A simple misconfiguration of MTP hardware filters can overfill a MTP/TIM Ram disk. This covers how to recognize and fix the condition.
The symptoms are the following:
- /nqtmp/tim is at 100% but not /nqtmp/headers
- The TIM logs are filled with errors:
A typical TIM hardware filter looks like the following:
In this case the filter settings look like this:
The culprit is checking the "Exclude" check box when setting up the filter. The resulting behavior is not what is typically expected. It means to block what is defined. (In this case port 443.) So ALL data except port 443 is sent to and overloading the MTP/TIM.
Knowing this, it is understandable why /nqtmp/TIM is at 100%. This is because the MTP is now receiving traffic from all ports except 443 instead of receiving traffic from port 443. Hence the traffic bottleneck.
To fix, simply uncheck the "Exclude" check box and restart the nqcapd process. The issue should go away.