Missing Hosts

[gimeb]

1. You have indicated that "This value can be adjusted in the panel's settings: 2016_12_12_16_24_35_Dashboard_Nagios_Log_Server.png and 2016_12_12_16_13_51_Dashboard_Nagios_Log_Server.png". What are these .png files? Is there suppose to be an attachment?
2. You have indicated "you could include host:136.133.231.211 in your query in the top search bar". I have tried that and also included additional filtering. Nothing was displayed. See the attached MissingHosts2.docx with screens.

In addition, please let me know if it is possible to cut and paste screen prints directly into the post reply since I am creating word documents with screen prints as attachments.

[mcapra]

What are these .png files? Is there suppose to be an attachment?

Yup! phpBB did silly things The original post should be fixed now.

You have indicated "you could include host:136.133.231.211 in your query in the top search bar". I have tried that and also included additional filtering. Nothing was displayed. See the attached MissingHosts2.docx with screens.

Is it expected for this host to be sending a substantial number of events? If not seeing anything in the last 15 minutes is unexpected, I would do a tcpdump against the 136.133.231.211 source and see if traffic is being dropped somewhere.

Assuming your adapter is eth0:

Code: Select all

tcpdump -i eth0 "src 192.168.67.97"

In terms of getting screenshots in a post, you can upload them as an attachment in phpBB and use "Place inline" to put them in certain spots of a post:

2016_12_13_09_17_01_Edit_post_Nagios_Support_Forum.png

[gimeb]

1. I still do not see the .png files you are referring (2016_12_12_16_24_35_Dashboard_Nagios_Log_Server.png and 2016_12_12_16_13_51_Dashboard_Nagios_Log_Server.png)
2. I have a separate dashboard which I created a long time ago and see the requests from the host:136.133.231.211. Therefore, I still do not understand the reason I do not see this host on the "Top Sources and Types". See the attached MissingHosts3.docx

3. As far as attachment of the screen prints to the post, my screen does not have all the options as in the one you have provided, i.e. I do not have "Place inline". I have placed my screen view in the same MissingHosts3.docx

[mcapra]

The first provided screenshots show a 15m time period, while the second shows a 1hr time period. With only 7 events being returned in the 1hr period, are you certain this isn't the result of a machine that just doesn't talk very much?

[gimeb]

Should I still see the host regardless of how frequent the log are sent?

[rkennedy]

The top talkers is based off the interval which is specified. If the logs do not send often, and there are ten hosts that have sent 10+ logs, then you will not see the log which only has sent one result.

[gimeb]

Please let me know how to see all the 13 hosts. You said that this can be done via some configuration setting

[rkennedy]

You will see all the logs at once, as long as they are appearing in the system in the time period you specify.

You can apply a query if you'd like to see past the most recent messages, for a specific host = part.

[gimeb]

I have updated my custom dashboard for 136.133.231.211 and specified 1hr period to see the information. I have updated the same time period on the Top Sources. However, I still do not see the 136.133.231.211 on the list. The attached is MissingHosts4.docx to illustrate. Please advise.

In addition I did not get a explanation on the reason I can not attach screens directly to the post. See my previous communication and the MissingHosts3.docx for screen prints.

[rkennedy]

What error do you see? I see some of your posts containing attachments, and some do not. Without knowing what the issue is and the screenshots, it's hard to tell exactly.

@mcapra posted an image above with instructions, what error are you seeing?