chewearn's blog

Notes on part 5

Part 5 chronicles my investigation of the various issues, after getting iplist to work on the Debian NSLU2 in part 4. In summary, the issues I found were:

1. iplist did not start;
2. iplist did not properly stop;
3. iplist not working after automatic update of blocklists;
4. not enough physical memory.

Iplist did not start

I explained about this problem near the end of part 4. To recap, iplist would only start to work after two commands, instead of one:

sudo ipblock -s
sudo ipblock -l

Iplist did not properly stop

Another problem was iplist appeared to become frozen when given the command:

sudo ipblock -d

Issuing the command was supposed to stop the blocklists. However, instead of reverting to the condition before iplist was started, it became frozen instead, and all traffics were block (except for the existing ssh connection, which issued this command).

The only way to recover was to kill all iplist processes by:

sudo pkill iplist

Iplist not working after automatic update of blocklists

I left the slug with iplist running overnight. After a couple of hours, iplist initiated the automatic update of blocklists. The download completed successfully; however iplist became frozen afterwards. I suspects this was caused by the same issue as iplist failing to properly stop (see above).

Here were the iplist messages on syslog (edited to show relevant parts):

ipblock[cron]: info: Updating lists
iplist[7013]: info: User defined signal 1 signal caught
iplist[7013]: info: User defined signal 1 signal caught
ntpd[1809]: no servers reachable
iplist[7013]: info: User defined signal 1 signal caught
last message repeated 28 times
last message repeated 54 times
last message repeated 54 times
last message repeated 54 times
last message repeated 54 times
last message repeated 54 times
last message repeated 54 times
last message repeated 54 times
last message repeated 52 times
last message repeated 41 times
iplist[7011]: error: can't open /var/run/iplist.pid
iplist[9259]: thread[32771]: info: logging to /tmp/ipblock.log

Not enough physical memory

Also explained else where, the slug has 32MB physical memory. However, the iplist requirement exceeded that by a considerable amount. With full blocklists enabled, the memory load (“free -m”) were:

            total      used      free    shared   buffers     cached
Mem:           29        27         1         0         0         4
-/+ buffers/cache:       22         6
Swap:         384        44       339

Observe that full physical memory and additional 44MB disk swap were occupied.

Test on less memory used

By removing two of the largest blocklists from “/etc/ipblock.conf” I was able to reduce the memory load such that no swap was used. These two blocklists were level1.gz (about 3.7MB) and edu.gz (about 0.8MB).

After command “sudo ipblock -s”, the memory load were:

            total      used      free    shared   buffers     cached
Mem:           29        17        11         0         0         7
-/+ buffers/cache:        9        20
Swap:         384         0       384

Following that, the command “sudo ipblock -l” resulted in the memory load:

            total      used      free    shared   buffers    cached
Mem:           29        19         9         0         1         7
-/+ buffers/cache:       10        18
Swap:         384         0       384

Two of observations from this test:

1. The second command “sudo iplock -l” took about 20 seconds to return with the results. Contrast this to the more than 15 minutes with the full blocklists. It was clear with the disk swap, iplist was taking too long to function.
2. The problem of properly starting and stopping iplist still exists despite this. Therefore, it appeared to be unrelated to the lack of physical memory.

Closing remark

Currently, I was working on Debian Etch. A visitor to a previous post, Alan, commented that he has been successful running iplist on Debian Sid. I think this is the right time to upgrade my slug to Debian Lenny, which is now in Release Candidate stage, and would soon be the Debian Stable.

Submit to: