- observium - lists.observium.org

Odd issue with Syslog collection
by Anthony Mattke 27 Jun '14

27 Jun '14

On a recent install of observium, I’ve noticed some oddities with Syslog collection… Some devices are being collected just fine, but others are not. In the example screenshot included below, my firewall ***10, and one switch ***04 are both being collected just fine. But the switches 75***** and *****50 are not. http://i.imgur.com/nxupFzJ.png One thing I noticed was that someone had turned on “service sequence-numbers” on the ****04 switch. (The ASA has no such feature that I know of.. ) When I disabled this service, the collection stopped working on that device! Example here…http://i.imgur.com/HViWcTk.png Thoughts? Thanks!! -Tony

3 4

ios-xr etc syslog
by Rob VanHooren 26 Jun '14

26 Jun '14

to make it go away, could try getting rid of the "service log sequence numbers" (or whatever exact syntax it is) in the device's ios config if you don't need the sequence numbering for audit, that's easier than trying to hack in a new syslog-ng.conf template. luck, R.

1 0

Syslog parsing: Issue from IOS XR devices
by Senses0 26 Jun '14

26 Jun '14

Hi, I have few devices running Cisco IOS XR. I am sending syslog messages from all devices to Observium. Everything is fine except for the log messages sent by routers running IOS XR. Instead of log Program name, messages sent by XR devices contain an incrementing sequence number, which is being parsed as log Program (Incrementing sequence number being parsed as syslog program = bad. real bad). The actual program name appears much later within the message. I have gone through the sylog configuration guide for XR routers. Couldnt find anything that would alter the message format of what is being sent. I also configured "logging facility syslog" in XR devices, but that didnt resolve the issue. To better explain my situation, I have attached a screenshot. Hopefully it would help. Oh and I am subscriber :) Thanks, Senn

1 0

Windows individual performance counter
by Stefan 26 Jun '14

26 Jun '14

1 0

Re: [Observium] location
by Rob VanHooren 26 Jun '14

26 Jun '14

… DNS LOC records were invented for this? http://en.wikipedia.org/wiki/LOC_record just a thought. R. On Jun 26, 2014, at 7:00, observium-request(a)observium.org wrote: > The location parsing stuff does need looked at a bit more.

1 0

GPS data on Syslocation
by Ciro Iriarte 25 Jun '14

25 Jun '14

Hi! , out of curiosity, is there any prevision to locate devices with actual GPS data, stored in the Syslocation field for example?. Regards, Ciro -- Ciro Iriarte http://iriarte.it --

2 1

Re: [Observium] Syslog from NX-OS device
by Steffen Klemer 25 Jun '14

25 Jun '14

Am Tue, 24.06.2014 um 14:49 schrieb Ole Hansen <oha(a)netic.dk>: > Hi, > > I'm trying to get syslog (using syslog-ng) from some NX-OS devices > into Observium, but so far no luck. > > I'm using the following syslog-ng configuration > > template t_observium { > template > ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$YEAR-$MONTH-$DAY > $HOUR:$MIN:$SEC||$MSG||$PROGRAM\n"); template-escape(yes); }; For me it works with destination d_observium { program("/opt/observium/syslog.php" template ("$HOST||$FACILITY||$PRIORITY||$LEVEL||$TAG||$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC||$MSG||$PROGRAM\n") template-escape(yes)); }; > 10.10.10.10||local7||info||info||be||2014-06-24 16:43:08||Jun 24 > 14:43:07: %SEC-6-IPACCESSLOGP: list flow denied udp > 192.168.10.10(137) -> 192.168.11.10(137), 5 packets ||147696 > 10.10.10.11||local7||notice||notice||bd||2014-06-24 16:43:16||2014 > Jun 24 16:43:16.724 CEST: %SYSMGR-5-CFGWRITE_STARTED: Configuration > copy started (PID 2143).|| I see an ip-addresses instead of a hostname in your first field here. iirc observium can only work with hostnames and especially needs the hostname in the first field to be identical to the one in the database (i.e. with or without FQDN), therefor I set use_dns(yes) and use_fqdn(no) instead of keep_hostname(yes) like it is written in the manual. It total it looks like this for me: options { chain_hostnames(off); flush_lines(0); use_dns(yes); use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); bad_hostname("^gconfd$"); }; But you can also set a hostname in nx-os and redefine the logging very fine granular. /Steffen -- Steffen Klemer E-Mail: Steffen.Klemer(a)gwdg.de Tel: +49 551 39 172361 __________________________________________________________________ GWDG Am Fassberg 11, 37077 Göttingen URL: http://www.gwdg.de E-Mail: gwdg(a)gwdg.de Tel.: +49 (0)551 201-1510 Fax: +49 (0)551 201-2150 Geschäftsführer: Prof. Dr. Ramin Yahyapour Aufsichtsratsvorsitzender: Dipl.-Kfm. Markus Hoppe Sitz der Gesellschaft: Göttingen Registergericht: Göttingen Handelsregister-Nr. B 598

2 1

nxos syslog
by Rob VanHooren 24 Jun '14

24 Jun '14

is the nexus' L3 in the global (default) vrf? if *not* then it won't (easily?) work until cisco fixes the (being kind here) "oddball way" that mib exposure happens on the nxos platform. a workaround could be to map out things with snmp contexts that tie in a string per vrf ... but imo that doesn't scale effectively. join the party: go beat up TAC and your sales rep. for how stupid their implementation -- of something pretty fundamental -- is. luck, R. Typogaphical errors courtesy of iPhone

1 0

NXOS vrfs == OID grief
by Rob VanHooren 24 Jun '14

24 Jun '14

it seems vrfs aren't discovered, since the OIDs are not found. this leads to all sorts of unhappiness, since with no ipaddr (mgmt vrf) winds up with no syslog, no routing, no nothing except L2 info. who can I send the walk to? (would rather not post it to the list or jira) thanks, R. [me@host ~] ./discovery.php -h theN7k -m cisco-vrf -d DEBUG! theN7k 135 nxos (cisco) VRFs : DEBUG: SNMP Auth options = -v2c -c 'secretSNMPro' /usr/bin/snmpbulkwalk -v2c -c 'secretSNMPro' -Osqn -m MPLS-L3VPN-STD-MIB -M /opt/observium/mibs 'udp':'theN7k':'161' mplsL3VpnVrfRD .1.3.6.1.2.1.10.166.11.1.2.2.1.4 No Such Object available on this agent at this OID DEBUG: SNMP Auth options = -v2c -c 'secretSNMPro' /usr/bin/snmpbulkwalk -v2c -c 'secretSNMPro' -Osqn -m MPLS-VPN-MIB -M /opt/observium/mibs 'udp':'theN7k':'161' mplsVpnVrfRouteDistinguisher .1.3.6.1.3.118.1.2.2.1.3 No Such Object available on this agent at this OID DEBUG: SNMP Auth options = -v2c -c 'secretSNMPro' /usr/bin/snmpbulkwalk -v2c -c 'secretSNMPro' -Osqn -m MPLS-VPN-MIB -M /opt/observium/mibs 'udp':'theN7k':'161' .1.3.6.1.3.118.1.2.2.1.2 .1.3.6.1.3.118.1.2.2.1.2 No Such Object available on this agent at this OID DEBUG: SNMP Auth options = -v2c -c 'secretSNMPro' /usr/bin/snmpbulkwalk -v2c -c 'secretSNMPro' -Osqn -m MPLS-VPN-MIB -M /opt/observium/mibs 'udp':'theN7k':'161' .1.3.6.1.3.118.1.2.1.1.2 .1.3.6.1.3.118.1.2.1.1.2 No Such Object available on this agent at this OID

2 1

Timeout: No Response from xxxx
by George 24 Jun '14

24 Jun '14

Hi, I have latest observium installed and running on a Ubuntu 12.04.4 server and am trying to add another same Ubuntu server to the observium server. I've set up snmpd on the target host. When I run the snmpstatus command from the observium server I get a Timeour: No Response. I've installed the mibs and everything else according to the docs. I can see in the syslog of the target host that the observium server hits it. I can run successfully snmpstatus on the target host and query itself. I can run snmpstatus successfully from another CentOS server. It works from everywhere except the observium server. There are no firewalls involved. Am I doing anything wrong? What info can I send you to help me debug it. Please help Thanks

2 1