Fusion Logs in 4.1.2

[DFaught]

We recently upgraded Fusion to version 4.1.2. When I look at Admin -> System Information -> Fusion Logs, there are pairs of error messages for all of the fused servers that look like this:

Code: Select all

poll_server() unable to poll data for s:nag23 Corp Network Too, u:nagiosadmin, poll:nagiosxi_bpi
poll_server() CHECK YOUR LIVE_DATA_TIMEOUT SETTINGS. IT MAY NEED INCREASED

When I look at Admin -> Servers -> Manage Fused Servers, the fused servers are all using Fusekey Authentication.

If I edit any of the fused servers and click the Test Fusion Settings button, both tests come up green.
In the Fused Server Stats dashlet, all the fused servers are green. In the Home -> Server Status -> Tactical Overview, the Last Updated
timestamps are all relatively current.

So if everything looks good and current, why are these errors happening?

Thank you for any help you can provide.

[scottwilkerson]

You can adjust this setting

See page 2 of this doc
https://assets.nagios.com/downloads/nag ... Tuning.pdf

Admin -> System Configuration -> System Settings -> Data & Polling
Live Data Timeout:

[DFaught]

I am reasonably sure that changing the setting will not make any difference to these errors. I have looked at a packet capture of 1/2 hour of the conversations between the Fusion server and one of the fused Nagios XI servers. What I see is that out of the 11 different types of GET requests that are done, it is only this type of request that fails:

GET /nagiosxi/includes/components/nagiosbpi/bpi_display.php?cmd=getbpixml&username= ...&password= ...

The response to this query is an "HTTP/1.1 200 OK" that contains the text "Your session has timed out."

All of the other requests work properly and use the fusekey instead of the password. All of the requests together, including the failed one, took about 4 seconds to complete for each interval.

The packet capture file is about 2 megabytes if you would like to look at it.

[scottwilkerson]

I talked to the developer on this and he realized that the BPI doesn't use the fusekey yet, but added it as a Bug Report.

He believed for not if you can enter user credentials also it should work until it is fixed.

The Bug Report ID for this is 13098

[DFaught]

Thank you. As I stated in my original post in this thread, all of the user IDs and passwords tested green, so I don't think that will help.

[scottwilkerson]

Thank you. As I stated in my original post in this thread, all of the user IDs and passwords tested green, so I don't think that will help.

Not 100% sure but the developer mentioned that bpi didn't have fusekey authentication built-in yet

[DFaught]

This is somewhat related, but I think a separate issue. I noticed when looking through the packet trace that the Fusion server appears to be polling the fused XI server twice in each (default) 300 second interval and doing the same set of GET requests both times. In the /usr/local/nagiosfusion/var/log directory, there are two sets of poll_subsys files, one set with the nagiosadmin user in the filenames and one set with my user in the filenames. I don't know how this came about, but how can I stop the double polling? Each of the fused servers is only defined once as far as I can tell and that is with the nagiosadmin user.

I do not think that this is the cause of the timeouts, although it is possible, becuase there are some of each user ID in the log error messages.

Here is the listing of the /usr/local/nagiosfusion/var/log directory:

[dfaught@mlwnag30]:[/usr/local/nagiosfusion/var/log]# ls -l
total 6560
-rw-rw-r-- 1 nagios nagios 3711590 Mar 5 11:23 auth_subsys.log
-rw-rw-r--. 1 nagios nagios 20318 Jan 5 03:26 auth_subsys.log-20180105.gz
-rw-rw-r-- 1 nagios nagios 18262 Feb 9 03:48 auth_subsys.log-20180209.gz
-rw-rw-r--. 1 nagios nagios 57 Oct 2 09:43 cmd_subsys.log
-rw-r--r--. 1 nagios nagios 0 Oct 2 09:45 dbmaint_subsys.log
-rw-rw-r-- 1 nagios nagios 2009061 Mar 7 14:08 log_subsys.log
-rw-rw-r--. 1 nagios nagios 428889 Jan 3 03:09 log_subsys.log-20180103.gz
-rw-rw-r-- 1 nagios nagios 418787 Feb 20 03:49 log_subsys.log-20180220.gz
-rw-r--r--. 1 nagios nagios 1700 Jan 13 21:34 poll_subsys.1.dfaught.log
-rw-r--r--. 1 nagios nagios 5653 Jan 30 08:49 poll_subsys.1.nagiosadmin.log
-rw-r--r--. 1 nagios nagios 3437 Jan 13 21:29 poll_subsys.2.dfaught.log
-rw-r--r--. 1 nagios nagios 3493 Jan 13 21:33 poll_subsys.2.nagiosadmin.log
-rw-r--r-- 1 nagios nagios 7881 Mar 7 14:06 poll_subsys.3.dfaught.log
-rw-r--r--. 1 nagios nagios 7885 Mar 7 14:07 poll_subsys.3.nagiosadmin.log
-rw-r--r-- 1 nagios nagios 7210 Mar 7 14:06 poll_subsys.4.dfaught.log
-rw-r--r--. 1 nagios nagios 7214 Mar 7 14:04 poll_subsys.4.nagiosadmin.log
-rw-r--r-- 1 nagios nagios 4052 Mar 7 14:07 poll_subsys.5.dfaught.log
-rw-r--r--. 1 nagios nagios 4056 Mar 7 14:06 poll_subsys.5.nagiosadmin.log
-rw-r--r-- 1 nagios nagios 8325 Mar 7 14:04 poll_subsys.6.dfaught.log
-rw-r--r-- 1 nagios nagios 8329 Mar 7 14:04 poll_subsys.6.nagiosadmin.log
-rw-rw-r--. 1 nagios nagios 91 Oct 2 09:43 poll_subsys.log
-rw-rw-r--. 1 nagios nagios 0 Oct 2 09:43 sysstat_subsys.log
[dfaught@mlwnag30]:[/usr/local/nagiosfusion/var/log]#

[scottwilkerson]

This is because some of the data is user specific, different users have access to different hosts/services etc.

This was the big problem in previous versions, you could have a user that us supposed to only see 5 hosts but they could always see everything.

In fusion 4, some of the polling is done per user.