Automatic Source Restart

[Sarg0n]

I apologize for my delay in response. I did not find anything in error with the script that I know of.

However, whenever I restart the nagiosna.service, I watch errors in /var/log/messages and I am seeing the following:

Code: Select all

Software error in bookkepper.c line 401: Entry not found in list
Signal launcher[29578] to terminate.

I do not believe this to be the semaphore error, as I have increased those already. Do you have any ideas or past experiences on what could cause this error? I am not sure where to look for the correct file that contains the entry on line 401.

[tgriep]

That error looks like it is a known issue. Take a look at this link.
https://github.com/phaag/nfdump/issues/30

I do have some instructions for upgrading the nfdump to a newer version that should fix that error.

First we need to install a required package. Run the following to do that.

Code: Select all

yum install bzip2-devel -y

Then, upload the file to the /tmp folder on the NNA server and then follow the instructions to extract and compile the software.

Code: Select all

cd /tmp
wget https://github.com/phaag/nfdump/archive/master.zip
unzip master.zip
cd /tmp/nfdump-master
./configure --prefix=/usr/local --enable-sflow --enable-nsel --enable-nfprofile --enable-nftrack
make
make install
ldconfig -v
service nagiosna restart

Try that and let us know if this fixes the issue.

[Sarg0n]

Guys, sorry for putting this to the side but now I am back with a need to find a resolution on this. So, to summarize, when we reboot the Nagios NA server, it does not autostart the sources and requires us to go in the web GUI and start them one at a time, which takes hours with the amount of sources we have. I am unable to copy and paste from the screen because our systems are classified and on a different enclave. What I do see, however is the following activity when I restart the nagiosna.service and attempt to autostart all of the sources:

Another collector with PID 23898 is already running, and configured for '/usr/local/nagiosna/var/[hostname]/flows'
initialize bookkeeper failed.
Software error in bookkeeper.c line 394: Entry not found in list
Signal Launcher [1999] to terminate.

Then the launcher terminates, and consequently nfcapd.

How would I fix this? Any ideas?

[Sarg0n]

And so I just manually started the source that that PID error was on via the "start" option on the GUI, and it started up fine. However, I restarted nagiosna.service and it failed again on the same source with the same error, except it was a different PID number. So, perhaps there's something wrong with the source? Could it be something to do with the fprobe settings?

[scottwilkerson]

Did you run the above procedure from @tgriep?

It should fix the issue and was a bug in nfcapd when run on certain OS versions
https://github.com/phaag/nfdump/issues/30

[Sarg0n]

Guys, I apologize but I must have missed a step the first time I tried following tgrieps instructions but after I followed it step-by-step this morning, it appears that it is now working, slowly but surely. How embarrassing, but also very awesome that it is working now.

Thanks so much for your patience and assistance with this! This issue appears to be resolved...

[scottwilkerson]

Guys, I apologize but I must have missed a step the first time I tried following tgrieps instructions but after I followed it step-by-step this morning, it appears that it is now working, slowly but surely. How embarrassing, but also very awesome that it is working now.

Thanks so much for your patience and assistance with this! This issue appears to be resolved...

Excellent! I am glad to hear it is working.