memory usage data alert incorrect

[BradZynda]

Hello,

have been noticing for Linux the memory usage is grabbing total and buff/cache but this is incorrect as the linux server will put back buff/cache as needed for the system.

Memory Usage 2 Physical memory: 99%used(31595MB/31963MB) (>98%) : CRITICAL

The correct usage should be when buff/cache = 0 and starts to swap or when available hits 0.

Getting a lot of false positive alerts from this.

Thanks,
Brad

[BradZynda]

After some thought on this.. (plays Jeopardy music)

amount_used = (buff/cache) - available

total_percent_used = $amount_used / total_mem

May want to get a second opinion on that but what it is currently doing is giving me a percent free plus what is used in buff/cache as a percent of total physical RAM.

Hope that clarifies it a little.

Thanks,
Brad

[tmcdonald]

Can you clarify what plugin is being used in this case? There might be flags you can pass in to change how the memory is calculated.

[BradZynda]

The Linux SNMP plugin that came in the base

[bolson]

You might consider using the nrpe plugin "check_mem". This plugin returns a free memory value which includes cached memory (phys mem - in use + cached)

This document explains the NRPE agent:

https://assets.nagios.com/downloads/nag ... g_NRPE.pdf

[BradZynda]

Due to security rules xinetd can not be on our servers, so that isn't an option for us. Is there a way to fix the Linux SNMP values? Kind of a deciding factor as memory usage is a must have..

Thanks,
Brad

[dwhitfield]

NRPE does not require xinetd. That is simply an option that our installer is designed to use. The source install does not use xinetd by default: https://support.nagios.com/kb/article.php?id=515

[BradZynda]

looked it over and that looks like a bit more of setting up and firewall rules needed, also it is getting away from going in the direction of SNMP.. before that route I am going to try the "without buffers" option on the mem check to see if that fixes anything.

Thanks,
Brad

[dwhitfield]

also it is getting away from going in the direction of SNMP..

Yes. I was just responding to your concern about xinetd. With snmpd.conf and such, I don't know that NRPE is really any more setup, but if you already know SNMP, I certainly understand your concern about switching.

Let us know how your test goes.

[BradZynda]

Yah we want to do SNMP v3 across the board setting a strict allow and view set with read-only.

So I tested the "Run without buffers" checked to off and that seems to be returning a closer representation of the memory used without false positives.

Thanks,
Brad