    ntop=/usr/sbin/$prog
    #pidfile=/var/run/$prog.pid
    pidfile=/var/lib/$prog/$prog.pid
    config=/etc/ntop.conf


    start() {
    ...

    This was checked using the i686 version - will check if the 64-bit version has the same problem...

    EDIT: 64-bit version requires the same fix
    Note you can also edit /etc/ntop.conf to setup which ports and protocol (http or https) for access
    as well as using the online configuration
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, July 29 2015, 03:40 AM - #Permalink
    Resolved
    0 votes
    OK - installed ntop and used the instructions at "https://www.howtoforge.com/installing-and-configuring-ntop";

    All went OK - except for one problem which seems to relate to what you experienced...

    # service ntop stop
    # service ntop restart

    do not work - I had to use

    # pkill ntop
    # ntop start

    This would seem to explain your problem of an existing process when trying to start another.
    Maybe a problem with /etc/rc.d/init.d/ntop or /usr/sbin/ntop ?
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, July 29 2015, 03:04 AM - #Permalink
    Resolved
    0 votes
    Drew, It is a few years since I installed ntop - so am not familiar with any present problems
    and no longer use it, though if I have time will give it a go...

    However, another program you might like to consider is vnStat and a php frontend that will
    integrate with the web-server.

    Instructions are at http://www.sraellis.tk/master.php?topic=vnstat_installv7

    Examples of output can be found by clinking on "Click here" for the systems in the left-hand
    frame and then clicking on "vnStat with vnStat PHP frontend"
    The reply is currently minimized Show
Your Reply