NagiosXI New Install

[scrantic]

Hi All, I've been a long term user of Nagios Core (but no expert) and just made the jump to NagiosXI.

I've set-up the configuration from scratch in order to review what we're monitoring. The only hiccup I've encountered is issues with time-outs on various service/host checks. The best way to explain this is lots of false alerts and notifications.

I never encountered this issue with our previous Nagios Core installation but not sure where to start looking to fix the problem. Most of our hosts are windows based servers so we're using NSClient++ along with generic host/server checks for other equipment. Some help to identify these issues would be great.

Platform is a Clean CentOS 6.2 install on a XenServer host with the latest version of NagiosXI installed via the installation script.

[scottwilkerson]

Are you seeing a lot of latency between the Nagios XI machine and the clients? Also what kind of load is your XI server running at?

[lmiltchev]

Are you having issues only with windows hosts, monitored via NSClient++? Can you run a check command from a command line and show us the output?

If you need more info on how to do this, please, review our wiki page:

http://support.nagios.com/wiki/index.ph ... mmand-line

[scrantic]

Are you seeing a lot of latency between the Nagios XI machine and the clients? Also what kind of load is your XI server running at?

Hi Scott, top - 09:54:24 up 5 days, 20:55, 1 user, load average: 0.87, 0.93, 1.28, There doesn't seem to be any latency issues it can happen with local or remote clients.

We're having issues monitoring generic hosts as well as nsclient hosts.

Output from a command line check.

Code: Select all

su -c '/usr/local/nagios/libexec/check_icmp -H 192.168.8.254 -w 3000.0,80% -c 5000.0,100% -p 5' nagios
OK - 192.168.8.254: rta 6.441ms, lost 0%|rta=6.441ms;3000.000;5000.000;0; pl=0%;80;100;;

su -c '/usr/local/nagios/libexec/check_icmp -H 192.168.100.254 -w 3000.0,80% -c 5000.0,100% -p 5' nagios
OK - 192.168.100.254: rta 0.921ms, lost 0%|rta=0.921ms;3000.000;5000.000;0; pl=0%;80;100;;

[scottwilkerson]

Can you run the following and return the output

Code: Select all

netstat -s

[scrantic]

Hi Scott, As requested.

Code: Select all

# netstat -s
Ip:
    1059827 total packets received
    87 with invalid addresses
    0 forwarded
    0 incoming packets discarded
    983205 incoming packets delivered
    1001481 requests sent out
Icmp:
    204393 ICMP messages received
    0 input ICMP message failed.
    ICMP input histogram:
        destination unreachable: 56
        redirects: 1168
        echo requests: 3276
        echo replies: 199893
    206326 ICMP messages sent
    0 ICMP messages failed
    ICMP output histogram:
        destination unreachable: 2005
        echo request: 201045
        echo replies: 3276
IcmpMsg:
        InType0: 199893
        InType3: 56
        InType5: 1168
        InType8: 3276
        OutType0: 3276
        OutType3: 2005
        OutType8: 201045
Tcp:
    119323 active connections openings
    66567 passive connection openings
    0 failed connection attempts
    547 connection resets received
    47 connections established
    3865345 segments received
    3873910 segments send out
    7708 segments retransmited
    0 bad segments received.
    1570 resets sent
Udp:
    25130 packets received
    99 packets to unknown port received.
    0 packet receive errors
    25321 packets sent
UdpLite:
TcpExt:
    108091 TCP sockets finished time wait in fast timer
    255 time wait sockets recycled by time stamp
    213725 delayed acks sent
    29 delayed acks further delayed because of locked socket
    Quick ack mode was activated 156 times
    1330221 packets directly queued to recvmsg prequeue.
    50101 packets directly received from backlog
    135948213 packets directly received from prequeue
    1252499 packets header predicted
    1091546 packets header predicted and directly queued to user
    275849 acknowledgments not containing data received
    2172676 predicted acknowledgments
    6 times recovered from packet loss due to SACK data
    3 congestion windows fully recovered
    3 congestion windows partially recovered using Hoe heuristic
    TCPDSACKUndo: 2
    884 congestion windows recovered after partial ack
    0 TCP data loss events
    1 timeouts after reno fast retransmit
    1 timeouts after SACK recovery
    6 fast retransmits
    3 retransmits in slow start
    7396 other TCP timeouts
    155 DSACKs sent for old packets
    325 DSACKs received
    337 connections reset due to unexpected data
    8 connections reset due to early user close
    27 connections aborted due to timeout
    TCPDSACKIgnoredOld: 291
    TCPDSACKIgnoredNoUndo: 10
    TCPSackShifted: 17
    TCPSackMerged: 4
    TCPSackShiftFallback: 117
IpExt:
    InBcastPkts: 47823
    InOctets: 268786870
    OutOctets: 327700594
    InBcastOctets: 5362997

[scottwilkerson]

How often are you seeing the timeouts? is there any patters, like they all happen in a tight interval, and then run fine for a while?

[scrantic]

Hi Scott, It's sporadic no real pattern. You don't really get a cluster of them all at once just one host might time-out and then you don't see anything for a few hours.

[scottwilkerson]

What version is the new XI server?

[scrantic]

Latest version XI 2011R2.4