Hi. I’m trying Smokeping for the first time.
I don’t understand the mechanics of CheckLoss matcher.
CheckLoss(l=>3,x=>4)
Does this mean an alarm will be raised if there are:
1 - at least 3 packets loss in the last 4 pollings?
2 - at least 3 packets loss in each of the last 4 pollings?
3 - 3% packet loss in the last 4 pollings?
4 - 3% packet loss in each of the
last 4 pollings?
Despite this, this matcher is not working well. When a
device becomes unreachable, usually I start receiving flapping alarms, that go
on (Raised, Cleared, Raised, Cleared, …) until there are no 100% losses
in the small historic that comes with the e-mail.
When the device comes back to life, this usually happens too.
Ex.:
#####################################################
Thu Jan 31 20:03:43 2008
Alert "someloss"
was raised for http://172.28.154.41/cgi-bin/smokeping/smokeping.cgi?target=WAN.Rede_Tecnica.Rui_Meireles
Pattern
-------
CheckLoss(l=>3,x=>4)
Data (old --> now)
------------------
loss: 0%, 0%, 0%, 0%, 0%,
0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%,
0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 100%, 100%, 100%, 100%, 100%, 100%, 100%,
100%
rtt: 0ms, 0ms, 0ms, 0ms,
0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms,
0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, U, U, U,
U, U, U, U, U
Comment
-------
Perdas Detectadas
#####################################################
Thu Jan 31 20:08:43 2008
Alert "someloss"
was cleared for http://172.28.154.41/cgi-bin/smokeping/smokeping.cgi?target=WAN.Rede_Tecnica.Rui_Meireles
Pattern
-------
CheckLoss(l=>3,x=>4)
Data (old --> now)
------------------
loss: 0%, 0%, 0%, 0%, 0%, 0%,
0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%, 0%,
0%, 0%, 0%, 0%, 0%, 0%, 0%, 100%, 100%, 100%, 100%, 100%, 100%, 100%, 100%,
100%
rtt: 0ms, 0ms, 0ms, 0ms,
0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms,
0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, 0ms, U, U, U, U, U,
U, U, U, U
Comment
-------
Perdas Detectadas
#####################################################
In the example above (2 of the many e-mails I received) why
was the alarm cleared? There is no reason for that!
And why is it showing such a big historic, if I specified 4
values?
If anyone could help me, I would deeply appreciate it. All I
want is to generate alarms when there are some (few) packet losses, and
terminate them as soon as the situation resolves.
Thanks.