- observium - lists.observium.org

New user - I apologize in advance if I am asking stupid questions
by Rich Elwell 29 Mar '15

29 Mar '15

Greetings, I've recently installed observium and find that it is a great tool. Kudos for developing something so useful and easy to use. I do have a couple of questions. I desire to set the device_id for some of the devices to a specific value. This is not supported in the interface. It looks like I *should* be able to modify the code to allow me to do this, but before I do I wanted to check and see if there is already a way for me to accomplish this without having to modify the code. I also desire to be able to add devices programatically via an API call from an external system. I looked over the existing simple API (not extensively) but it didn't seem like that was possible. So basically I want to be able to do something like: http://myserver/api.php?mydetails&including&device_id and have it add the device while specifying the device_id. Is that possible? If not, I'm probably going to build it. Thanks, Rich -- Rich Elwell, MS, CISSP, GCIA, CCNA, CCNA Security /dev/null security ⋅ network *nix administration

3 5

ISSUES/BUg with regards to collect_table Implementation - Suggested Code Changes
by Mark Gibbons 29 Mar '15

29 Mar '15

Hi (especially adam - can you take a read please) Background I have been working on integrating support for Ubiquiti wireless products so that wireless stats can be shown on the "wireless" graph page for these devices. I created routines to process the mibs in /include/polling/graphs using the original loop method to parse the mib to generate and populate the RRD's and everything is working absolutely fine. I will of course submit this work for inclusion once tested/verified fully. However, i read the README (you see people do read README's!!!!!!!!!!): "Please make sure you use the *new* format of graphing poller. Generate a $graph_defs array to be used in collect_table." And i thought I would have a go at the $table_def method. So I defined the MIB as per $tabledef and come across issues with multi indexed oids. In this instance from a MIB walk we have two oids as follows: ubntRadioRssi.1.1 ubntRadioRssi.1.2 So i put the following in table_def: 'ubntRadioRssi.1' => array('index' => '1', 'descr' => 'RSSI Chain 0', 'ds_type' => 'GAUGE', 'ds_name' => 'RadioRssi_0'), 'ubntRadioRssi.1' => array('index' => '2', 'descr' => 'RSSI Chain 1', 'ds_type' => 'GAUGE', 'ds_name' => 'RadioRssi_1'), But, of course, (knowing what i know now) this does not work because the array index is the same and you only get the last entry. So i thought try with a blank index specifying the full oid: 'ubntRadioRssi.1.1' => array('index' => '', 'descr' => 'RSSI Chain 0', 'ds_type' => 'GAUGE', 'ds_name' => 'RadioRssi_0'), 'ubntRadioRssi.1.2' => array('index' => '', 'descr' => 'RSSI Chain 1', 'ds_type' => 'GAUGE', 'ds_name' => 'RadioRssi_1'), But this didn't work so I investgated. The issues surround the handling of the separation of oid and index in both collect table AND snmp_get_multi. Let me Deal with snmp_get_multi first. Snmp_get multi expects an array of full oid's - great. However it spits back an array of oids and index separated. Because you use explode to breakup the oid it will only ever return the first index after the first "." rather than the full index after the first "." I am talking about this code at approx Line 464 in /includes/snmp.inc.php foreach (explode("\n", $data) as $entry) { list($oid,$value) = explode("=", $entry, 2); $oid = trim($oid); $value = trim($value); list($oid, $index) = explode(".", $oid); if (!strstr($value, "at this OID") && isset($oid) && isset($index)) { $array[$index][$oid] = $value; } } This can be corrected if you change it to the following code. In this case the base oid is returned with the FULL index in the index. I can't see that this could/would break other stuff but your experience would know better!! : foreach (explode("\n", $data) as $entry) { list($oid,$value) = explode("=", $entry, 2); $oid = trim($oid); $value = trim($value); $dotpos = strpos($oid, '.'); if ($dotpos != FALSE) { $index = substr($oid, $dotpos+1); $oid = substr($oid, 0, $dotpos); } //list($oid, $index) = explode(".", $oid); if (!strstr($value, "at this OID") && isset($oid) && isset($index)) { $array[$index][$oid] = $value; } } So the next issue is index handling within collect_table and the temporary index of oids created to generate rrdupdate. Current code is at approx 898 in /includes/polling/functions.inc.php: $oids[] = $oid.'.'.$entry['index']; $oids_index[] = array('index' => $entry['index'], 'oid' => $oid); Again if this is changed to the following so that oid and index is re-split like the return from snmp_get_multi we have a working solution where you can specify the full oid as an index for the oid array in table_def with an oid index of '' (blank): if ($entry['index'] != '') { $fulloid = $oid.'.'.$entry['index']; } else { $fulloid = $oid; } $oids[] = $fulloid; $dotpos = strpos($fulloid, '.'); if ($dotpos != FALSE) { $splitindex = substr($fulloid, $dotpos+1); $splitoid = substr($fulloid, 0, $dotpos); } //$oids_index[] = array('index' => $entry['index'], 'oid' => $oid); $oids_index[] = array('index' => $splitindex, 'oid' => $splitoid); So this is a possible solution to the multiple index problem on an oid. By specifying the full oid with blank index. What do you think? Seems like a Win/Win to me but my experience of Observium php code and structure is < 1 week. At least this solution means we can use the table_def method for us but it would mean a lot of maintenance with svn updates. Hope this solution is of possible interest for inclusion. KR's Mark

1 1

FortiGate support
by Thomas Raabo - Zitcom A/S 27 Mar '15

27 Mar '15

At some point we had FortiGate support for session graphing and so on. Now its gone. Does somebody know why? Thomas

2 2

How best to engage the Professional Services team?
by Arthur Bommele (DataByte) 27 Mar '15

27 Mar '15

Dear concerned, How best to engage the Professional Services team? Specifically, regarding Feature Development. Kind regards, Arthur B.

1 0

Help analysis
by Eliezer De Sousa Oliveira 27 Mar '15

27 Mar '15

hello everyone! how to tell the host that causes more traffic on my network? the Community observium, have an option to do this analysis? ass eliezer

2 3

Cronjobs in polling the devices
by Jerico M. Rubion 26 Mar '15

26 Mar '15

Hi there, I would like to inquire about the desired minimum cron jobs that are accepted in observium. I only have a Quad Core Intel(R) Xeon(R) CPU E5405 @ 2.00GHz CPU resources available currently managing 69 HOSTS/Devices. My current setting in /etc/cron.d/observium is */10 * * * * root /opt/observium/poller-wrapper.py 4 >> /dev/null 2>&1 */10 * * * * root /opt/observium/poller.php -h all >> /dev/null 2>&1 Can I comment out the 2nd line -> */10 * * * * root /opt/observium/poller.php -h all >> /dev/null 2>&1 ?? Best Regards, Jerico M. Rubion | 77GSI IT Services Group SEVEN SEVEN GLOBAL SERVICES INC. | 27th Floor, Orient Square Bldg., F. Ortigas Jr. Ortigas Center, Pasig City, Philippines 1605 Office: +632.915.7747 ext. 1911 | Mobile: +63.9175382740 | Duo: +632.9667501 The Information contained and all attachments to this email are for the named recipient(s) only. It contains legally privileged and confidential information intended solely for the use of the addressee. The addressee undertakes to use such information consistent with its privileged and confidential character, and by the receipt thereof appreciates that any use contrary thereto will subject him to sanctions provided for by law. If the reader of this message is not the intended recipient, please be notified that any reading, dissemination, distribution, copying or other use of this message or its attachments is strictly prohibited. If you have received this transmittal in error, please notify the sender immediately.

2 1

Inquiry increased work load
by Jerico M. Rubion 25 Mar '15

25 Mar '15

Hi, Is there an automatic upgrade/patch that happened last March 24 2015 (1pm) EST Timezone? I'm getting an incremental increase of CPU load starting from the date and time I specified, I didn't change any settings in observium application even in the cronjobs. Output of: ps aux | sort -nrk 3 | head root 12585 8.5 0.0 4612 696 ? R 02:12 0:00 /usr/bin/snmpbulkwalk - xxx -OQUs -m CISCO-IPSEC-FLOW-MONITOR-MIB -M /opt/observium/mibs udp:xxxxxxx:161 cipSecGlobalStats root 12546 7.0 0.0 4748 1540 ? R 02:12 0:00 /usr/bin/snmpwalk -v1 -c -OQUs -m SNMPv2-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp udp:xxxxxxx:161 snmp root 12581 6.5 0.0 4880 1744 ? R 02:12 0:00 /usr/bin/snmpget -v1 -c -Otv -M /opt/observium/mibs udp:xxxxxx:161 sysUpTime.0 root 12579 6.0 0.0 4932 1828 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -r 0 -v2c -c -OqsX -m BRIDGE-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp udp:xxxxxx:161 dot1dTpFdbEntry root 12573 6.0 0.0 0 0 ? R 02:12 0:00 [snmpbulkwalk] root 12571 6.0 0.0 5008 1888 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -v2c -c -OQUn -M /opt/observium/mibs udp:xxxxx:161 .1.3.6.1.4.1.9.9.13.1 root 12569 6.0 0.0 4748 1668 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -r 0 -v2c -c -OqsX -m BRIDGE-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp udp:xxxxxxx:161 dot1dTpFdbEntry root 12582 5.5 0.0 4924 1968 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -v2c -c -OQUs -m IF-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp udp:xxxxx:161 ifEntry root 12539 5.3 0.0 5016 1884 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -v2c -c -OQUs -m CISCO-VLAN-MEMBERSHIP-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp:/opt/observium/mibs/cis co udp:xxxxxx:161 vmVlan root 12557 5.0 0.0 5016 1872 ? R 02:12 0:00 /usr/bin/snmpbulkwalk -v2c -c -OQUs -m CISCO-VLAN-MEMBERSHIP-MIB -M /opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp:/opt/observium/mibs/cis co udp:xxxxxx:161 vmVlan Note: xxxxx is used to replaced sensitive information Kindly see attached screenshot for the incremental increase of CPU load that happend last Match 24 1pm (EST Timezone) Best Regards, Jerico M. Rubion | 77GSI IT Services Group SEVEN SEVEN GLOBAL SERVICES INC. | 27th Floor, Orient Square Bldg., F. Ortigas Jr. Ortigas Center, Pasig City, Philippines 1605 Office: +632.915.7747 ext. 1911 | Mobile: +63.9175382740 | Duo: +632.9667501 The Information contained and all attachments to this email are for the named recipient(s) only. It contains legally privileged and confidential information intended solely for the use of the addressee. The addressee undertakes to use such information consistent with its privileged and confidential character, and by the receipt thereof appreciates that any use contrary thereto will subject him to sanctions provided for by law. If the reader of this message is not the intended recipient, please be notified that any reading, dissemination, distribution, copying or other use of this message or its attachments is strictly prohibited. If you have received this transmittal in error, please notify the sender immediately.

1 0

Re: [Observium] howto control ports
by Tom Laermans 25 Mar '15

25 Mar '15

You typo'd your realname in your mail client setup ;) 'Ports' is quite a confusing word to use in this context indeed... Tom On Mar 24, 2015 8:38 PM, Adam Armstronf <adama(a)memetic.org> wrote: > > Well, that was totally not obvious! > > We don't actually do any "port" monitoring at all, the old services code is long since deprecated and probably broken. > > Adam. > > Sent with AquaMail for Android > http://www.aqua-mail.com > > On 24 March 2015 12:17:28 Frank Lahr <logman0u812(a)gmail.com> wrote: >> >> He wants to monitor an applications port(s), up/down and the data going going threw it. >> I was thinking about using Observium to monitor dicom/hl7 ports too, but have not looked into it yet. >> >> Frank >> >> On Tue, Mar 24, 2015 at 2:48 AM, Adam Armstrong <adama(a)memetic.org> wrote: >>> >>> I think you might be using the wrong words :) >>> >>> adam. >>>> >>>> On 24/03/2015 06:25:33, J.P.M.H. Geerets <j.p.geerets(a)amc.uva.nl> wrote: >>>> >>>> Hi folks, >>>> >>>> Bit new here. >>>> >>>> Have an observium (community edition) install in test environment. >>>> Is het possible to creat my own ports to test on? >>>> Want to test for example ports on a cloverleaf (communication) server to check orm messages etc. >>>> Also wanna check dicomports, mostly on 104. >>>> >>>> Any idea how to do this with observium? >>>> >>>> >>>> Met vriendelijke groet, >>>> >>>> Jean-Paul >>>> --- >>>> Jean-Paul Geerets - ICT Radiologie >>>> >>>> ________________________________ >>>> >>>> AMC Disclaimer : http://www.amc.nl/disclaimer >>>> >>>> ________________________________ >>>> _______________________________________________ >>>> observium mailing list >>>> observium(a)observium.org >>>> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>> >>> >>> _______________________________________________ >>> observium mailing list >>> observium(a)observium.org >>> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>> >> >> >> >> -- >> Frank >> _______________________________________________ >> observium mailing list >> observium(a)observium.org >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>

3 2

Re: [Observium] (no subject)
by Adam Armstrong 25 Mar '15

25 Mar '15

Either SNMP timeout, SNMP stack bug or vendor bug. Adam. On 25 Mar 2015 02:06, Zach Underwood <zunder1990(a)gmail.com> wrote: > > I get the same thing about the interfaces nulling on some of my HP 1910 switches. > > On Mar 24, 2015 10:02 PM, "Christopher Pole" <chris(a)apexn.com.au> wrote: >> >> Poor choice of terms on my part regarding discovery, let me try again. >> >> Every now and then Observium will go through and mark every interface attribute on this device as NULL and then shortly thereafter re-learn the attributes, for example: >> >> Time: 2015-03-25 00:56:26 >> Port: lag2 >> Message: Interface changed: [ifName] LAG2 -> NULL; [ifAlias] Trunk: sw01 -> NULL; [ifAdminStatus] up -> NULL; [ifOperStatus] up -> NULL; [ifMtu] 9216 -> NULL; [ifSpeed] 2000000000 -> NULL; [ifHighSpeed] 2000 -> NULL; [ifType] ieee8023adLag -> NULL; [ifPhysAddress] 001bed9fa841 -> NULL; [ifPromiscuousMode] true -> NULL; [ifConnectorPresent] false -> NULL >> >> At this point the alert triggers for this interface, as anything over 0bps is triggers the >85% util alarm. >> >> Shortly thereafter observium relearns the interface attributes: >> >> Time: 2015-03-25 01:00:16 >> Port: lag2 >> Message: Interface changed: [ifName] -> LAG2; [ifAlias] -> Trunk: sw01; [ifAdminStatus] -> up; [ifOperStatus] -> up; [ifMtu] -> 9216; [ifSpeed] -> 2000000000; [ifHighSpeed] -> 2000; [ifType] -> ieee8023adLag; [ifPhysAddress] -> 001bed9fa841; [ifPromiscuousMode] -> true; [ifConnectorPresent] -> false >> >> At this point the alert sends a recovery message. >> >> The nullification and re-learning of interface attributes happens periodically but with no fixed schedule. Is this possibly something that can be caused by a bulk-walk failure part way through? Or an SNMP timeout? >> >> Thanks, >> >> Chris >> >> >> On Wed, Mar 25, 2015 at 10:41 AM, Adam Armstrong <adama(a)memetic.org> wrote: >>> >>> Nothing gets rediscovered at any frequency other than the frequency with which you run discovery.php. >>> >>> Almost everything collected by the poller is collected by snmpbulkwalk. >>> >>> It's possible that bulkwalk is failing part way through for this device causing the ifHighSpeed to be set to zero (or set to the value of ifSpeed, which will be just as useless on ports >1Gb) >>> >>> adam. >>>> >>>> On 24/03/2015 22:16:43, Christopher Pole <chris(a)apexn.com.au> wrote: >>>> >>>> Hi folks, >>>> >>>> we have an alert that triggers when certain ports hit >85% utilisation being triggered by a single device on a regular basis as it seems to get rewalked quite often, which briefly sets the speed of the monitored ports to 0 which then triggers the alert as any utilisation over 0 is >85% :). >>>> >>>> The device is a Brocade CES, but it is the only one in our fleet that suffers from this rediscover > trigger alert issue. Though the others also seem to rediscover more often than is necessary. >>>> >>>> Any thoughts on how I might figure out what is going on so I can fix it? >>>> >>>> Thanks, >>>> Chris >>>> _______________________________________________ observium mailing list observium(a)observium.org http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>> >>> >>> _______________________________________________ >>> observium mailing list >>> observium(a)observium.org >>> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>> >> >> >> _______________________________________________ >> observium mailing list >> observium(a)observium.org >> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium >>

1 0

(no subject)
by Christopher Pole 25 Mar '15

25 Mar '15

Hi folks, we have an alert that triggers when certain ports hit >85% utilisation being triggered by a single device on a regular basis as it seems to get rewalked quite often, which briefly sets the speed of the monitored ports to 0 which then triggers the alert as any utilisation over 0 is >85% :). The device is a Brocade CES, but it is the only one in our fleet that suffers from this rediscover > trigger alert issue. Though the others also seem to rediscover more often than is necessary. Any thoughts on how I might figure out what is going on so I can fix it? Thanks, Chris

3 3