- observium - lists.observium.org

Re: [Observium] observium Digest, Vol 80, Issue 9
by Don Maker 10 Mar '17

10 Mar '17

"643m means 0.643 Adam." Thank you for the response, Adam. That makes sense, but numbers like 291.59m do not. Should I just assume that anything with an m is less than zero? On Thu, Mar 9, 2017 at 7:00 AM, <observium-request(a)observium.org> wrote: > Send observium mailing list submissions to > observium(a)observium.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > or, via email, send a message with subject or body 'help' to > observium-request(a)observium.org > > You can reach the person managing the list at > observium-owner(a)observium.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of observium digest..." > > > Today's Topics: > > 1. Re: question regarding traffic accounting (Adam Armstrong) > 2. Re: question regarding traffic accounting (Michael) > 3. Re: question regarding traffic accounting (Adam Armstrong) > 4. Re: question regarding traffic accounting (Ross [Eve IT]) > 5. Re: question regarding traffic accounting (Adam Armstrong) > 6. Re: question regarding traffic accounting (Adam Armstrong) > 7. Re: Windows Processor Numbers are Odd (Max Krabbenhöft) > 8. SVN Update doesn't seem to update observium (Lorenzo Zafra) > 9. Re: Windows Processor Numbers are Odd (Adam Armstrong) > 10. Re: SVN Update doesn't seem to update observium (Adam Armstrong) > 11. Re: question regarding traffic accounting (Ross [Eve IT]) > 12. Re: question regarding traffic accounting (Ross [Eve IT]) > 13. Help with monitor Tomcat Traffic without Apache (Michael) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 08 Mar 2017 12:06:39 +0000 > From: Adam Armstrong <adama(a)memetic.org> > To: Observium Public Support <observium(a)observium.org> > Subject: Re: [Observium] question regarding traffic accounting > Message-ID: <9574d4e3-a350-4a31-9469-9d255671a64e(a)typeapp.com> > Content-Type: text/plain; charset="utf-8" > > It has to be large to keep the c*nt per square mile density the same as in > normal countries... > > ... > > :D > > ⁣Sent from BlueMail > > On 8 Mar 2017, 10:36, at 10:36, "Ross [Eve IT]" <ross(a)eve-it.net> wrote: > >Thanks for the response, > >It is virtual, we did actually vmotion a few hosts to this server > >including > >the Observium machine. > > > >But I've checked the hypervisor, and its clock is good. > >Also uses NTP, same as the other Hypervisors. > > > >Although good point, I've actually been thinking about that exact same > >thing for logging purposes. UTC across the board as we also span a few > >timezones, Australia is large! > > > > > >On Wed, Mar 8, 2017 at 9:29 PM, Michael <obslist(a)smarsz.com> wrote: > > > >> It's very odd as there's no timezone of UTC+21. > >> > >> Your Observium instance isn't virtual is it? We've encountered > >problems > >> with guests set to obtain their time from the local clock and (on > >ESXi > >> hypervisors) have a massive time jump when vmotioned to a new host as > >they > >> grab their time from that clock. Any inconsistencies between the > >> hypervisors will throw your guests clock big time. All of a sudden, > >your > >> guest has jumped +10 hours (and ntpd will often wet its pants and > >refuse to > >> correct such a huge offset)... > >> > >> We had a similar problem to above when one hypervisor was set to our > >local > >> time (+10/11, same as you) when it was supposed to be set to UTC. In > >our > >> case, we run all of our clocks deliberately in UTC to preserve > >logging > >> integrity etc (you never get duplicated log times during the daylight > >> savings shift). > >> > >> Might not be your issue, but it may help somebody else (and worth > >keeping > >> in mind)! > >> > >> Michael > >> > >> > >> > >> > On 8 Mar 2017, at 8:55 pm, Ross [Eve IT] <ross(a)eve-it.net> wrote: > >> > > >> > Looks correct > >> > > >> > mysql> SELECT TIMEDIFF(NOW(), UTC_TIMESTAMP); > >> > +--------------------------------+ > >> > | TIMEDIFF(NOW(), UTC_TIMESTAMP) | > >> > +--------------------------------+ > >> > | 11:00:00 | > >> > +--------------------------------+ > >> > 1 row in set (0.00 sec) > >> > > >> > mysql> > >> > > >> > mysql> SELECT @@global.time_zone, @@session.time_zone; > >> > +--------------------+---------------------+ > >> > | @@global.time_zone | @@session.time_zone | > >> > +--------------------+---------------------+ > >> > | SYSTEM | SYSTEM | > >> > +--------------------+---------------------+ > >> > 1 row in set (0.00 sec) > >> > > >> > mysql> > >> > > >> > # date > >> > Wednesday 8 March 20:55:17 AEDT 2017 > >> > > >> > > >> > > >> > > >> > On Wed, Mar 8, 2017 at 8:32 PM, Simon Schmitz <schmitz(a)eseven.de> > >wrote: > >> > MySQL Time ? > >> > > >> > Am 08.03.2017 um 15:31 schrieb Ross [Eve IT] <ross(a)eve-it.net>: > >> > > >> >> Tried all that, still no go. > >> >> > >> >> I've set PHP to the right timezone. > >> >> NTP is set and running on all our servers. > >> >> > >> >> Any other ideas ? > >> >> > >> >> > >> >> On Tue, Mar 7, 2017 at 7:45 PM, Sophanith Chhom < > >> sophanith.chhom(a)gmail.com> wrote: > >> >> Try to use single quote? eg: > >> >> > >> >> date.timezone = 'Australia/Melbourne' > >> >> > >> >> Then restart httpd service > >> >> > >> >> On Tue, Mar 7, 2017 at 3:28 PM, Ross [Eve IT] <ross(a)eve-it.net> > >wrote: > >> >> Hi Sam, > >> >> thanks for responding. > >> >> however I already have that set correctly. > >> >> > >> >> [Date] > >> >> ; Defines the default timezone used by the date functions > >> >> ; http://php.net/date.timezone > >> >> date.timezone = Australia/Melbourne > >> >> > >> >> any other ideas ? > >> >> > >> >> > >> >> On Tue, Mar 7, 2017 at 5:40 PM, Sam Hernandez-gill < > >> Sam.Hernandez-gill(a)qvc.com> wrote: > >> >> > >> >> I think that’s usually the php.ini timezone setting when the > >filtered > >> time doesn’t match, check out what you have set there, and match your > >> system’s timezone and restart apache > >> >> > >> >> > >> >> > >> >> From: observium [mailto:observium-bounces@observium.org] On Behalf > >Of > >> Ross [Eve IT] > >> >> Sent: Tuesday, March 07, 2017 1:19 AM > >> >> To: observium(a)observium.org > >> >> Subject: [Observium] question regarding traffic accounting > >> >> > >> >> > >> >> > >> >> Hello all, > >> >> > >> >> > >> >> > >> >> I'm using traffic accounting for multiple interfaces and have > >noticed a > >> strange occurrence. > >> >> > >> >> The graphs seem to be be producing the wrong time in the graphs. > >> >> > >> >> > >> >> > >> >> See attached; > >> >> > >> >> > >> >> > >> >> > >> >> > >> >> If you notice the top right corner, 2017/03/08 03:15:04 > >> >> > >> >> It's Tues 7th here 5:15pm. > >> >> > >> >> > >> >> > >> >> The server clock is synced NTP. > >> >> > >> >> > >> >> > >> >> Is there something I've missed here ? > >> >> > >> >> > >> >> > >> >> Observium 17.3.8420 (rolling) > >> >> > >> >> Debian Wheezy. > >> >> > >> >> > >> >> > >> >> Ross. > >> >> > >> >> > >> >> > >> >> > >> >> > >> >> ---------------------------- > >> >> This message (including any attachments) contains confidential > >> information intended for a specific individual and purpose, and is > >> protected by law. If you are not the intended recipient of this > >e-mail > >> (even if the e-mail address above is yours), (i) you may not use, > >copy or > >> retransmit it, (ii) please delete this message and (iii) please > >notify the > >> sender immediately. Any disclosure, copying, or distribution of this > >> message or the taking of any action based on it, is strictly > >prohibited. > >> >> ---------------------------- > >> >> > >> >> > >> >> > >> >> > >> >> _______________________________________________ > >> >> observium mailing list > >> >> observium(a)observium.org > >> >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> >> > >> >> > >> >> > >> >> _______________________________________________ > >> >> observium mailing list > >> >> observium(a)observium.org > >> >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> >> > >> >> > >> >> > >> >> _______________________________________________ > >> >> observium mailing list > >> >> observium(a)observium.org > >> >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> >> > >> >> > >> >> _______________________________________________ > >> >> observium mailing list > >> >> observium(a)observium.org > >> >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> > > >> > _______________________________________________ > >> > observium mailing list > >> > observium(a)observium.org > >> > http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> > > >> > > >> > _______________________________________________ > >> > observium mailing list > >> > observium(a)observium.org > >> > http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> > >> _______________________________________________ > >> observium mailing list > >> observium(a)observium.org > >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium > >> > > > > > >------------------------------------------------------------------------ > > > >_______________________________________________ > >observium mailing list > >observium(a)observium.org > >http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >

3 3

SVN Update doesn't seem to update observium
by Lorenzo Zafra 10 Mar '17

10 Mar '17

Hello All, I submitted a patch and it was commited in r8368, but when I run svn update to r8428 I dont get any of the changes. Anyone know whats wrong? We are running the subscription edition, if that matters. I checked to see if I would get the patch when creating a new copy of observium through [svn co ... ] and yes it worked fine. -- [image: Edmonton_sig_RGB_S.jpg] Lorenzo Zafra COMMUNICATIONS ENGINEERING STUDENT ENGINEERING & MAINTENANCE CITY OPERATIONS | EDMONTON TRANSIT 7 <(780)%20442-5021>80-944-0419 OFFICE 7 <(780)%20668-1302>80-885-3696 MOBILE l <matthew.dyck(a)edmonton.ca>orenzo.zafra(a)edmonton.ca City of Edmonton D.L. MacDonald Transit Yards ROW Building 13304 - 50A Street Edmonton AB T5A 4P6 All information contained in this email post is proprietary to the City of Edmonton, confidential and intended only for the addressed recipient. If you have received this post in error, please disregard the contents, inform the sender of the misdirection, and remove it from your system. The copying, dissemination or distribution of this email, if misdirected, is strictly prohibited.

2 4

question regarding traffic accounting
by Ross [Eve IT] 09 Mar '17

09 Mar '17

Hello all, I'm using traffic accounting for multiple interfaces and have noticed a strange occurrence. The graphs seem to be be producing the wrong time in the graphs. See attached; [image: Inline image 1] If you notice the top right corner, 2017/03/08 03:15:04 It's Tues 7th here 5:15pm. The server clock is synced NTP. Is there something I've missed here ? Observium 17.3.8420 (rolling) Debian Wheezy. Ross.

7 25

Logs for LDAP
by David Haché 09 Mar '17

09 Mar '17

Hi, I have been using observium for a while and I am pleased with it. Now when I try to integrate LDAP, I can't find the logs to troubleshoot. I activated LDAP and it connect correctly, the query looks good but no go. Log from my LDAP server [06/Mar/2017:16:41:55.102124385 -0500] conn=255138 op=1 SRCH base="cn=users,cn=accounts,dc=domain,dc=com" scope=2 filter="(&(objectClass=posixaccount)(uid=dave))" attrs=ALL Does anyone have suggestion how to activate the loggin for ldap on the PHP / NGINX / Observium side? Thanks. Dave

3 5

Windows Processor Numbers Seem Odd.
by Don Maker 09 Mar '17

09 Mar '17

"643m means 0.643 Adam." Thank you for the response, Adam. That makes sense, but numbers like 291.59m do not. Should I just assume that anything with an m is less than zero?

1 0

Help with monitor Tomcat Traffic without Apache
by Michael 09 Mar '17

09 Mar '17

2 1

Windows Processor Numbers are Odd
by Don Maker 08 Mar '17

08 Mar '17

I got observium working almost exactly how I want it, but I have an issue with Windows cpu numbers. The graph looks fine (I think), but the numbers are weird. The max numbers look like a percentage, but the now and Avg show odd things like 640.5m I have no idea what that means. Also, the processor is never identified properly. I would happily change to wmi for Windows devices, but I'm not sure how that is done, or if it is stable. Does anyone have any suggestions or experiences with wmi and observium? Thanks!

4 3

Discovery creating & deleting inventory entries
by Lorenzo Zafra 07 Mar '17

07 Mar '17

Hi All, When I run discovery.php on our Nokia 7210 Service Access Switch (Alcatel-Lucent TiMOS) it creates and deletes inventory entries and the valid entries are found at the bottom of the page. See screenshot below. Are these deleted automatically after some time? I found that there is an inventory.inc.php file for the housekeeping script, but it is not included in the options when running housekeeping.php. Does this mean that inventory.inc.php is deprecated? To delete them, I just edited the script myself and ran it. Thanks! -- [image: Edmonton_sig_RGB_S.jpg] Lorenzo Zafra COMMUNICATIONS ENGINEERING STUDENT ENGINEERING & MAINTENANCE CITY OPERATIONS | EDMONTON TRANSIT 7 <(780)%20442-5021>80-944-0419 OFFICE 7 <(780)%20668-1302>80-885-3696 MOBILE l <matthew.dyck(a)edmonton.ca>orenzo.zafra(a)edmonton.ca City of Edmonton D.L. MacDonald Transit Yards ROW Building 13304 - 50A Street Edmonton AB T5A 4P6 All information contained in this email post is proprietary to the City of Edmonton, confidential and intended only for the addressed recipient. If you have received this post in error, please disregard the contents, inform the sender of the misdirection, and remove it from your system. The copying, dissemination or distribution of this email, if misdirected, is strictly prohibited.

2 2

Event LOG ignore
by Alexandre J. Correa (Onda) 07 Mar '17

07 Mar '17

Hello, Thre´s a way to ignore/filter some event log like this (flooding, in this case): 8h 30m 57s GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 14h 30m 37s GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 4d 14h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 4d 20h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 5d 20h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 7d 8h 31m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 7d 20h 31m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 8d 2h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 8d 8h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 8d 14h 31m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 8d 20h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 9d 8h 30m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:9f:26:47 -> 00:0c:29:51:1e:76 10d 8h 31m GE0/0/5 MAC changed: xxx.xxx.xxx.xxx : 00:0c:29:51:1e:76 -> 00:0c:29:9f:26:47 .... .... some servers share same loopback address (dns anycast). regars, -- Fwd: a *Alexandre Jeronimo Correa* / CEO _alexandre(a)onda.net.br <mailto:alexandre@onda.net.br>_ / Office +55 34 3351 - 3077 *ONDA INTERNET* +55 34 3351-3077 Av. Benedito Valadares, 217 – Centro – Sacramento – MG - BR _http://www.onda.net.br <http://www.onda.net.br/>_

3 2

artificially high (100%) CPU usage reported from routing engine on Juniper MX-104 w/ 550 interfaces & solution
by Darrell Budic 07 Mar '17

07 Mar '17

Observium has been recording artificially high CPU for RE0 on my MX-104, and I finally spent the time to understand what was going on and look for a solution. Here’s what I found in case it helps someone else. I say artificially because monitoring the system from the CLI reported 30-40% CPU usage with significant spikes during SNMP polling, but Observium constantly recorded 100% CPU usage. First up, I got the juniper to stop reporting on it’s internal interfaces and a bunch of others that show up by default. This removed a bunch of interfaces that existed but never had data and observing was polling. This cut the poll time down a fair bit, so I mention it if you haven’t used it on a juniper before. If you want this, it’s: snmp { filter-interfaces { all-internal-interfaces; interfaces { <other interface you don’t want stats for here>; } } } I also went through and turned off all the modules it wasn’t using or weren’t producing any data in polling or discovery. Helped a little more, but exposed something odd. When I would run polling on just the processors module, it would report CPU usage that matched what I saw in the CLI. When it ran as part of the whole host polling, it reported 100%. Figured out it was polling the processors after it had polled sensors and the 550 interfaces on this router, and that has run up the CPU utilization while it was polling, so the RE was reporting that instant CPU usage while it was still high. Not sure it was the best way, but moved the processor module to the head of the polling queue, and now I’m getting a CPU status that is more representative of the general load on the RE, and not the 100% usage the SNMP polling was causing. This router has always had this many interfaces, so as far as I can tell, a change in polling order caused this behavior and not a growth in interfaces. Here’s my patch to includes/polling/functions.inc.php if it’s helpful to anyone: Index: functions.inc.php =================================================================== --- functions.inc.php (revision 8345) +++ functions.inc.php (working copy) @@ -639,6 +639,11 @@ //print_warning("Module [ $module ] excluded for device."); continue; } + if ($module == 'processors') + { + array_unshift($poll_modules, $module); // Add 'processors' before all + continue; + } if ($module == 'unix-agent') { array_unshift($poll_modules, $module); // Add 'unix-agent' before all

1 0