Brad Lhotsky | 3 Oct 18:15 2007
Picon

Migration to a new server, and new database

Hi,

We are currently running a JFFNMS 0.8.0 installation on a local MySQL 
server.  We're transitioning the database to a real database server 
running postgresql, and installing 0.8.3 on a server setup specifically 
to provide network monitoring capabilities.

I've written a very basic perl script to pull zone, client, hosts, 
interfaces, and interfaces_values tables from MySQL and insert them into 
pgsql.

The interfaces show up correctly in the admin front end, but the poller 
is inserting zero's into all the nics, disks, ports, load, cpu, and 
established connection fields.  Strangely enough, the processes are 
getting the correct information and the graphs are rendered correctly.

I've checked permissions, and everything is setup fine.  What should I 
be looking for, or what do I need to import from the old server that I'm 
missing?

I didn't copy the RRDs over because I'm changing version of rrdtool and 
didn't want to run into any problems.  At this point, the data in the 
RRDs is nice to have, but not critical, so I was mainly focusing on 
getting the RRDs populated correctly on the new server.

Also, I've noticed that sometimes when my linux servers reboot or a disk 
is unmounted and then remounted, I have to manually delete the interface 
in jffnms and rediscover it.  I've been looking around for possible 
problems with OIDs, but I've yet to find anywhere that might be storing 
_specific_ OIDs in jffnms.
(Continue reading)

LIMA David | 4 Oct 23:23 2007

Consolidate and poller2 bug

Hi,

 

I notice a problem using poller2.php and consolidate process, the trigger does not catch the time correctly. For example I set a trigger rule like that

 

if 'type !IN 12,25'

If 'duration > 600’

The email

 

Example of bad triggered event :

Event: 2007-10-04 22:06:20  BMXXXX BOUL

Event: Host is reachable with 0% Packet Loss

 

Event: 2007-10-04 21:57:56  BMXXXX BOUL

Event: Host is unreachable with 80% Packet Loss

 

 

Looking into the database for event infos

 

select * from alarms where triggered = 1 and  interface=3108;

+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+

| id   | date_start          | date_stop           | interface | type | active | referer_start | referer_stop | triggered |

+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+

| 1598 | 2007-10-04 21:57:56 | 2007-10-04 22:06:20 |      3108 |   40 |     12 |          2147 |         2162 |         1 |

+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+

 

Log for triggers :

22:06:31 alarm 1598:    T 2 - P 10 - R 21       If 'type(40) !IN 12,25' (1)

22:06:31 alarm 1598:    T 2 - P 25 - R 17       If 'duration(4864.000000) > 600' (1)    Then email (1)  Stop

 

 

We can see that the duration  fonction is bad because 21 :57 :58 until 22 :06 :20 is not 4864 seconds but 504. If I use the poller1 function this test works.

 

 

 

   _______________

David LIMA

Professional Services

www.scc.com

 


______________________________________________________________________
Ce message contient des informations dont le contenu est susceptible d'etre confidentiel.
Il est destine au(x) destinataire(s) indique(s) exclusivement.

A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez habilite a recevoir le mail a leur place, il vous est interdit de le copier, de l'utiliser ou de devoiler son contenu a un tiers.

Si vous avez recu cet email par erreur, merci de prendre contact avec l'emetteur.

Les opinions exprimees dans cet e-mail sont celles de l'emetteur et ne refletent pas necessairement celles de l'entreprise.

Ce e-mail peut contenir des pieces jointes dont certaines pourraient contenir des virus qui pourraient endommager votre systeme informatique.

La compagnie a pris toutes dispositions afin de minimiser ce risque et decline toute responsabilite pour toute perte ou dommage resultant directement ou indirectement de l'utilisation de cet email ou de son contenu.

Il vous appartient d'effectuer vos propres controles anti-virus avant d'ouvrir la ou les pieces jointes.
______________________________________________________________________
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
jffnms-users mailing list
jffnms-users@...
https://lists.sourceforge.net/lists/listinfo/jffnms-users
Craig Small | 5 Oct 13:42 2007
Picon

Re: kiosk && JFFNMS

On Tue, Sep 25, 2007 at 07:29:25AM -0500, wireless wrote:
> I'm looking to build a system, just for JFFNMS that will have a
> kiosk type of functionality. The system will be located where
> technicians access it to monitor and debug network issues only
Not sure if is what you mean but I have set JFFNMS up so it only
displays a certain map or screen, you just encode the username and
password into the URL and it should work fine.

 -Craig
--

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
Craig Small | 5 Oct 13:44 2007
Picon

Re: Text in graphics problem

On Fri, Sep 28, 2007 at 10:42:26AM -0500, Efrain Espadas wrote:
> 
> I am getting all the graphics without any text (inbound, outbound, bits per second, time, etc.)
> look graphic bellow. Any idea?
Font problem, look in JFFNMS for the font path and make sure it has 
a proper file there.

> _________________________________________________________________
> Discover the new Windows Vista
bleah

--

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
Craig Small | 5 Oct 13:49 2007
Picon

Re: Migration to a new server, and new database

On Wed, Oct 03, 2007 at 12:15:19PM -0400, Brad Lhotsky wrote:
> The interfaces show up correctly in the admin front end, but the poller 
> is inserting zero's into all the nics, disks, ports, load, cpu, and 
> established connection fields.  Strangely enough, the processes are 
> getting the correct information and the graphs are rendered correctly.
Run the poller manually and see what it is getting. I would say it
is something to do with the binaries on your new system and not
JFFNMS per-se.

> Also, I've noticed that sometimes when my linux servers reboot or a disk 
> is unmounted and then remounted, I have to manually delete the interface 
> in jffnms and rediscover it.  I've been looking around for possible 
> problems with OIDs, but I've yet to find anywhere that might be storing 
> _specific_ OIDs in jffnms.
They are in the poller table.

 - Craig
--

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
Craig Small | 5 Oct 14:22 2007
Picon

Re: Consolidate and poller2 bug

On Thu, Oct 04, 2007 at 11:23:31PM +0200, LIMA David wrote:
> select * from alarms where triggered = 1 and  interface=3108;
> | id   | date_start          | date_stop           | interface | type |
> active | referer_start | referer_stop | triggered |
> | 1598 | 2007-10-04 21:57:56 | 2007-10-04 22:06:20 |      3108 |   40 |
> 12 |          2147 |         2162 |         1 |

> We can see that the duration  fonction is bad because 21 :57 :58 until
> 22 :06 :20 is not 4864 seconds but 504. If I use the poller1 function
> this test works.
564 isn't it? Giving a difference of 1 hour, 11 minutes and 40 seconds.

OK, so where does duration come from? Two places it seems!
First place is from the database;
 SELECT (date_stop - date_start) AS duration FROM alarms WHERE triggered = 1 AND interface=3108

That should be 564, or 504 if you're calculations are correct.

The second place, for down alarms, comes calculated from the
current clock. Makes sense because you cannot calculate a down alarm
That is your servers time when it runs the command minus the start_date
Next time you get it, try this:
php -r 'echo time() - strtotime("2007-10-04 21:57:56"). "\n";'

You need to do it near the time it happens and substitute the
time with your start_date value;

Can you also tell me what event with id 2147 and 2162 look like?

--

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
LIMA David | 5 Oct 19:42 2007

Re: Consolidate and poller2 bug

Hi Craig

Here are the results, i repeat that i only appears using poller2.

Thanks.

   _______________
David LIMA
Professional Services
www.scc.com

-----Message d'origine-----
De : jffnms-users-bounces@...
[mailto:jffnms-users-bounces@...] De la part de
Craig Small
Envoyé : vendredi 5 octobre 2007 14:23
À : jffnms-users@...
Objet : Re: [jffnms-users] Consolidate and poller2 bug

On Thu, Oct 04, 2007 at 11:23:31PM +0200, LIMA David wrote:
> select * from alarms where triggered = 1 and  interface=3108;
> | id   | date_start          | date_stop           | interface | type |
> active | referer_start | referer_stop | triggered |
> | 1598 | 2007-10-04 21:57:56 | 2007-10-04 22:06:20 |      3108 |   40 |
> 12 |          2147 |         2162 |         1 |

> We can see that the duration  fonction is bad because 21 :57 :58 until
> 22 :06 :20 is not 4864 seconds but 504. If I use the poller1 function
> this test works.
564 isn't it? Giving a difference of 1 hour, 11 minutes and 40 seconds.

OK, so where does duration come from? Two places it seems!
First place is from the database;
 SELECT (date_stop - date_start) AS duration FROM alarms WHERE triggered = 1 AND interface=3108

That should be 564, or 504 if you're calculations are correct.

[David LIMA: ] 

First problem I guess ... 

mysql> SELECT (date_stop - date_start) AS duration FROM alarms WHERE triggered = 1 AND interface=3108;
+-------------+
| duration    |
+-------------+
| 4864.000000 |
|  804.000000 |
|  796.000000 |
|  812.000000 |
|  692.000000 |
|  790.000000 |
|  709.000000 |
|  806.000000 |
|  767.000000 |
+-------------+
9 rows in set (0.00 sec)

The second place, for down alarms, comes calculated from the
current clock. Makes sense because you cannot calculate a down alarm
That is your servers time when it runs the command minus the start_date
Next time you get it, try this:
php -r 'echo time() - strtotime("2007-10-04 21:57:56"). "\n";'

You need to do it near the time it happens and substitute the
time with your start_date value;

[David LIMA: ] 
Not sure if it is what you want but (test the server time inside php ?)

ntsncnms2:~# date
Fri Oct  5 16:29:30 CEST 2007
ntsncnms2:~# php -r 'echo time() - strtotime("2007-10-05 16:29:30"). "\n";'
7

Can you also tell me what event with id 2147 and 2162 look like?
[David LIMA: ] 
+------+---------------------+------+------+-------------------+-------------+----------+-----------------+---------+-----+----------+
| id   | date                | type | host | interface         | state       | username | info            | referer | ack | analized |
+------+---------------------+------+------+-------------------+-------------+----------+-----------------+---------+-----+----------+
| 2147 | 2007-10-04 21:57:56 |   40 |  306 | Reachability Test | unreachable | status   | 80% Packet Loss |       0 |   1 |        1 |
+------+---------------------+------+------+-------------------+-------------+----------+-----------------+---------+-----+----------+
+------+---------------------+------+------+-------------------+-----------+----------+----------------+---------+-----+----------+
| id   | date                | type | host | interface         | state     | username | info           | referer | ack | analized |
+------+---------------------+------+------+-------------------+-----------+----------+----------------+---------+-----+----------+
| 2162 | 2007-10-04 22:06:20 |   40 |  306 | Reachability Test | reachable | status   | 0% Packet Loss |       0 |   1 |        1 |
+------+---------------------+------+------+-------------------+-----------+----------+----------------+---------+-----+----------+

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
jffnms-users mailing list
jffnms-users@...
https://lists.sourceforge.net/lists/listinfo/jffnms-users

______________________________________________________________________
Ce message contient des informations dont le contenu est susceptible d'etre confidentiel.
Il est destine au(x) destinataire(s) indique(s) exclusivement.

A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez habilite a recevoir le
mail a leur place, il vous est interdit de le copier, de l'utiliser ou de devoiler son contenu a un tiers.

Si vous avez recu cet email par erreur, merci de prendre contact avec l'emetteur.

Les opinions exprimees dans cet e-mail sont celles de l'emetteur et ne refletent pas necessairement
celles de l'entreprise.

Ce e-mail peut contenir des pieces jointes dont certaines pourraient contenir des virus qui pourraient
endommager votre systeme informatique.

La compagnie a pris toutes dispositions afin de minimiser ce risque et decline toute responsabilite pour
toute perte ou dommage resultant directement ou indirectement de l'utilisation de cet email ou de son contenu.

Il vous appartient d'effectuer vos propres controles anti-virus avant d'ouvrir la ou les pieces jointes.
______________________________________________________________________

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
Craig Small | 6 Oct 00:06 2007
Picon

Re: Consolidate and poller2 bug

On Fri, Oct 05, 2007 at 07:42:33PM +0200, LIMA David wrote:
> Here are the results, i repeat that i only appears using poller2.
Hmm, thats strange in itself, but let's see.

> mysql> SELECT (date_stop - date_start) AS duration FROM alarms WHERE triggered = 1 AND interface=3108;
> +-------------+
> | duration    |
> +-------------+
> | 4864.000000 |
OK, here is our problem. Can you run 
 SELECT *, (date_stop - date_start)  AS duration FROM alarms WHERE triggered = 1 AND interface=3108;

> | 2147 | 2007-10-04 21:57:56 |   40 |  306 | Reachability Test | unreachable | status   | 80% Packet Loss |       0 |   1 |        1 |
> | 2162 | 2007-10-04 22:06:20 |   40 |  306 | Reachability Test | reachable | status   | 0% Packet Loss |       0 |   1 |        1 |
So they're the right times as before.

 - Craig
--

-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
LIMA David | 7 Oct 10:07 2007

Re: Consolidate and poller2 bug

>> Here are the results, i repeat that i only appears using poller2.
> Hmm, thats strange in itself, but let's see.

I think you are right, I notice it with poller2 only because I have a huge number of hosts now and the problem
only appears when the interface flaps (UP/DOWN) within the poll cycle, when the interface stay down the
duration is OK.

> OK, here is our problem. Can you run 
> SELECT *, (date_stop - date_start)  AS duration FROM alarms WHERE triggered = 1 AND interface=3108;

For sure, the duration calculation into mysql is bad

mysql> SELECT *, (date_stop) - (date_start)  AS duration FROM alarms WHERE triggered = 1 AND interface=3108;
+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+-------------+
| id   | date_start          | date_stop           | interface | type | active | referer_start | referer_stop | triggered |
duration    |
+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+-------------+
| 1598 | 2007-10-04 21:57:56 | 2007-10-04 22:06:20 |      3108 |   40 |     12 |          2147 |         2162 |         1 | 4864.000000 |
| 1652 | 2007-10-04 23:01:18 | 2007-10-04 23:09:22 |      3108 |   40 |     12 |          2220 |         2223 |         1 |  804.000000 |
---snip-----
23 rows in set (0.00 sec)

mysql> SELECT *, TIME_TO_SEC(TIMEDIFF((date_stop),(date_start))) AS duration FROM alarms WHERE
triggered = 1 AND interface=3108;
+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+----------+
| id   | date_start          | date_stop           | interface | type | active | referer_start | referer_stop | triggered |
duration |
+------+---------------------+---------------------+-----------+------+--------+---------------+--------------+-----------+----------+
| 1598 | 2007-10-04 21:57:56 | 2007-10-04 22:06:20 |      3108 |   40 |     12 |          2147 |         2162 |         1 |      504 |
| 1652 | 2007-10-04 23:01:18 | 2007-10-04 23:09:22 |      3108 |   40 |     12 |          2220 |         2223 |         1 |      484 |
---snip---
23 rows in set (0.00 sec)

I attached the patch for the event api.

 Other thing, I don't know the impact of having time between 2 poll cycles > 5 minutes (for RRD ?) I tried to
increase the number of poller threads but I notice that with thread > 40 the system is overloaded (IO > 15
Mb/s and cpu increasing to 100% and load average jumping to 60), with poller thread = 39 I have a correct
value for loadaverage, CPU, and IO rate) but my poll cycle is > 5 Minutes ... I plan to add up to 10 000
interface on this system. Migrating the database to another box does not solve the overload problem, I
don't know if I'm facing a limit, a misconfiguration or a BUG somewhere.

Any advice will be greatly appreciated.

_______________
David LIMA
Professional Services
www.scc.com

-----Message d'origine-----
De : jffnms-users-bounces@...
[mailto:jffnms-users-bounces@...] De la part de
Craig Small
Envoyé : samedi 6 octobre 2007 00:07
À : jffnms-users@...
Objet : Re: [jffnms-users] Consolidate and poller2 bug

On Fri, Oct 05, 2007 at 07:42:33PM +0200, LIMA David wrote:
> Here are the results, i repeat that i only appears using poller2.
Hmm, thats strange in itself, but let's see.

> mysql> SELECT (date_stop - date_start) AS duration FROM alarms WHERE triggered = 1 AND interface=3108;
> +-------------+
> | duration    |
> +-------------+
> | 4864.000000 |
OK, here is our problem. Can you run 
 SELECT *, (date_stop - date_start)  AS duration FROM alarms WHERE triggered = 1 AND interface=3108;

> | 2147 | 2007-10-04 21:57:56 |   40 |  306 | Reachability Test | unreachable | status   | 80% Packet Loss |       0 |   1 |        1 |
> | 2162 | 2007-10-04 22:06:20 |   40 |  306 | Reachability Test | reachable | status   | 0% Packet Loss |       0 |   1 |        1 |
So they're the right times as before.

 - Craig
-- 
Craig Small      GnuPG:1C1B D893 1418 2AF4 45EE  95CB C76C E5AC 12CA DFA5
http://www.enc.com.au/                             csmall at : enc.com.au
http://www.debian.org/          Debian GNU/Linux, software should be Free 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
jffnms-users mailing list
jffnms-users@...
https://lists.sourceforge.net/lists/listinfo/jffnms-users

______________________________________________________________________
Ce message contient des informations dont le contenu est susceptible d'etre confidentiel.
Il est destine au(x) destinataire(s) indique(s) exclusivement.

A moins que vous ne fassiez partie de la liste des destinataires, ou que vous soyez habilite a recevoir le
mail a leur place, il vous est interdit de le copier, de l'utiliser ou de devoiler son contenu a un tiers.

Si vous avez recu cet email par erreur, merci de prendre contact avec l'emetteur.

Les opinions exprimees dans cet e-mail sont celles de l'emetteur et ne refletent pas necessairement
celles de l'entreprise.

Ce e-mail peut contenir des pieces jointes dont certaines pourraient contenir des virus qui pourraient
endommager votre systeme informatique.

La compagnie a pris toutes dispositions afin de minimiser ce risque et decline toute responsabilite pour
toute perte ou dommage resultant directement ou indirectement de l'utilisation de cet email ou de son contenu.

Il vous appartient d'effectuer vos propres controles anti-virus avant d'ouvrir la ou les pieces jointes.
______________________________________________________________________
Attachment (duration_patch): application/octet-stream, 612 bytes
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
jffnms-users mailing list
jffnms-users@...
https://lists.sourceforge.net/lists/listinfo/jffnms-users
Walid Shoughary | 19 Oct 17:04 2007
Picon

Showing IPs and Names together?

Dear all,

Is it possible to show the IP and the Name of a certain graph?

For example, viewing a router's CPU will show the name of the device, the type of graph (CPU in this case), the CPU Utilization, Max, Average and Last result.

I am monitoring a large inventory list and it is hard to keep track of all the device names, is it possible to add the IP to the graph as well?

Thank you all in advance.

Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! Try it!
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
jffnms-users mailing list
jffnms-users@...
https://lists.sourceforge.net/lists/listinfo/jffnms-users

Gmane