Page 1 of 4
Outbound and Inbound Xfer Questions
Posted: Mon Oct 28, 2013 1:08 pm
by BanditBBS
Setup inbound and outbound xfers between two XI server so a few machines can be shared between the two through a firewall. Checks are definitely being passed, but I'm having a few issues and have a question or two. I am using NSCA on both.
1.) When are the check results passed to the other server? Immediately, on a schedule, etc?
2.) I have 7 or 8 servers that start with "dev." and then some other word after the period. I thought I had proper regex in the box, but not all of them seem to be getting passed. Care to help me on that? I have it set to only send what I have in the box.
3.) In my event log of the receiving server I am seeing a bunch of this: "Passive check result was received for service '0' on"..."but does not exist" These dev. hosts only have the check_xi_ping command on the host and no services defined, so no clue why I am getting that!
Thanks
EDIT - One server is 2.3 and the other is 2.5, but that shouldn't matter, right?
Re: Outbound and Inbound Xfer Questions
Posted: Mon Oct 28, 2013 4:22 pm
by slansing
1.) When are the check results passed to the other server? Immediately, on a schedule, etc?
They should be passively re-sent virtually immediately.
2.) I have 7 or 8 servers that start with "dev." and then some other word after the period. I thought I had proper regex in the box, but not all of them seem to be getting passed. Care to help me on that? I have it set to only send what I have in the box.
Only some of the hosts that are appended with "dev." are being passed but not all of them? Strange.. Are there notable differences between them?
3.) In my event log of the receiving server I am seeing a bunch of this: "Passive check result was received for service '0' on"..."but does not exist" These dev. hosts only have the check_xi_ping command on the host and no services defined, so no clue why I am getting that!
And this is just for the aforementioned "dev." hosts?
Re: Outbound and Inbound Xfer Questions
Posted: Mon Oct 28, 2013 9:16 pm
by BanditBBS
slansing wrote:Only some of the hosts that are appended with "dev." are being passed but not all of them? Strange.. Are there notable differences between them?
No notable differences. Just seems very iffy on if the results are being passed. Is it logged anywhere on the sending server?
slansing wrote:And this is just for the aforementioned "dev." hosts?
Nope, all hosts that are being sent
Re: Outbound and Inbound Xfer Questions
Posted: Tue Oct 29, 2013 12:40 pm
by tmcdonald
Two things that come to mind:
1.) Wanna post/PM the regex and a list of the dev.* servers?
2.) Post/PM a "tcpdump -i any port 5667" up to about a hundred lines or so?
Re: Outbound and Inbound Xfer Questions
Posted: Tue Oct 29, 2013 7:17 pm
by BanditBBS
tmcdonald wrote:Two things that come to mind:
1.) Wanna post/PM the regex and a list of the dev.* servers?
2.) Post/PM a "tcpdump -i any port 5667" up to about a hundred lines or so?
Code: Select all
/dev\./w*/
/dev\.diablo/
/dev\.app01/
/dev\.app02/
/dev\.db01/
/dev\.svn/
/dev\.qaapp01/
/dev\.web01/
/^aewdf501/
/^aewdf502/
/^staging.aemq01/
That is a list of the servers and the regex. I only had the first one in there and it didn't send all of them, so then I put them all in by themselves also. I tried with and without escaping the '.'. I also tried many different regex as well, with and without the ^ also.
Also, 3 of the hosts just stopped receiving data randomly. I can tell this from the host graphs. 2 of them stopped hours ago receiving anything and one has a blank of a couple hours from yesterday evening, then all of a sudden started working again. It makes no sense. I'll do the capture here in a bit and pm it.
EDIT: PM Sent
Re: Outbound and Inbound Xfer Questions
Posted: Wed Oct 30, 2013 9:55 am
by tmcdonald
The only thing I can really think of is a greedy regex. I've seen that before in some situations. Can you post/PM which servers are always passed, which are always missed, and which seem to have intermittent problems? It's a longshot but maybe I can see a pattern. *cue A Beautiful Mind theme song*
Re: Outbound and Inbound Xfer Questions
Posted: Wed Oct 30, 2013 10:25 am
by BanditBBS
Let me show you another issue. Same servers, but sending information the opposite direction. It is not sending all services, look at image:
Capture.JPG
All of those services are OK on the machine that should be sending for those two hosts.
Re: Outbound and Inbound Xfer Questions
Posted: Wed Oct 30, 2013 11:01 am
by BanditBBS
weird, just looked at CPU stats on RP000002 and look at the text on the screen:
Code: Select all
CPU STATISTICS OK: user=0.05% system=0.00% iowait=0.00% idle=99.95%
rp000002 /MQHA/FFOMSP02 0 DISK OK - free space: /MQHA/FFOMSP02 60608 MB (63% inode=99%):
it somehow combined information from 2 check....WTF?!?!
Re: Outbound and Inbound Xfer Questions
Posted: Wed Oct 30, 2013 11:21 am
by tmcdonald
Can you post/pm the commands you have defined for NSCA? Might be there's a rogue semi-colon or something that is concatenating checks.
Re: Outbound and Inbound Xfer Questions
Posted: Wed Oct 30, 2013 11:25 am
by BanditBBS
tmcdonald wrote:Can you post/pm the commands you have defined for NSCA? Might be there's a rogue semi-colon or something that is concatenating checks.
Umm, what?
You mean the ...no, nevermind, what?