Outbound and Inbound Xfer Questions

[BanditBBS]

Setup inbound and outbound xfers between two XI server so a few machines can be shared between the two through a firewall. Checks are definitely being passed, but I'm having a few issues and have a question or two. I am using NSCA on both.

1.) When are the check results passed to the other server? Immediately, on a schedule, etc?
2.) I have 7 or 8 servers that start with "dev." and then some other word after the period. I thought I had proper regex in the box, but not all of them seem to be getting passed. Care to help me on that? I have it set to only send what I have in the box.
3.) In my event log of the receiving server I am seeing a bunch of this: "Passive check result was received for service '0' on"..."but does not exist" These dev. hosts only have the check_xi_ping command on the host and no services defined, so no clue why I am getting that!

Thanks

EDIT - One server is 2.3 and the other is 2.5, but that shouldn't matter, right?

[slansing]

1.) When are the check results passed to the other server? Immediately, on a schedule, etc?

They should be passively re-sent virtually immediately.

2.) I have 7 or 8 servers that start with "dev." and then some other word after the period. I thought I had proper regex in the box, but not all of them seem to be getting passed. Care to help me on that? I have it set to only send what I have in the box.

Only some of the hosts that are appended with "dev." are being passed but not all of them? Strange.. Are there notable differences between them?

3.) In my event log of the receiving server I am seeing a bunch of this: "Passive check result was received for service '0' on"..."but does not exist" These dev. hosts only have the check_xi_ping command on the host and no services defined, so no clue why I am getting that!

And this is just for the aforementioned "dev." hosts?

[BanditBBS]

Only some of the hosts that are appended with "dev." are being passed but not all of them? Strange.. Are there notable differences between them?

No notable differences. Just seems very iffy on if the results are being passed. Is it logged anywhere on the sending server?

And this is just for the aforementioned "dev." hosts?

Nope, all hosts that are being sent

[tmcdonald]

Two things that come to mind:

1.) Wanna post/PM the regex and a list of the dev.* servers?

2.) Post/PM a "tcpdump -i any port 5667" up to about a hundred lines or so?

[BanditBBS]

Two things that come to mind:

1.) Wanna post/PM the regex and a list of the dev.* servers?

2.) Post/PM a "tcpdump -i any port 5667" up to about a hundred lines or so?

Code: Select all

/dev\./w*/
/dev\.diablo/
/dev\.app01/
/dev\.app02/
/dev\.db01/
/dev\.svn/
/dev\.qaapp01/
/dev\.web01/
/^aewdf501/
/^aewdf502/
/^staging.aemq01/

That is a list of the servers and the regex. I only had the first one in there and it didn't send all of them, so then I put them all in by themselves also. I tried with and without escaping the '.'. I also tried many different regex as well, with and without the ^ also.

Also, 3 of the hosts just stopped receiving data randomly. I can tell this from the host graphs. 2 of them stopped hours ago receiving anything and one has a blank of a couple hours from yesterday evening, then all of a sudden started working again. It makes no sense. I'll do the capture here in a bit and pm it.

EDIT: PM Sent

[tmcdonald]

The only thing I can really think of is a greedy regex. I've seen that before in some situations. Can you post/PM which servers are always passed, which are always missed, and which seem to have intermittent problems? It's a longshot but maybe I can see a pattern. *cue A Beautiful Mind theme song*

[BanditBBS]

Let me show you another issue. Same servers, but sending information the opposite direction. It is not sending all services, look at image:

Capture.JPG

All of those services are OK on the machine that should be sending for those two hosts.

[BanditBBS]

weird, just looked at CPU stats on RP000002 and look at the text on the screen:

Code: Select all

CPU STATISTICS OK: user=0.05% system=0.00% iowait=0.00% idle=99.95%
rp000002	/MQHA/FFOMSP02	0	DISK OK - free space: /MQHA/FFOMSP02 60608 MB (63% inode=99%):

it somehow combined information from 2 check....WTF?!?!

[tmcdonald]

Can you post/pm the commands you have defined for NSCA? Might be there's a rogue semi-colon or something that is concatenating checks.

[BanditBBS]

Can you post/pm the commands you have defined for NSCA? Might be there's a rogue semi-colon or something that is concatenating checks.

Umm, what?

You mean the ...no, nevermind, what?