box / memsniff Goto Github PK

A tool for recording and displaying statistics on memcached traffic written in golang.

License: Apache License 2.0

Go 99.56% Makefile 0.44%

memsniff's Introduction

Memsniff

Memsniff displays the busiest keys being retrieved from your memcache server. It has been inspired by the earlier mctop and memkeys tools.

Like its predecessors, memsniff listens to network traffic and identifies responses to get requests, and is usually run directly on a memcache server host.

You can see our announcement here.

Installation

Before building you'll need to have the libpcap library and headers installed.

On Redhat-based distributions:

# yum install libpcap-devel

Or on Debian-based distributions:

# apt-get update && apt-get install libpcap-dev

Memsniff uses the standard golang toolchain, which makes installation simple. Once you have the toolchain installed and $GOPATH pointed to your working directory:

$ go get github.com/box/memsniff
$ go build github.com/box/memsniff

You will find a compiled binary at $GOPATH/bin/memsniff, ready to be transferred to your Memcache hosts or packaged in your distribution's preferred format.

Usage

On most operating systems memsniff requires superuser privileges to capture network traffic from an interface, which you specify with the -i option.

# memsniff -i eth0

See -h for more command-line options. Once running a few more keys are active:

p - Pause the updating of the display. Press p again to resume.
q - Exit memsniff.

Roadmap

Support binary memcached protocol
Support additional operations beyond GET
Support alternate sorting methods
Create a stable report format for output to disk
Automatic logging to disk when specified conditions are met (e.g. aggregate or single key traffic exceeds a threshold)
Break out traffic by client IP
Supply build support for common package formats (.deb, .rpm, …)

Developing memsniff

Want to contribute? First have a look at CONTRIBUTING.md.

Running the tests

memsniff uses the standard Go testing framework:

$ go test ./...
?   	github.com/box/memsniff	[no test files]
...
ok  	github.com/box/memsniff/vendor/github.com/spf13/pflag	0.067s

Data pipeline

Raw packets are captured on the main thread from libpcap using GoPacket.
Batches of raw packets are sent to the decode pool, where workers parse the memcached protocol looking for responses to get requests. The key and size of the value returned are extracted into a response summary.
Batches of response summaries are sent to the analysis pool where the stream is hash partitioned by cache key and sent to workers. Each worker maintains a hotlist of the busiest keys in its hash partition.
In response to periodic requests from the UI, the analysis pool merges reports from all its workers into a single sorted hotlist, which is displayed to the user.

Support

Need to contact us directly? Email [email protected] and be sure to include the name of this project in the subject.

Copyright and License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

memsniff's People

Contributors

Stargazers

Watchers

Forkers

boxmiles rubythonode doubaokun zengyijie xiaolezheng lmtwga iziren sansom eightnoteight zsrinivas asdptkt hadesfeng joaquin-freepik ziqi521 alum isabella232

memsniff's Issues

No get responses are captured

When I run memsniff I am greeted with an empty interface

Running this on Centos7.X

Error reading pcap file

Hi Box team,

I'm trying to use memsniff to parse traffic on my memcached server. Due to OS limitation I can't run memsniff directly on the server. Instead I'm looking into running memsniff somewhere else to read the captured pcap files.

however I ran into an error when reading the captured pcap file:
Error from DecodeLayers: No decoder for layer type Unknown

no result is showing in memsniff and the last message I received is Reached EOF, waiting for workers to finish

command used to capture traffic:
tcpdump -nnA -i any "dst port 11211" -s 0 -X -w output.pcap

command used for running memsniff:
memsniff -r output.pcap

tcpdump is executed on a CentOS5 server, and memsniff is built & executed from my laptop (MacOS). I'm using the latest version (as this is written) of memsniff:

memsniff --version
2019/02/05 11:12:47.783652 memsniff version 1.4.0 (revision autopopulated by build.sh)

can you help me figuring out what I did wrong in using memsniff? the same pcap file can be opened fine in wireshark so I figured it's probably the way I used memsniff that's causing this issue.

thanks in advance!

Same key reported on multiple lines with varying size

Noticed this was happening for a memcache key that was changing size during memsniff operation, so it was being aggregated on several lines with their own size and bandwidth numbers.

Suggested fixes include:
A) Using max size seen (overestimates size/bandwidth)
B) Using min size seen (underestimates size/bandwidth)
C) Using avg size seen (more accurate, but may have perf impact / other)
D) Regardless of above, add UI indication that size is fluctuating / not constant for a key; could prepend/append a ~, *, other

Display is not stable-sorted

When using the -cumulative flag to measure total traffic from just one specific page, the order of the lines in the output moves on each refresh even in the absence of traffic, with results not changing.

It appears that all lines with the same result for max(size) and sum(size) move their relative locations, suggesting the sort method should include the key as the last element of the ordering rule, to get a stable display on a stable system.

Example from such a capture:

logement-cache_bootstrap-logement-cache-_multi0-variables            1048205          1048205
logement-cache_views-logement-cache-_multi0-views_data%253Afr        1048205          1048205
logement-cache-logement-cache-_multi0-schema                         1048205          1048205
logement-cache_views-logement-cache-_multi1-views_data%253Afr        1048205          1048205
logement-cache_views-logement-cache-_multi2-views_data%253Afr        1048205          1048205

In this example, these five lines near the top of the report are constantly switching their relative positions.

track TCP conversations

Working with Redis or the binary memcache protocol will require correlating requests to responses, which means we need to follow both sides of the TCP conversation. For starters, we should use the mechanism to support the initial use case of only inspecting get responses in the memcache text protocol.