nsca logging as error, ndo2db as debug

[WillemDH]

Hello,

After installing the NLS agent for Linux on my Nagios XI server, it seems like nsca is logging every connection to /var/log/messages with a severity as 'error',even if there does not seem to be an error. Is this 'normal' behaviour. Shouldn't these messages be logged with an informational level, as it kind of makes searching for 'real errors' harder and is causing a non-necessary flow of error severity levels events.
For each message sent over nsca to Nagios XI, it seems NSCA makes three log entries with the exact same datestamp:

Time difference in packet: 0 seconds for host <hostname>
Attempting to write to nagios command pipe
End of connection...

I have no problem with these events being logged, but why are they logged as error? Maybe it should be an error / warning level event if something would not work as expected, or if the time difference would be too high or if it was unable to write to Nagios command pipe.

Another thing I noticed was that ndo2db seems to log an event as debug for every connection and disconnection made to mysql database.

Successfully connected to MySQL database
Successfully disconnected from MySQL database

I would suspect debug is something set when explicitly troubleshooting? Could it be that deugging is somewhere enabled where it shouldn't in ndo2db config?

Thoughts?

Willem

[cmerchant]

We can quickly check the debug level of XI:

Code: Select all

grep debug /usr/local/nagios/etc/ndo2db.cfg

can you show us the /etc/rsyslogd.d/logserver.conf?

[WillemDH]

Cmerchant,

Seems like debug is set to 0

Code: Select all

grep debug /usr/local/nagios/etc/ndo2db.cfg
# This option determines how much (if any) debugging information will
# be written to the debug file.  OR values together to log multiple
debug_level=0
# This option determines how verbose the debug log out will be.
debug_verbosity=1
# This option determines where the daemon should write debugging information.
debug_file=/usr/local/nagios/var/ndo2db.debug
# This option determines the maximum size (in bytes) of the debug file.  If
# get out of control when debugging.
max_debug_file_size=1000000

Code: Select all

### Begin forwarding rule for Nagios Log Server                           NAGIOSLOGSERVER
$WorkDirectory /var/lib/rsyslog # Where spool files will live             NAGIOSLOGSERVER
$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files     NAGIOSLOGSERVER
$ActionQueueMaxDiskSpace 1g   # 1GB space limit (use as much as possible) NAGIOSLOGSERVER
$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown         NAGIOSLOGSERVER
$ActionQueueType LinkedList   # Use asynchronous processing               NAGIOSLOGSERVER
$ActionResumeRetryCount -1    # Infinite retries if host is down          NAGIOSLOGSERVER
# Remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional       NAGIOSLOGSERVER
*.* @@<nls01>:5546                                               # NAGIOSLOGSERVER
### End of Nagios Log Server forwarding rule                              NAGIOSLOGSERVER

Grtz

[tmcdonald]

Actually we would want to check nsca.cfg for the error messages:

Code: Select all

grep "debug" /usr/local/nagios/etc/nsca.cfg

Looking at the source it does seem odd but if debugging is turned on it will log that as an error:

Code: Select all

if(debug==TRUE){
     syslog(LOG_DEBUG,"Listening for connections on port %d\n",htons(myname.sin_port));
}

Code: Select all

if(debug==TRUE)
    syslog(LOG_ERR,"Attempting to write to nagios command pipe");

Code: Select all

if(debug==TRUE)
    syslog(LOG_ERR,"End of connection...");

Looks like only the first is going in as debug. Copy + paste error perhaps? If debug is on let's turn it off and restart nsca.

[WillemDH]

Weel it seems debugging is on:

Code: Select all

grep "debug" /usr/local/nagios/etc/nsca.cfg
# This option determines whether or not debugging
# Values: 0 = debugging off, 1 = debugging on
debug=1

I can't remember having that turned on.
So I will turn it off tomorrow and restart nsca? Why would NSCA write to error when debug is on?

[tgriep]

Let us know if disabling debugging works for you.