- observium - lists.observium.org

What SHA and AES does Observium use?
by Henry Collins 15 May '15

15 May '15

What are the key lengths of these algorithms that Observium uses? I have some firewalls, which require to set explicitly which algorithm they have to communicate with Observium. However, I cannot make it work, even though I tried all the key lengths on my firewalls. I am having trouble using SNMP v3 on the following devices: HardwareSummit X440-48tOperating SystemExtreme XOS 15.3.1.4 patch1-19 (nossh) HardwareSummit X440-24tOperating SystemExtreme XOS 15.3.1.4 patch1-19 (nossh) HardwareSummit Stack V2Operating SystemExtreme XOS 15.3.1.4 patch1-41 (nossh) HardwareASA5515Operating SystemCisco ASA 9.2(2)4 Observium does report that it could not authenticate. SNMP v2c works though.

3 2

How to get the same number of graphs on both Windows and Linux machines?
by Henry Collins 15 May '15

15 May '15

I have a number of Windows and Linux machines, which communicate with Observium server. Linux machines report way more information than Windows. Is it possible to get more data from Windows machines? The following data I get from Windows machines (System tab for example): Running Processes Users Logged In Memory Pool Usage Processors Filesystem Usage Device Uptime The following data I get from Linux machines (System tab again): Running Processes Users Logged In Memory Pool Usage Processors Filesystem Usage Context Switches Detailed Processors System Interrupts System I/O Activity Load Averages Detailed Memory Swap I/O Activity Device Uptime I use NET-SNMP on Linux machines and NuDesign SNMPv3 Master Agent Service on Windows machines.

2 1

alert_checker
by Jeffrey d'Ambly 15 May '15

15 May '15

Is there a not match supported in alert checkers? —Jeff

2 1

links in alerts
by Jeffrey d'Ambly 15 May '15

15 May '15

Is there an option for setting the FQDN of the server in email alerts? —Jeff

2 1

Alert Contacts Front End
by Thomas Nicholson 14 May '15

14 May '15

Hi All, Is there a web front end for adding alert contacts and assigning contacts to alerts? I can get it working my manually adding entries in the database, just wondered if there was a GUI that I was missing. Cheers, Tom

3 6

How to get revised SNMP settings from existing devices
by Mike Driscoll 14 May '15

14 May '15

I’ve been updating parameters in some Cisco switches such as snmp-server location and snmp-server contact. But I don’t see these changes reflected in existing devices. Is there anything else I should do?

3 2

new obs server
by Jeffrey d'Ambly 13 May '15

13 May '15

I just installed a new obs server using the professional edition. For some reason all my graphs are empty. I think this maybe due to rrdcached, but I have no idea why. Also when I run the poller in debug mode I saw some SQL errors? Is this something I should be concerned about? Also found this in /var/log/messages May 12 22:23:17 sjc-corp-net01 rrdcached[2470]: queue_thread_main: rrd_update_r (/opt/observium/rrd/nj-wan01/port-13.rrd) failed with status -1. (/opt/observium/rrd/nj-wan01/port-13.rrd: not a simple signed integer: '1.844674407371E+19') May 12 22:25:03 sjc-corp-net01 rrdcached[2470]: queue_thread_main: rrd_update_r (/opt/observium/rrd/nj-wan01/port-13.rrd) failed with status -1. (/opt/observium/rrd/nj-wan01/port-13.rrd: not a simple signed integer: '1.844674407371E+19') May 12 22:30:27 sjc-corp-net01 rrdcached[2470]: queue_thread_main: rrd_update_r (/opt/observium/rrd/nj-wan01/port-13.rrd) failed with status -1. (/opt/observium/rrd/nj-wan01/port-13.rrd: not a simple signed integer: '1.844674407371E+19') SQL[SELECT * FROM `cef_switching` WHERE `device_id` = '63' AND `entPhysicalIndex = '7051' AND `afi` = 'ipv4' AND `cef_index` = '1'] RUNTIME[0.00008607s] ERROR[Error in query: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'afi` = 'ipv4' AND `cef_index` = '1'' at line 1] RRD /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv4-1.rrd already exists - no need to create. SQL[UPDATE `cef_switching` set `drop` ='0',`punt` ='0',`punt2host` ='0',`drop_prev` ='',`punt_prev` ='',`punt2host_prev` ='',`updated` ='1431494692',`updated_prev` ='' WHERE `device_id` = '63' AND `entPhysicalIndex` = '7051' AND `afi` = 'ipv4' AND `cef_index` = '1'] RUNTIME[0.00063586s] RRD[cmd[update /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv4-1.rrd N:0:0:0 --daemon unix:/var/rrdtool/rrdcached/rrdcached.sock] stdout[OK u:0.00 s:0.02 r:56.10] stderr[]] | |-2: RP LES SQL[SELECT * FROM `cef_switching` WHERE `device_id` = '63' AND `entPhysicalIndex = '7051' AND `afi` = 'ipv4' AND `cef_index` = '2'] RUNTIME[0.00007796s] ERROR[Error in query: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'afi` = 'ipv4' AND `cef_index` = '2'' at line 1] RRD /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv4-2.rrd already exists - no need to create. SQL[UPDATE `cef_switching` set `drop` ='0',`punt` ='395367',`punt2host` ='1150',`drop_prev` ='',`punt_prev` ='',`punt2host_prev` ='',`updated` ='1431494692',`updated_prev` ='' WHERE `device_id` = '63' AND `entPhysicalIndex` = '7051' AND `afi` = 'ipv4' AND `cef_index` = '2'] RUNTIME[0.00068498s] RRD[cmd[update /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv4-2.rrd N:0:395367:1150 --daemon unix:/var/rrdtool/rrdcached/rrdcached.sock] stdout[OK u:0.00 s:0.02 r:56.11] stderr[]] |- ipv6 RRD /opt/observium/rrd/nj-wan01/cef-pfx-7051-ipv6.rrd already exists - no need to create. SQL[UPDATE `cef_prefix` set `cef_pfx` ='' WHERE `device_id` = '63' AND `entPhysicalIndex` = '7051' AND `afi` = 'ipv6'] RUNTIME[0.00073409s] RRD[cmd[update /opt/observium/rrd/nj-wan01/cef-pfx-7051-ipv6.rrd N:U --daemon unix:/var/rrdtool/rrdcached/rrdcached.sock] stdout[OK u:0.00 s:0.02 r:56.11] stderr[]] | |-1: RP LES SQL[SELECT * FROM `cef_switching` WHERE `device_id` = '63' AND `entPhysicalIndex = '7051' AND `afi` = 'ipv6' AND `cef_index` = '1'] RUNTIME[0.00008082s] ERROR[Error in query: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'afi` = 'ipv6' AND `cef_index` = '1'' at line 1] RRD /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv6-1.rrd already exists - no need to create. SQL[UPDATE `cef_switching` set `drop` ='0',`punt` ='0',`punt2host` ='0',`drop_prev` ='',`punt_prev` ='',`punt2host_prev` ='',`updated` ='1431494692',`updated_prev` ='' WHERE `device_id` = '63' AND `entPhysicalIndex` = '7051' AND `afi` = 'ipv6' AND `cef_index` = '1'] RUNTIME[0.00065994s] RRD[cmd[update /opt/observium/rrd/nj-wan01/cefswitching-7051-ipv6-1.rrd N:0:0:0 --daemon unix:/var/rrdtool/rrdcached/rrdcached.sock] stdout[OK u:0.00 s:0.02 r:56.11] stderr[]]

4 5

Observium and ATM ?
by Jerome SCHEVINGT 13 May '15

13 May '15

Hi Does Observium support ATM on cisco ? because i see the first card: ATM1/0 but not all sub interface regards jerome

6 9

Observium Subscription Invoice
by Meyer, Florian 13 May '15

13 May '15

Hi, is it possible to get an invoice for the purchased subscription? I purchased the subscription via my personal credit card and have to get my money back from my employer, but they need an invoice. Thanks for any help! Mit freundlichen Grüßen i. A. Florian Meyer Team Infrastruktur/Systeme Universitätsmedizin Rostock Dezernat IT Postfach 10 08 88 18055 Rostock Tel.: +49 (0) 381 / 494 3364 Fax: +49 (0) 381 / 494 3302

2 1

Fortigate Sessions Graph Patch
by Nathan Phelan 12 May '15

12 May '15

Hi Basile, Thanks for that patch; that fixed it up for us. Would be great to see that included in Observium soon. Cheers, Nathan From: observium [mailto:observium-bounces@observium.org] On Behalf Of Basile Bluntschli Sent: Saturday, 9 May 2015 5:26 AM To: Observium Network Observation System Subject: Re: [Observium] Fortigate Ports Disappeared Hi Serghei I have no idea how to apply a svn diff file to an existing file. I just followed the instructions on the Observium website on how to submit a patch :) I would need to use google as well... Else you could manually edit the fortigate.inc.pcp file, the patch provides something like three or four lines of code change... That should be doable as well. Kind regards Basile 2015-05-08 16:42 GMT+02:00 Serghei Golipad <s.golipad(a)kelway.com<mailto:s.golipad@kelway.com>>: Hi Basile, Am I doing something wrong here? observ01:/opt/observium/includes/polling/os# patch -p1 < r6384.patch can't find file to patch at input line 5 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |Index: fortigate.inc.php |=================================================================== |--- fortigate.inc.php (revision 6384) |+++ fortigate.inc.php (working copy) -------------------------- File to patch: fortigate.inc.php patching file fortigate.inc.php Hunk #1 FAILED at 11. patch unexpectedly ends in middle of line Hunk #2 FAILED at 23. 2 out of 2 hunks FAILED -- saving rejects to file fortigate.inc.php.rej root@uk1soc-observ01:/opt/observium/includes/polling/os# From: observium [mailto:observium-bounces@observium.org<mailto:observium-bounces@observium.org>] On Behalf Of Basile Bluntschli Sent: 08 May 2015 15:34 To: Observium Network Observation System Subject: Re: [Observium] Fortigate Ports Disappeared Hi Serghei Fortigate CPU was fixed somewhere in August 2014. The same change broke back then the Firewall Session counter. You may want to update to the current svn version? And then reapply my patch? This should work. Kind regards Basile 2015-05-08 15:23 GMT+02:00 Serghei Golipad <s.golipad(a)kelway.com<mailto:s.golipad@kelway.com>>: Hi Basile, I’ve tried that one, patch fails. Are you able to send a copy of your fortigate.php.inc? P.S does it fix CPU graphs too? Also any reason why there’s CPU and Processor graphs? Thanks From: observium [mailto:observium-bounces@observium.org<mailto:observium-bounces@observium.org>] On Behalf Of Basile Bluntschli Sent: 08 May 2015 13:57 To: Observium Network Observation System Subject: Re: [Observium] Fortigate Ports Disappeared Hi Serghei there is a patch here: http://jira.observium.org/browse/OBSERVIUM-1278?jql= It works for me... You can try it on your own risk :) Kind regards Basile 2015-05-08 10:22 GMT+02:00 Serghei Golipad <s.golipad(a)kelway.com<mailto:s.golipad@kelway.com>>: Hi Nathan, That was spot on :D thank you very much! This problem was been screwing our traffic accounting graphs and causing all sorts of aggravation ☺ We are on: v5.0,build3608,140409 (GA Patch 7) time to upgrade, I know. P.S if only there was a fix to sessions being graphed ☹ Cheers From: observium [mailto:observium-bounces@observium.org<mailto:observium-bounces@observium.org>] On Behalf Of Nathan Phelan Sent: 08 May 2015 05:58 To: Observium Network Observation System Subject: Re: [Observium] Fortigate Ports Disappeared Hi Serghei, This is an issue we have run into several times. Every time it has been due to a SNMPD bug on the fortigates. There is an issue with several firmware versions that returns invalid values for interfaces that have been recently deleted (usually vlan subinterfaces or ipsec interfaces). When this has happened snmp on the fortigates will still return values for everything apart from anything referencing the deleted interface (which is still in snmp somewhere). I have logged a ticket with Fortinet about this (in Feb 2014) and it is supposed to be fixed in newer firmware versions (although I have seen it crop up again on ‘fixed’ versions). When it is in this state snmpwalk actually fails the following query snmpwalk -v2c -c public fortigateIPAddress ifType Error in packet. Reason: (genError) A general failure occured Failed object: IF-MIB::ifType.45 (in this example 45 was snmp index of the deleted interface). The fix for us has always been to kill and restart snmpd on the Fortigate (on all cluster members if it is a cluster). You’ll need to find the process ID of the snmpd process and then kill it; watchdog will automatically restart it and then it’ll be fine. show running processes diag sys top 30 99 kill snmpd process by process id diag sys kill 11 <process ID> I don’t remember if you have to do a discovery after this or if it will return to normal on the next polling cycle. Interested to hear if this solves it for you – also interested to hear what firmware version you are seeing this on. Cheers, Nathan From: observium [mailto:observium-bounces@observium.org] On Behalf Of Serghei Golipad Sent: Friday, 8 May 2015 1:17 AM To: Observium Network Observation System Subject: Re: [Observium] Fortigate Ports Disappeared Hi Adam, Anything I should be looking for in the debug? I can see ifNames correctly displayed during debug however those don’t make it into portal. Also in event log I get below for all discovered ports: Interface changed: [ifDescr] TEST_PORT -> NULL; [ifType] other -> NULL; [ifDuplex] -> 0 One of the things I’ve picked up from poller debug: ignored (by empty ifDescr and ifName). Thanks From: observium [mailto:observium-bounces@observium.org] On Behalf Of Adam Armstrong Sent: 07 May 2015 15:45 To: observium(a)observium.org<mailto:observium@observium.org> Subject: Re: [Observium] Fortigate Ports Disappeared snmpwalk doesn't prove anything, since we don't use snmpwalk. Checking the output from the poller module running in debug might, though. ./poller.php -h <host> -m ports -d adam. Sent from Mailbird<http://www.getmailbird.com/?utm_source=Mailbird&utm_medium=email&utm_campai…> On 07/05/2015 15:38:44, Serghei Golipad <s.golipad(a)kelway.com<mailto:s.golipad@kelway.com>> wrote: Hi Everyone, Has anyone else had this problem? All of a sudden some of the critical ports have disappeared, first though it was SNMP process crash on the firewall however simple snmpwalk proves that’s not the case. I then deleted device including RRDs and re-added, now none of the ports are showing ☹ I’m on 6404. Thanks PLEASE CONSIDER THE ENVIRONMENT BEFORE PRINTING THIS EMAIL. Kelway Ltd is a Company registered in England and Wales. This email is sent for and on behalf of Kelway Holdings Limited. Kelway Holdings Limited is the UK holding company for Kelway Limited trading as Kelway. The registered office for Kelway Holdings Limited (Company Number 05872067) and its UK group undertakings is 10 Fleet Place, London, EC4M 7RB. VAT Registration 902 1949 39. Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than Kelway or the sender of its existence. For more information about Kelway please visit www.kelway.com<http://www.kelway.com> _______________________________________________ observium mailing list observium(a)observium.org<mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium _______________________________________________ observium mailing list observium(a)observium.org<mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium _______________________________________________ observium mailing list observium(a)observium.org<mailto:observium@observium.org> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium

1 0