Memory values doubled

[GreatWolfResorts]

I just noticed this issue today while adding a few additional hosts to our Nagios XI system. It appears every single memory service check for all of our hosts show double the value of total memory as well as free/used memory. For example:

Memory Usage Ok 2h 54m 12s 1/5 07/21/2011 17:45:19 Memory usage: total:49127.68 Mb - used: 2053.91 Mb (4%) - free: 47073.77 Mb (96%)

This machine only has 24GB memory installed, with 1GB used.

System Details:

Linux Distribution: CentOS
Platform: Virtual
Version: Nagios XI 2011R1.5

Let me know any and all additional information you require. Thanks!

- Dan

[nscott]

Dan,

Are you using the same method of monitoring for all these systems, for example, are you using solely NRPE, NSClient++ or SNMP? Or is a mix of both?

[GreatWolfResorts]

We're using NSClient++ version 0.3.8 (32 & 64 bit versions) to pull the data. That's pretty consistent across the board. I don't believe we're using SNMP or NRPE for any hosts at this time, at least with the memory checks.

check_xi_service_nsclient!MEMUSE!-w 90 -c 95

[lmiltchev]

We tested the NSClient++ version 0.3.9 and were able to recreate the "Memory values doubled" problem on our test box. We will be looking into this issue and will be posting a bug report if necessary.

[mguthrie]

Can you post the command definition and the service definition where you're getting this error. There are two types of memory checks for windows, physical and page file usage. Not sure if that's the issue here or not.

[GreatWolfResorts]

Command Definition: $USER1$/check_nt -H $HOSTADDRESS$ -s "$ARG1$" -p 12489 -v $ARG2$ $ARG3$ $ARG4$
Service Definition: check_xi_service_nsclient!******!MEMUSE!-w 95 -c 100!!!!!

We're using password protection with the nsclient so I removed the actual password being used and replaced with a series of asterisks.

[lmiltchev]

It seems like this is a Nsclient++ issue. Even if we posted it on our tracker we wouldn't be able to fix it. You can probably check out the Nsclient++ forums.
I found a couple of posts, mentioning of the same (or similar) problems:
http://www.nsclient.org/nscp/discussion/topic/452#-1
http://www.nsclient.org/nscp/discussion/topic/295#-1

[lmiltchev]

BTW, you may look into Monitoring Windows With WMI as an alternative. You will not have the "memory values doubled" problem. Check it out:

http://library.nagios.com/library/produ ... ent-for-xi

http://library.nagios.com/library/produ ... s-with-wmi

If you decide to go this route, make sure you have perl DateTime module installed on your Nagios server.

[GreatWolfResorts]

Thanks for the info! I configured WMI to work with our NagiosXI setup, and it appears to do the trick. Just to update for those reading this post in the future, there are a couple options we have moving forward with this issue. One was the WMI method mentioned earlier. The second is the use of the NRPE protocol. I essentially created the following custom command:

check_xi_service_nrpe:
$USER1$/check_nrpe -H $HOSTADDRESS$ -p 5666 -c $ARG1$ -a MaxWarn=$ARG2$% MaxCrit=$ARG3$% $ARG4$ $ARG5$

$ARG4$ = "type=physical"

Note: You will need to enable some NRPE commands in the nsc.ini file on the remote device. Specifically: allow_arguments=1

Alternatively, a full understanding of the check_nt MEMUSE command helps when reviewing the values returned. Windows refers to the sum of memory and swap files, that is, the entire available virtual memory. Windows regularly swaps program and data code from the main memory, even when it still has spare reserves. In this respect the load of the entire virual memory in Windows is the more important parameter to observe over simply physical or swap.

So in the end, the values returned weren't necessarily a bug in NagiosXI or nsclient++, but rather a view of the virtual memory of the machine.

Hope this helps!

[mguthrie]

Thanks for your explanation on this! I posted your solution to our wiki so we can reference it again : )

http://support.nagios.com/wiki/index.ph ... es_Doubled