devmon-support — General Devmon support

[Devmon] combine 2 OIDs

[Stef C. <ste...@do...>]

Hi,

I want to combine 2 OIDs in the threshold file so I can set the color if 
each OID has a certain status.

I don't find a transform or threholds option to combine the status of 
the OIDs.

Can this be done?


Stef

Re: [Devmon] Unpack HEX Ip

[Wim N. <wim...@zi...>]

Hello Oliver,

When rereading your e-mail it became clear that the IP address in 
cipSecEndPtRemoteAddr1 is not encoded as an hexadecimal string (8 characters) but 
as an octet string (4 characters).

Still, it is possible to use a single transform to get the desired result, if  
Devmon patch # 36 (which patches only two lines in Devmon) is applied. The 
transform is:

ip1 : REGSUB : {cipSecEndPtRemoteAddr1} /^(.)(.)(.)(.)$/ord($1) . '.' . ord($2) . 
'.' . ord($3) . '.' . ord($4)/e

Regards,

   Wim Nelis.

Re: [Devmon] Unpack HEX Ip

[<ol...@nm...>]

hello Buchan,

- I don't get why concat is not working. Any idea or example how to user 
it ?
- Yes probably a just printf may be good :)
- I already try the REGSUB with /.*/ but was not working. I will try 
yours.

many thx for you quick answer !!

oau

On 26.04.2017 06:53, Buchan Milne wrote:
> Hi Olivier,
> 
> There should probably be a transform that can use e.g. printf or 
> similar.
> 
> However, you can probably get what you need with REGSUB, e.g.:
> 
> ip1: REGSUB : {cipSecEndPtRemoteAddr11d} /^.*$/$1.{
> cipSecEndPtRemoteAddr12d}.{cipSecEndPtRemoteAddr13d}.{
> cipSecEndPtRemoteAddr14d}/
> 
> (or similar)
> 
> Regards,
> Buchan
> 
> On Tue, Apr 25, 2017 at 10:44 PM, <ol...@nm...> wrote:
> 
>> hello
>> 
>> I'm working on a template for asa vpn. I got ips in HEX format and I
>> would like to get them in cidr way.
>> 
>> I started like this :
>> 
>> cipSecEndPtRemoteAddr11B : SUBSTR : {cipSecEndPtRemoteAddr1} 0 1
>> cipSecEndPtRemoteAddr12B : SUBSTR : {cipSecEndPtRemoteAddr1} 1 1
>> cipSecEndPtRemoteAddr13B : SUBSTR : {cipSecEndPtRemoteAddr1} 2 1
>> cipSecEndPtRemoteAddr14B : SUBSTR : {cipSecEndPtRemoteAddr1} 3 1
>> 
>> cipSecEndPtRemoteAddr11H : UNPACK : {cipSecEndPtRemoteAddr11B} H2
>> cipSecEndPtRemoteAddr12H : UNPACK : {cipSecEndPtRemoteAddr12B} H2
>> cipSecEndPtRemoteAddr13H : UNPACK : {cipSecEndPtRemoteAddr13B} H2
>> cipSecEndPtRemoteAddr14H : UNPACK : {cipSecEndPtRemoteAddr14B} H2
>> 
>> cipSecEndPtRemoteAddr11d : CONVERT : {cipSecEndPtRemoteAddr11H} hex
>> cipSecEndPtRemoteAddr12d : CONVERT : {cipSecEndPtRemoteAddr12H} hex
>> cipSecEndPtRemoteAddr13d : CONVERT : {cipSecEndPtRemoteAddr13H} hex
>> cipSecEndPtRemoteAddr14d : CONVERT : {cipSecEndPtRemoteAddr14H} hex
>> 
>> ip1: MATH : {cipSecEndPtRemoteAddr11d} . {cipSecEndPtRemoteAddr12d} .
>> {cipSecEndPtRemoteAddr13d} . {cipSecEndPtRemoteAddr14d}
>> 
>> where cipSecEndPtRemoteAddr1 is the ip in HEX. It's working well 
>> except
>> I'm not able to just concat the 4 element in one.
>> 
>> any clue ?
>> 
>> many thx
>> 
>> oau
>> 
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> Devmon-support mailing list
>> Dev...@li...
>> https://lists.sourceforge.net/lists/listinfo/devmon-support
>> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support

Re: [Devmon] Unpack HEX Ip

[Wim N. <wim...@zi...>]

Hello Oliver,

if Devmon patch # 36 is installed, the transformation becomes easier. In that 
case the following transform would do the job:

ip1 : REGSUB : {cipSecEndPtRemoteAddr1} /^(..)(..)(..)(..)$/hex($1) . '.' . 
hex($2) . '.' . hex($3) . '.' . hex($4)/e

It is assumed that the string in cipSecEndPtRemoteAddr1 always contains exactly 8 
hexadecimal digits.

Regards,
   Wim Nelis.


> There should probably be a transform that can use e.g. printf or similar.
>
> However, you can probably get what you need with REGSUB, e.g.:
>
> ip1: REGSUB : {cipSecEndPtRemoteAddr11d} /^.*$/$1.{ cipSecEndPtRemoteAddr12d}.{cipSecEndPtRemoteAddr13d}.{
> cipSecEndPtRemoteAddr14d}/
>
> (or similar)
>
> Regards,
> Buchan
>
> On Tue, Apr 25, 2017 at 10:44 PM, <ol...@nm...> wrote:
>
>> hello
>>
>> I'm working on a template for asa vpn. I got ips in HEX format and I
>> would like to get them in cidr way.
>>
>> I started like this :
>>
>> cipSecEndPtRemoteAddr11B : SUBSTR : {cipSecEndPtRemoteAddr1} 0 1
>> cipSecEndPtRemoteAddr12B : SUBSTR : {cipSecEndPtRemoteAddr1} 1 1
>> cipSecEndPtRemoteAddr13B : SUBSTR : {cipSecEndPtRemoteAddr1} 2 1
>> cipSecEndPtRemoteAddr14B : SUBSTR : {cipSecEndPtRemoteAddr1} 3 1
>>
>> cipSecEndPtRemoteAddr11H : UNPACK : {cipSecEndPtRemoteAddr11B} H2
>> cipSecEndPtRemoteAddr12H : UNPACK : {cipSecEndPtRemoteAddr12B} H2
>> cipSecEndPtRemoteAddr13H : UNPACK : {cipSecEndPtRemoteAddr13B} H2
>> cipSecEndPtRemoteAddr14H : UNPACK : {cipSecEndPtRemoteAddr14B} H2
>>
>> cipSecEndPtRemoteAddr11d : CONVERT : {cipSecEndPtRemoteAddr11H} hex
>> cipSecEndPtRemoteAddr12d : CONVERT : {cipSecEndPtRemoteAddr12H} hex
>> cipSecEndPtRemoteAddr13d : CONVERT : {cipSecEndPtRemoteAddr13H} hex
>> cipSecEndPtRemoteAddr14d : CONVERT : {cipSecEndPtRemoteAddr14H} hex
>>
>> ip1: MATH : {cipSecEndPtRemoteAddr11d} . {cipSecEndPtRemoteAddr12d} .
>> {cipSecEndPtRemoteAddr13d} . {cipSecEndPtRemoteAddr14d}
>>
>> where cipSecEndPtRemoteAddr1 is the ip in HEX. It's working well
>> except I'm not able to just concat the 4 element in one.
>>
>> any clue ?
>>
>> many thx
>>
>> oau
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> Devmon-support mailing list
>> Dev...@li...
>> https://lists.sourceforge.net/lists/listinfo/devmon-support
>>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>
>
>

Re: [Devmon] Unpack HEX Ip

[Buchan M. <bg...@gm...>]

Hi Olivier,

There should probably be a transform that can use e.g. printf or similar.

However, you can probably get what you need with REGSUB, e.g.:

ip1: REGSUB : {cipSecEndPtRemoteAddr11d} /^.*$/$1.{
cipSecEndPtRemoteAddr12d}.{cipSecEndPtRemoteAddr13d}.{
cipSecEndPtRemoteAddr14d}/

(or similar)

Regards,
Buchan

On Tue, Apr 25, 2017 at 10:44 PM, <ol...@nm...> wrote:

> hello
>
> I'm working on a template for asa vpn. I got ips in HEX format and I
> would like to get them in cidr way.
>
> I started like this :
>
> cipSecEndPtRemoteAddr11B : SUBSTR : {cipSecEndPtRemoteAddr1} 0 1
> cipSecEndPtRemoteAddr12B : SUBSTR : {cipSecEndPtRemoteAddr1} 1 1
> cipSecEndPtRemoteAddr13B : SUBSTR : {cipSecEndPtRemoteAddr1} 2 1
> cipSecEndPtRemoteAddr14B : SUBSTR : {cipSecEndPtRemoteAddr1} 3 1
>
> cipSecEndPtRemoteAddr11H : UNPACK : {cipSecEndPtRemoteAddr11B} H2
> cipSecEndPtRemoteAddr12H : UNPACK : {cipSecEndPtRemoteAddr12B} H2
> cipSecEndPtRemoteAddr13H : UNPACK : {cipSecEndPtRemoteAddr13B} H2
> cipSecEndPtRemoteAddr14H : UNPACK : {cipSecEndPtRemoteAddr14B} H2
>
> cipSecEndPtRemoteAddr11d : CONVERT : {cipSecEndPtRemoteAddr11H} hex
> cipSecEndPtRemoteAddr12d : CONVERT : {cipSecEndPtRemoteAddr12H} hex
> cipSecEndPtRemoteAddr13d : CONVERT : {cipSecEndPtRemoteAddr13H} hex
> cipSecEndPtRemoteAddr14d : CONVERT : {cipSecEndPtRemoteAddr14H} hex
>
> ip1: MATH : {cipSecEndPtRemoteAddr11d} . {cipSecEndPtRemoteAddr12d} .
> {cipSecEndPtRemoteAddr13d} . {cipSecEndPtRemoteAddr14d}
>
> where cipSecEndPtRemoteAddr1 is the ip in HEX. It's working well except
> I'm not able to just concat the 4 element in one.
>
> any clue ?
>
> many thx
>
> oau
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>

[Devmon] Unpack HEX Ip

[<ol...@nm...>]

hello

I'm working on a template for asa vpn. I got ips in HEX format and I 
would like to get them in cidr way.

I started like this :

cipSecEndPtRemoteAddr11B : SUBSTR : {cipSecEndPtRemoteAddr1} 0 1
cipSecEndPtRemoteAddr12B : SUBSTR : {cipSecEndPtRemoteAddr1} 1 1
cipSecEndPtRemoteAddr13B : SUBSTR : {cipSecEndPtRemoteAddr1} 2 1
cipSecEndPtRemoteAddr14B : SUBSTR : {cipSecEndPtRemoteAddr1} 3 1

cipSecEndPtRemoteAddr11H : UNPACK : {cipSecEndPtRemoteAddr11B} H2
cipSecEndPtRemoteAddr12H : UNPACK : {cipSecEndPtRemoteAddr12B} H2
cipSecEndPtRemoteAddr13H : UNPACK : {cipSecEndPtRemoteAddr13B} H2
cipSecEndPtRemoteAddr14H : UNPACK : {cipSecEndPtRemoteAddr14B} H2

cipSecEndPtRemoteAddr11d : CONVERT : {cipSecEndPtRemoteAddr11H} hex
cipSecEndPtRemoteAddr12d : CONVERT : {cipSecEndPtRemoteAddr12H} hex
cipSecEndPtRemoteAddr13d : CONVERT : {cipSecEndPtRemoteAddr13H} hex
cipSecEndPtRemoteAddr14d : CONVERT : {cipSecEndPtRemoteAddr14H} hex

ip1: MATH : {cipSecEndPtRemoteAddr11d} . {cipSecEndPtRemoteAddr12d} . 
{cipSecEndPtRemoteAddr13d} . {cipSecEndPtRemoteAddr14d}

where cipSecEndPtRemoteAddr1 is the ip in HEX. It's working well except 
I'm not able to just concat the 4 element in one.

any clue ?

many thx

oau

Re: [Devmon] possible bug in multinode

[Buchan M. <bg...@gm...>]

> OK, this one has taken me a bit to track down. I updated my xymon config
> and devmon died.
>

Did the normally polling process die? Do you have any relevant log
messages? Or did it exhibit the same behaviour as below?


>
> Below is the devmon/xymon info from the xymon hosts file:
>
> DEVMON:model(cisco;2960),except(all;ifName;ao:Gi1/0/[1-
> 4]|Gi1/0/[7,8,9,10,11]|Gi1/0/[23,24,25,26,27,28,29,30,31,32,
> 33,34]|Gi1/0/[45,46,47,48])
>

You can't use commas inside the regex, as it makes it difficult to parse
the different types of options (which are separated by commas).

You probably want something like this:

DEVMON:model(cisco;2960),except(all;ifName;ao:Gi1/0/[1-4]|Gi1/0/([7-9]|10|11|2[3-9]|3[0-4]|4[5-8]))

This kind of problem is that my colleagues have had as well, and maybe at
some point it needs to be easier to configure devmon. But that would
probably require a database of some kind (where at present using a database
is optional), and the Xymon community seems to be averse to requiring a
database.


>
> After I make a mod in that, I restart devmon.  My init script executes
>
> devmon --readbbhosts
>
> to update the database.  What I find in the DB, with the line above is:
>
> | switch       | all     | ifName | alarm   | Gi1/0/[1-4]|Gi1/0/[7 |
>
> so the DB update is being truncated.  Just for fun, I manually updated the
> DB with information as in the hosts and devmon is completely happy.
> Running devmon with the data above,
> and devmon exist with an error for the regex (correctly).
>
> when I use this regex:
>
> DEVMON:model(cisco;2960),except(all;ifName;ao:Gi1/0/[1-
> 4]|Gi1/0/[7-11]|Gi1/0/[23-34]|Gi1/0/[45-48]
>

This regex is invalid, as the values inside square brackets in a *regex*
need to represent a consecutive range of single characters, not a range of
values.


>
> the database loads correctly:
>
> | switch       | all     | ifName | alarm   | Gi1/0/[1-4]|Gi1/0/[7-11]|Gi1/0/[23-34]|Gi1/0/[45-48]
> |
>
> and devmon still dies parsing the regex:
>
> Invalid [] range "7-1" in regex; marked by <-- HERE in
> m/^(Gi1/0/[1-4]|Gi1/0/[7-1 <-- HERE 1]|Gi1/0/[23-34]|Gi1/0/[45-48])$/ at
> /usr/local/devmon-0.3.1-beta1/modules/dm_tests.pm
> line 1853
>
> bug or do I just not understand?
>
>
Well, the best solution here is that same code should actually be used to
validate the regex when loading the config as at run-time, so that anything
that is accepted into configuration will not cause devmon to die.

Regards,
Buchan

[Devmon] possible bug in multinode

[Bruce F. <bfe...@ba...>]

OK, this one has taken me a bit to track down. I updated my xymon config and devmon died.

Below is the devmon/xymon info from the xymon hosts file:

DEVMON:model(cisco;2960),except(all;ifName;ao:Gi1/0/[1-4]|Gi1/0/[7,8,9,10,11]|Gi1/0/[23,24,25,26,27,28,29,30,31,32,33,34]|Gi1/0/[45,46,47,48])

After I make a mod in that, I restart devmon.  My init script executes

devmon --readbbhosts

to update the database.  What I find in the DB, with the line above is:

| switch       | all     | ifName | alarm   | Gi1/0/[1-4]|Gi1/0/[7 |

so the DB update is being truncated.  Just for fun, I manually updated the DB with information as in the hosts and devmon is completely happy.  Running devmon with the data above, 
and devmon exist with an error for the regex (correctly).

when I use this regex:

DEVMON:model(cisco;2960),except(all;ifName;ao:Gi1/0/[1-4]|Gi1/0/[7-11]|Gi1/0/[23-34]|Gi1/0/[45-48]

the database loads correctly:

| switch       | all     | ifName | alarm   | Gi1/0/[1-4]|Gi1/0/[7-11]|Gi1/0/[23-34]|Gi1/0/[45-48] |

and devmon still dies parsing the regex:

Invalid [] range "7-1" in regex; marked by <-- HERE in m/^(Gi1/0/[1-4]|Gi1/0/[7-1 <-- HERE 1]|Gi1/0/[23-34]|Gi1/0/[45-48])$/ at /usr/local/devmon-0.3.1-beta1/modules/dm_tests.pm 
line 1853

bug or do I just not understand?

Re: [Devmon] Cisco 2960 uptime wrap

[Nelis, W. <Wim...@nl...>]

Hello Bruce,

See Devmon patch #12 for an alternative: https://sourceforge.net/p/devmon/patches/12/

Regards,
  Wim Nelis.

-----Original Message-----
From: Bruce Ferrell [mailto:bfe...@ba...] 
Sent: 23 March 2017 16:23
To: dev...@li...
Subject: [Devmon] Cisco 2960 uptime wrap

I'm using devmon with xymon and I got an interesting surprise this am.  An alert for CPU/uptime.

The messages indicated last reboot reason was power up.

The OID in the template for this is .1.3.6.1.2.1.1.3.0 RFC1213-MIB::sysUpTime.0 = Timeticks:

After investigating the switch and seeing it thought it had been up over a year, I did some googling and found that OID is a 32 bit int and it wraps at 496 days, resulting in xymon thinking the device just booted.

I can see why that OID might be used; it returns not just the timeticks but also an uptime in hours:minutes:seconds.  Easy to parse, but "prone" to this error.

Can anyone think of a better OID to use?

[Devmon] Cisco 2960 uptime wrap

[Bruce F. <bfe...@ba...>]

I'm using devmon with xymon and I got an interesting surprise this am.  An alert for CPU/uptime.

The messages indicated last reboot reason was power up.

The OID in the template for this is .1.3.6.1.2.1.1.3.0 RFC1213-MIB::sysUpTime.0 = Timeticks:

After investigating the switch and seeing it thought it had been up over a year, I did some googling and found that OID is a 32 bit int and it wraps at 496 days, resulting in xymon 
thinking the device just booted.

I can see why that OID might be used; it returns not just the timeticks but also an uptime in hours:minutes:seconds.  Easy to parse, but "prone" to this error.

Can anyone think of a better OID to use?

Re: [Devmon] Devmon on Ubuntu

[Jeremy L. <jla...@re...>]

John

Your perl probably cannot see BER.pm. In my devmon I added these extra "use
lib" lines near the top after "use FindBin" and replacing another line
containing $FindBin that didn't find the bins like it was supposed to:

  use FindBin;
  use lib "/usr/lib/devmon/modules";
  use lib "/usr/share/devmon/modules";
  use dm_config;

I have my BER.pm installed into /usr/lib/devmon/modules/ and this tells
devmon where to look. If you've installed it elsewhere, you should adjust
accordingly.

J


On 17 December 2016 at 00:27, <joh...@ac...> wrote:

> Does anyone have devmon working on Ubuntu (16.04.1 LTS)?
>
> I have tried 3 different servers and I keep ending up with the following
> error:
>
> [16-12-16@07:20:40] Querying new hosts /w custom cids using snmp v2
> Undefined subroutine &dm_snmp::encode_oid called at
> /home/xymon/devmon/modules/dm_snmp.pm line 480, <__ANONIO__> line 9.
>
> I have found a couple of suggestions that either BER.pm or SNMP_Session.pm
> are not installed but both are installed.  Links within the installation
> doc for SNMP Session are no longer valid.
>
> What else can I try?
> What am I doing wrong?
>
> Thanks,
> John
> _____________________________________________________________________
> John Rothlisberger
> IT Strategy, Infrastructure & Security - Technology Growth Platform
> TGP for Business Process Outsourcing
> Accenture
> 312.693.3136 office
> _____________________________________________________________________
>
>
> ________________________________
>
> This message is for the designated recipient only and may contain
> privileged, proprietary, or otherwise confidential information. If you have
> received it in error, please notify the sender immediately and delete the
> original. Any other use of the e-mail by you is prohibited. Where allowed
> by local law, electronic communications with Accenture and its affiliates,
> including e-mail and instant messaging (including content), may be scanned
> by our systems for the purposes of information security and assessment of
> internal compliance with Accenture policy.
> ____________________________________________________________
> __________________________
>
> www.accenture.com
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Hi Wim,

2017-01-16 15:42 GMT+01:00 W.J.M. Nelis <Wim...@nl...>:

> Hello Peter,
>
> > There is one network object that is queried by two vm's (xymon-dev,
> > xymon-acc) and one hw box.
> > The two vm's are preps for a new xymon server with the latest and
> greatest;
> > the hw box is our current xymon prod box.
> >
> > Only the hw box works as expected. The two vm's are similar build and
> > produces spikes at different times.
> So the spikes seem to result from a timing problem.
> Do you see messages containing "duplicate RRD data with same timestamp" in
> /var/log/xymon/rrd-status.log?
>
No "duplicate RRD" messages found.
I'm trying to see if a hardware box (the new Xymon server to be) produces
the same behaviour.

>
> > What the three hosts have in common is the Xymon-html-output for this
> > network device. Which shows normal output. The hidden devmon code is also
> > normal. A batch job that queries the network device also produces normal
> > output (your previous suggestion, as I recall).
> You've shown the list of names of the interfaces, retrieved using snmpwalk.
> Some interface names appear two times. This implies that two updates are
> sent at the same time for some interfaces to RRD. From what I've seen, the
> value at the second occurrence of an interface name is always zero. If that
> one is handled before the other one, you'll get a spike.
>
That would be a good assumption.


>
> > So I have rrd files that when I look into these files show absurd values.
> > But that could be perhaps an error in the processing of the hidden devmon
> > code? Or an rrd anomaly? Or just my own 'unknown error'?
> The problem does not occur at xymon running on bare metal. My guess is that
> if you retrieve the list of interfaces from that machine, there are no
> duplicate interface names in it. Thus, probably you're problem will be gone
> if you move from a VM to bare metal.
>
The same devmon if_load-test is performed on bare metal, that produces the
same hidden devices output with a 0 value for the duplicate devices.
And yes, on this server, there are no spikes. That's whats makes it so
weird to me.

But I am going to implement the same test on the new hardware, that is
waiting for deployment ;-)


>
> >
> > What I just did:
> > I tried to minimize the shown devices. So I managed to do so, by
> re-using a
> > field shown (Errors in) from the If_Err-test.
> This I do not understand.
>
Sorry, I tried to exclude the duplicate (hidden) output by trying to
restrict devmon. Because the if_err-output does not show the duplicate
output. I stole some code and tried to apply this to the if_load test. It
did not work, so I reverted the test. :-/


> >   But underneath all the
> > 64-bits interfaces are queried, so devmon output is still shown for all
> the
> > devices.
> >
> > <!--DEVMON RRD: if_load 0 0DS:ds0:COUNTER:600:0:U
> > DS:ds1:COUNTER:600:0:Umgmt0 8879632404:16047447934loopback0
> > 15094564810:145416650Ethernet3_1 5145707654:5008405830Ethernet3_2
> > 275179849444513:598883108402034Ethernet3_3
> > 1100302946652053:951076190448071Ethernet3_4
> > 51407929508676:69081629766292Ethernet3_5
> > 823099309481:5352820011173Ethernet3_6 199285632:199285632Ethernet3_7
> > 199285632:199285632Ethernet3_8 199285632:199285632Ethernet4_1
> > 3118632864693475:491943590772051Ethernet4_2
> > 414769440784827:649329384941863Ethernet4_3
> > 103430757126278:415216974406768Ethernet4_4
> > 156480646041793:681504646556060Ethernet4_5
> > 299330487390116:1361606088437009Ethernet4_6
> > 45595170267863:313429801053492Ethernet4_7
> > 199285632:199285632Ethernet4_8 199285632:199285632Ethernet3_1
> > 0:0Ethernet3_2 0:0Ethernet3_3 0:0Ethernet4_1 0:0Ethernet4_2
> > 0:0Ethernet4_3 0:0Ethernet4_4 0:0Ethernet4_5 0:0Ethernet4_6
> > 0:0Ethernet3_4 0:0Ethernet3_5 0:0-->
> >
> > And now I will try your suggestion using exceptions file:
> >
> > [root@uhu-o if_load]# cat exceptions
> >
> > #ifName : alarm  : .+
> >
> > ifName : ignore : Nu.+|Vl.+|VLAN.+
> >
> > ifHCInOctets : only : 0
> > Unfortunately the output remains the same as above (for all counters).
> > Perhaps I'm missing something here...?
> >
> Sorry, I've made an error in this configuration snippet. The idea is to
> ignore those interfaces which show an octet counter with value 0, as those
> are (almost always) the duplicate interfaces. The snippet should read:
>
> ifHCInOctets : ignore : 0
>
Done, but it did not work. I have to investigate more to make sure I'm
using the correct syntax and name. Something for later this week...


>
> Which version of devmon are you using?
>
0.3.1-beta1 old (on my old hobbit/xymon server, and development server) and
the one from the recent tree (that works fine with Xymon with the new
hosts.d/subdirectories).

Both produce the same spikey result.


> In the version at sourceforge, devmon-0.3.1-beta1.tar.gz, a parameter
> 'all' is used in the rrd directive of the TABLE command in file message. In
> a later patch, available via URL
> https://sourceforge.net/p/devmon/code/HEAD/tree/trunk/, this has been
> changed a bit. How does your message file looks like?
>
> Regards,
>    Wim Nelis.
>

The message file:

<b>Interface error rates:</b>

Input load:  yellow={ifInLoad_T.thresh:yellow}%,

red={ifInLoad_T.thresh:red}%

Output load: yellow={ifOutLoad_T.thresh:yellow}%,

red={ifOutLoad_T.thresh:red}%

TABLE: noalarmsmsg,rrd(DS:ds0:ifHCInOctets:COUNTER;
DS:ds1:ifHCOutOctets:COUNTER)

Interface Name|Interface Speed|Rate in (load %)|Rate out (load %)

{ifName}{ifAliasBox}|{ifHighSpeed_T}|{ifInLoad_T.color}{ifInSpeed_T}
({ifInLoad_T}%){ifInLoad_T.errors}|{ifOutLoad_T.color}{ifOutSpeed_T}
({ifOutLoad_T}%){ifOutLoad_T.errors}

Waiting for the hardware deployment for the next step ;-)

Peter

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[W.J.M. N. <Wim...@nl...>]

Hello Peter,

> There is one network object that is queried by two vm's (xymon-dev,
> xymon-acc) and one hw box.
> The two vm's are preps for a new xymon server with the latest and greatest;
> the hw box is our current xymon prod box.
>
> Only the hw box works as expected. The two vm's are similar build and
> produces spikes at different times.
So the spikes seem to result from a timing problem.
Do you see messages containing "duplicate RRD data with same timestamp" in 
/var/log/xymon/rrd-status.log?

> What the three hosts have in common is the Xymon-html-output for this
> network device. Which shows normal output. The hidden devmon code is also
> normal. A batch job that queries the network device also produces normal
> output (your previous suggestion, as I recall).
You've shown the list of names of the interfaces, retrieved using snmpwalk. 
Some interface names appear two times. This implies that two updates are 
sent at the same time for some interfaces to RRD. From what I've seen, the 
value at the second occurrence of an interface name is always zero. If that 
one is handled before the other one, you'll get a spike.

> So I have rrd files that when I look into these files show absurd values.
> But that could be perhaps an error in the processing of the hidden devmon
> code? Or an rrd anomaly? Or just my own 'unknown error'?
The problem does not occur at xymon running on bare metal. My guess is that 
if you retrieve the list of interfaces from that machine, there are no 
duplicate interface names in it. Thus, probably you're problem will be gone 
if you move from a VM to bare metal.

>
> What I just did:
> I tried to minimize the shown devices. So I managed to do so, by re-using a
> field shown (Errors in) from the If_Err-test.
This I do not understand.

>   But underneath all the
> 64-bits interfaces are queried, so devmon output is still shown for all the
> devices.
>
> <!--DEVMON RRD: if_load 0 0DS:ds0:COUNTER:600:0:U
> DS:ds1:COUNTER:600:0:Umgmt0 8879632404:16047447934loopback0
> 15094564810:145416650Ethernet3_1 5145707654:5008405830Ethernet3_2
> 275179849444513:598883108402034Ethernet3_3
> 1100302946652053:951076190448071Ethernet3_4
> 51407929508676:69081629766292Ethernet3_5
> 823099309481:5352820011173Ethernet3_6 199285632:199285632Ethernet3_7
> 199285632:199285632Ethernet3_8 199285632:199285632Ethernet4_1
> 3118632864693475:491943590772051Ethernet4_2
> 414769440784827:649329384941863Ethernet4_3
> 103430757126278:415216974406768Ethernet4_4
> 156480646041793:681504646556060Ethernet4_5
> 299330487390116:1361606088437009Ethernet4_6
> 45595170267863:313429801053492Ethernet4_7
> 199285632:199285632Ethernet4_8 199285632:199285632Ethernet3_1
> 0:0Ethernet3_2 0:0Ethernet3_3 0:0Ethernet4_1 0:0Ethernet4_2
> 0:0Ethernet4_3 0:0Ethernet4_4 0:0Ethernet4_5 0:0Ethernet4_6
> 0:0Ethernet3_4 0:0Ethernet3_5 0:0-->
>
> And now I will try your suggestion using exceptions file:
>
> [root@uhu-o if_load]# cat exceptions
>
> #ifName : alarm  : .+
>
> ifName : ignore : Nu.+|Vl.+|VLAN.+
>
> ifHCInOctets : only : 0
> Unfortunately the output remains the same as above (for all counters).
> Perhaps I'm missing something here...?
>
Sorry, I've made an error in this configuration snippet. The idea is to 
ignore those interfaces which show an octet counter with value 0, as those 
are (almost always) the duplicate interfaces. The snippet should read:

ifHCInOctets : ignore : 0

Which version of devmon are you using?

In the version at sourceforge, devmon-0.3.1-beta1.tar.gz, a parameter 'all' is used in the rrd directive of the TABLE command in file message. In a later patch, available via URL
https://sourceforge.net/p/devmon/code/HEAD/tree/trunk/, this has been changed a bit. How does your message file looks like?

Regards,
   Wim Nelis.

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Hi Wim,

Thanks again for your quick response.

There is one network object that is queried by two vm's (xymon-dev,
xymon-acc) and one hw box.
The two vm's are preps for a new xymon server with the latest and greatest;
the hw box is our current xymon prod box.

Only the hw box works as expected. The two vm's are similar build and
produces spikes at different times.

What the three hosts have in common is the Xymon-html-output for this
network device. Which shows normal output. The hidden devmon code is also
normal. A batch job that queries the network device also produces normal
output (your previous suggestion, as I recall).

So I have rrd files that when I look into these files show absurd values.
But that could be perhaps an error in the processing of the hidden devmon
code? Or an rrd anomaly? Or just my own 'unknown error'?

What I just did:
I tried to minimize the shown devices. So I managed to do so, by re-using a
field shown (Errors in) from the If_Err-test. But underneath all the
64-bits interfaces are queried, so devmon output is still shown for all the
devices.

<!--DEVMON RRD: if_load 0 0DS:ds0:COUNTER:600:0:U
DS:ds1:COUNTER:600:0:Umgmt0 8879632404:16047447934loopback0
15094564810:145416650Ethernet3_1 5145707654:5008405830Ethernet3_2
275179849444513:598883108402034Ethernet3_3
1100302946652053:951076190448071Ethernet3_4
51407929508676:69081629766292Ethernet3_5
823099309481:5352820011173Ethernet3_6 199285632:199285632Ethernet3_7
199285632:199285632Ethernet3_8 199285632:199285632Ethernet4_1
3118632864693475:491943590772051Ethernet4_2
414769440784827:649329384941863Ethernet4_3
103430757126278:415216974406768Ethernet4_4
156480646041793:681504646556060Ethernet4_5
299330487390116:1361606088437009Ethernet4_6
45595170267863:313429801053492Ethernet4_7
199285632:199285632Ethernet4_8 199285632:199285632Ethernet3_1
0:0Ethernet3_2 0:0Ethernet3_3 0:0Ethernet4_1 0:0Ethernet4_2
0:0Ethernet4_3 0:0Ethernet4_4 0:0Ethernet4_5 0:0Ethernet4_6
0:0Ethernet3_4 0:0Ethernet3_5 0:0-->

And now I will try your suggestion using exceptions file:

[root@uhu-o if_load]# cat exceptions

#ifName : alarm  : .+

ifName : ignore : Nu.+|Vl.+|VLAN.+

ifHCInOctets : only : 0
Unfortunately the output remains the same as above (for all counters).
Perhaps I'm missing something here...?

regards,
Peter

2017-01-13 15:31 GMT+01:00 W.J.M. Nelis <Wim...@nl...>:

> Hello Peter,
>
> > Until now I checked and reproduced the error on two similar RHEL6
> servers:
> >
> > -both vm's
> > -Xymon version *Xymon 4.3.27-4.el6.terabithia
> > <http://xymon.sourceforge.net/>*
> >
> > Perl v5.10.1
> >
> > net-snmp-libs-5.5-57.el6_8.1.x86_64
> > net-snmp-5.5-57.el6_8.1.x86_64
> > net-snmp-utils-5.5-57.el6_8.1.x86_64
> > perl-SNMP_Session-1.12-4.el6.noarch
> > rrdtool-1.5.5-1.1.el6.x86_64
> >
> > -devmon: I tried two versions. One old version  $Id: README 96 2008-12-07
> > 20:01:21Z buchanmilne $ and the newest from svn://
> > svn.code.sf.net/p/devmon/code/trunk but the behaviour is the same for
> both.
> > Spikey to Tb of Pb :-(
> >
> > A script that queries the device showed no problem. So it suspect the
> > problem to be somewhere near the integration in Xymon and rrdtool, I
> think.
> >
> Do both vm's have a similar list of interfaces, that is with interfaces
> which occur two times in the list? Are those interfaces also visible in
> twofold in the CLI?
>
> My guess is that the two occurrences of an interface causes those spikes.
> If there is no other way to suppress those additional interfaces, and if
> the octet-counters for those additional (dummy) interfaces are always zero,
> the following might help:
>
> ---exceptions ---
> <OctetOut> : only : 0
>
> in which <OctetOut> is the name variable in the template containing the
> output octet counter. This variable should be used in the TABLE as well. If
> it works, it suppresses the lines in the table in which the output octet
> counter is zero. Thus it should suppress the second occurrence of
> interfaces. It is however not a nice solution.
>
> Regards,
>    Wim Nelis.
>
>
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today. http://sdm.link/xeonphi
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[W.J.M. N. <Wim...@nl...>]

Hello Peter,

> Until now I checked and reproduced the error on two similar RHEL6 servers:
>
> -both vm's
> -Xymon version *Xymon 4.3.27-4.el6.terabithia
> <http://xymon.sourceforge.net/>*
>
> Perl v5.10.1
>
> net-snmp-libs-5.5-57.el6_8.1.x86_64
> net-snmp-5.5-57.el6_8.1.x86_64
> net-snmp-utils-5.5-57.el6_8.1.x86_64
> perl-SNMP_Session-1.12-4.el6.noarch
> rrdtool-1.5.5-1.1.el6.x86_64
>
> -devmon: I tried two versions. One old version  $Id: README 96 2008-12-07
> 20:01:21Z buchanmilne $ and the newest from svn://
> svn.code.sf.net/p/devmon/code/trunk but the behaviour is the same for both.
> Spikey to Tb of Pb :-(
>
> A script that queries the device showed no problem. So it suspect the
> problem to be somewhere near the integration in Xymon and rrdtool, I think.
>
Do both vm's have a similar list of interfaces, that is with interfaces 
which occur two times in the list? Are those interfaces also visible in 
twofold in the CLI?

My guess is that the two occurrences of an interface causes those spikes. 
If there is no other way to suppress those additional interfaces, and if 
the octet-counters for those additional (dummy) interfaces are always zero, 
the following might help:

---exceptions ---
<OctetOut> : only : 0

in which <OctetOut> is the name variable in the template containing the 
output octet counter. This variable should be used in the TABLE as well. If 
it works, it suppresses the lines in the table in which the output octet 
counter is zero. Thus it should suppress the second occurrence of 
interfaces. It is however not a nice solution.

Regards,
   Wim Nelis.

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Until now I checked and reproduced the error on two similar RHEL6 servers:

-both vm's
-Xymon version *Xymon 4.3.27-4.el6.terabithia
<http://xymon.sourceforge.net/>*

Perl v5.10.1

net-snmp-libs-5.5-57.el6_8.1.x86_64
net-snmp-5.5-57.el6_8.1.x86_64
net-snmp-utils-5.5-57.el6_8.1.x86_64
perl-SNMP_Session-1.12-4.el6.noarch
rrdtool-1.5.5-1.1.el6.x86_64

-devmon: I tried two versions. One old version  $Id: README 96 2008-12-07
20:01:21Z buchanmilne $ and the newest from svn://
svn.code.sf.net/p/devmon/code/trunk but the behaviour is the same for both.
Spikey to Tb of Pb :-(

A script that queries the device showed no problem. So it suspect the
problem to be somewhere near the integration in Xymon and rrdtool, I think.

A snippet from the rrd-file itself (*bold* shows where the spike is shown
within Xymon):

                        <!-- 2017-01-13 12:35:00 CET / 1484307300 -->
<row><v>5.7105224900e+01</v><v>5.8115433942e+01</v></row>

                        <!-- 2017-01-13 12:40:00 CET / 1484307600 -->
<row><v>5.8957199343e+01</v><v>5.8392224460e+01</v></row>

                        <!-- 2017-01-13 12:45:00 CET / 1484307900 -->
<row><v>5.7099887492e+01</v><v>5.6687551450e+01</v></row>

                        <!-- 2017-01-13 12:50:00 CET / 1484308200 -->
<row><v>5.8605291571e+01</v><v>5.6760382434e+01</v></row>

                        <!-- 2017-01-13 12:55:00 CET / 1484308500 -->
<row><v>5.8580590782e+01</v><v>5.7980850059e+01</v></row>

                        <!-- 2017-01-13 13:00:00 CET / 1484308800 -->
<row><v>5.7861062111e+01</v><v>5.8227579693e+01</v></row>

                        <!-- 2017-01-13 13:05:00 CET / 1484309100 -->
<row><v>5.6812837466e+01</v><v>5.6722093664e+01</v></row>

                        <!-- 2017-01-13 13:10:00 CET / 1484309400 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 13:15:00 CET / 1484309700 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 13:20:00 CET / 1484310000 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 13:25:00 CET / 1484310300 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 13:30:00 CET / 1484310600 -->
<row><v>5.7004775956e+01</v><v>5.7555122040e+01</v></row>

                        <!-- 2017-01-13 13:35:00 CET / 1484310900 -->
<row><v>5.6252308123e+01</v><v>5.7254810458e+01</v></row>

*                        <!-- 2017-01-13 13:40:00 CET / 1484311200 -->
<row><v>3.1506835599e+16</v><v>3.1506835599e+16</v></row>*

*                        <!-- 2017-01-13 13:45:00 CET / 1484311500 -->
<row><v>2.9982311313e+16</v><v>2.9982311313e+16</v></row>*

                        <!-- 2017-01-13 13:50:00 CET / 1484311800 -->
<row><v>5.7708598566e+01</v><v>5.6476949821e+01</v></row>

                        <!-- 2017-01-13 13:55:00 CET / 1484312100 -->
<row><v>5.9456068100e+01</v><v>5.8023161290e+01</v></row>

                        <!-- 2017-01-13 14:00:00 CET / 1484312400 -->
<row><v>5.6431666667e+01</v><v>5.8812361111e+01</v></row>

                        <!-- 2017-01-13 14:05:00 CET / 1484312700 -->
<row><v>5.8108073462e+01</v><v>5.6759528696e+01</v></row>

                        <!-- 2017-01-13 14:10:00 CET / 1484313000 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 14:15:00 CET / 1484313300 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 14:20:00 CET / 1484313600 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 14:25:00 CET / 1484313900 -->
<row><v>NaN</v><v>NaN</v></row>

                        <!-- 2017-01-13 14:30:00 CET / 1484314200 -->
<row><v>5.7106884794e+01</v><v>5.6664554938e+01</v></row>

Since the template works for me on the old Xymon-server (SLES, Xymon
version old, etc) I ask this here to know if someone else has experienced
or currently experiences this behaviour?

Although this seems to me a low traffic mailing list, I do know that there
are many others using the great tool devmon for querying remote devices and
have it integrated within Xymon.

Regards, Peter

2016-12-21 15:05 GMT+01:00 Peter Welter <pet...@gm...>:

> Sorry Wim,
>
> I just posted my other email before I read your mail.
>
> The other Xymon-server is showing valid graphs (> 4Gbits!!) where the vm
> (new Xymon server) shows on different moments of different Ethernet device,
> spikes. Glad to know that 64-bit counters shouldn't be a problem and yes,
> they are reproduced fine (with my batch job I ran last night, I could see
> that the results are increasing numbers).
>
> So I have to check where the two machines differ. In many many ways, I'm
> afraid (vm, version xymon, perl, os, devmon etc... :-/  )
>
> Thanks for your help. Peter
>
>

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Sorry Wim,

I just posted my other email before I read your mail.

The other Xymon-server is showing valid graphs (> 4Gbits!!) where the vm
(new Xymon server) shows on different moments of different Ethernet device,
spikes. Glad to know that 64-bit counters shouldn't be a problem and yes,
they are reproduced fine (with my batch job I ran last night, I could see
that the results are increasing numbers).

So I have to check where the two machines differ. In many many ways, I'm
afraid (vm, version xymon, perl, os, devmon etc... :-/  )

Thanks for your help. Peter

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Last night I ran a batch job query for the specific device counters. There
were no flapping counters whatsoever! It is still running. This is a vm, a
RHEL server, newer xymon version, newer devmon version, different Perl
version.

I also deployed the if_load-test on my current Xymon server. Yes, hardware,
SLES, and different in many ways. But the test shows valid counters.

So the puzzle is which of these nasty different thing (hw vs vm, OS, Perl,
Xymon, devmon, ...) is the culprit.

I hope to have this fixed a.s.a.p.

Peter






2016-12-20 12:20 GMT+01:00 Peter Welter <pet...@gm...>:

> Hi Wim,
>
> Thanks for your quick response.
>
> I cannot acknowledge wether there are network issues. So sorry, but
> several times (+/- 8 times a day) we experience the issue.
>
> I see multiple devices with the query:
> [root@uhu-o cisco-n7000]# snmpwalk -v2c -c SECRET xxx.xxx.xxx.xxx
> .1.3.6.1.2.1.31.1.1.1.1
> IF-MIB::ifName.83886080 = STRING: mgmt0
> IF-MIB::ifName.335544320 = STRING: loopback0
> IF-MIB::ifName.385875968 = STRING: Null0
> IF-MIB::ifName.437256192 = STRING: Ethernet3/1
> IF-MIB::ifName.437260288 = STRING: Ethernet3/2
> IF-MIB::ifName.437264384 = STRING: Ethernet3/3
> IF-MIB::ifName.437268480 = STRING: Ethernet3/4
> IF-MIB::ifName.437272576 = STRING: Ethernet3/5
> IF-MIB::ifName.437276672 = STRING: Ethernet3/6
> IF-MIB::ifName.437280768 = STRING: Ethernet3/7
> IF-MIB::ifName.437284864 = STRING: Ethernet3/8
> IF-MIB::ifName.437780480 = STRING: Ethernet4/1
> IF-MIB::ifName.437784576 = STRING: Ethernet4/2
> IF-MIB::ifName.437788672 = STRING: Ethernet4/3
> IF-MIB::ifName.437792768 = STRING: Ethernet4/4
> IF-MIB::ifName.437796864 = STRING: Ethernet4/5
> IF-MIB::ifName.437800960 = STRING: Ethernet4/6
> IF-MIB::ifName.437805056 = STRING: Ethernet4/7
> IF-MIB::ifName.437809152 = STRING: Ethernet4/8
> IF-MIB::ifName.637534209 = STRING: Ethernet3/1
> IF-MIB::ifName.637534210 = STRING: Ethernet3/2
> IF-MIB::ifName.637534211 = STRING: Ethernet3/3
> IF-MIB::ifName.637534212 = STRING: Ethernet4/1
> IF-MIB::ifName.637534213 = STRING: Ethernet4/2
> IF-MIB::ifName.637534214 = STRING: Ethernet4/3
> IF-MIB::ifName.637534215 = STRING: Ethernet4/4
> IF-MIB::ifName.637534216 = STRING: Ethernet4/5
> IF-MIB::ifName.637534217 = STRING: Ethernet4/6
> IF-MIB::ifName.637534218 = STRING: Ethernet3/4
> IF-MIB::ifName.637534219 = STRING: Ethernet3/5
>
> 2016-12-20 9:32 GMT+01:00 W.J.M. Nelis <Wim...@nl...>:
>
>> Hello Peter,
>>
>> > I currently want to monitor our cisco n7000 switch using devmon.
>> >
>> > I took the current cisco-n6000 template, since it is using the 10GB
>> > Highspeed ports and our 7000 switch is using many of these 10Gbps
>> ports. It
>> > is also based on this article with suggestions from Joshua Krause:
>> > https://sourceforge.net/p/devmon/mailman/message/19631280/
>> >
>> > The good part: It does gather all kind of data. ;-)
>> >
>> > The bad part: It shows over time many spikes whereas the scale is
>> boosted
>> > to T of even P-bit, making the output less useful.
>> Are the occurrences of these spikes related to certain events?
>> A spike can be caused by a reset of the SNMP-counters. If the DS type is
>> COUNTER, a huge spike is generated, as the reset to zero is interpreted as
>> a counter wrap. In case of a 64-bit counter, the result will be in the
>> range you describe.
>>
>> (Note: Devmon does not know if a counter is 32-bit or 64-bit. If the value
>> decreases from one sample to the next, and if the value of the oldest of
>> the two samples is less than 2^32, it assumes that it is a 32-bit counter.
>> Thus the height of the spike will be much less for a rarely used
>> interface.)
>>
>>
>> > Perhaps this has to do with the template that was copied, but perhaps
>> it is
>> > just just the flapping from the maximum number of positions.
>> > (32bits/64-bits). But then again, I read 64-bits counters.
>> >
>> > I try to add ifInErrors, to remove redundant interfaces that were
>> > previously shown. Lending this from the if_err-test the number of
>> interface
>> > shown reduced to the same amount that is shown with if_err and
>> if_dsc-test.
>> > But underneath the output for all devices is shown to devmon and perhaps
>> > that makes it want to update for example Ethernet4_6 twice?!
>> Do you see the interfaces multiple times in an snmpwalk of ifName (OID
>> .1.3.6.1.2.1.31.1.1.1.1)?
>>
>> Regards,
>>    Wim Nelis.
>>
>>
>>
>>
>> ------------------------------------------------------------
>> ------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/intel
>> _______________________________________________
>> Devmon-support mailing list
>> Dev...@li...
>> https://lists.sourceforge.net/lists/listinfo/devmon-support
>>
>
>

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[W.J.M. N. <Wim...@nl...>]

Hello Peter,

> I cannot acknowledge wether there are network issues. So sorry, but several
> times (+/- 8 times a day) we experience the issue.
Do the graphs show a spike for all interfaces simultaneously (except for 
the ones which are not used)? If so, it looks like a reset of the counters 
within SNMP. You can minimise the impact of those resets by defining the 
dataset to be of type DERIVE rather than COUNTER. That should cause a 
negative spike, but as the lower limit is set to zero, this spike won't 
appear in the graph.

By using DERIVE, you will miss a measurement of the throughput if there is 
a real counter wrap. However, using 64-bit counters, this will not happen 
in your lifetime. (A 64-bit octet counter will wrap hen used on a 10 [Gb/s] 
interface transmitting at full speed after more than 460 years.) So the 
issue of counter-wraps can be ignored for 64-bit counters.

That should give you less stress in finding and solving the cause of those 
spikes.

>
> I see multiple devices with the query:
> [root@uhu-o cisco-n7000]# snmpwalk -v2c -c SECRET xxx.xxx.xxx.xxx
> .1.3.6.1.2.1.31.1.1.1.1
> IF-MIB::ifName.83886080 = STRING: mgmt0
> IF-MIB::ifName.335544320 = STRING: loopback0
> IF-MIB::ifName.385875968 = STRING: Null0
> IF-MIB::ifName.437256192 = STRING: Ethernet3/1
> IF-MIB::ifName.437260288 = STRING: Ethernet3/2
> IF-MIB::ifName.437264384 = STRING: Ethernet3/3
> IF-MIB::ifName.437268480 = STRING: Ethernet3/4
> IF-MIB::ifName.437272576 = STRING: Ethernet3/5
> IF-MIB::ifName.437276672 = STRING: Ethernet3/6
> IF-MIB::ifName.437280768 = STRING: Ethernet3/7
> IF-MIB::ifName.437284864 = STRING: Ethernet3/8
> IF-MIB::ifName.437780480 = STRING: Ethernet4/1
> IF-MIB::ifName.437784576 = STRING: Ethernet4/2
> IF-MIB::ifName.437788672 = STRING: Ethernet4/3
> IF-MIB::ifName.437792768 = STRING: Ethernet4/4
> IF-MIB::ifName.437796864 = STRING: Ethernet4/5
> IF-MIB::ifName.437800960 = STRING: Ethernet4/6
> IF-MIB::ifName.437805056 = STRING: Ethernet4/7
> IF-MIB::ifName.437809152 = STRING: Ethernet4/8
> IF-MIB::ifName.637534209 = STRING: Ethernet3/1
> IF-MIB::ifName.637534210 = STRING: Ethernet3/2
> IF-MIB::ifName.637534211 = STRING: Ethernet3/3
> IF-MIB::ifName.637534212 = STRING: Ethernet4/1
> IF-MIB::ifName.637534213 = STRING: Ethernet4/2
> IF-MIB::ifName.637534214 = STRING: Ethernet4/3
> IF-MIB::ifName.637534215 = STRING: Ethernet4/4
> IF-MIB::ifName.637534216 = STRING: Ethernet4/5
> IF-MIB::ifName.637534217 = STRING: Ethernet4/6
> IF-MIB::ifName.637534218 = STRING: Ethernet3/4
> IF-MIB::ifName.637534219 = STRING: Ethernet3/5
Very strange.  I wonder if there is a transform within Devmon which can 
remove the duplicates.

Regards,
   Wim Nelis.

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Hi Wim,

Thanks for your quick response.

I cannot acknowledge wether there are network issues. So sorry, but several
times (+/- 8 times a day) we experience the issue.

I see multiple devices with the query:
[root@uhu-o cisco-n7000]# snmpwalk -v2c -c SECRET xxx.xxx.xxx.xxx
.1.3.6.1.2.1.31.1.1.1.1
IF-MIB::ifName.83886080 = STRING: mgmt0
IF-MIB::ifName.335544320 = STRING: loopback0
IF-MIB::ifName.385875968 = STRING: Null0
IF-MIB::ifName.437256192 = STRING: Ethernet3/1
IF-MIB::ifName.437260288 = STRING: Ethernet3/2
IF-MIB::ifName.437264384 = STRING: Ethernet3/3
IF-MIB::ifName.437268480 = STRING: Ethernet3/4
IF-MIB::ifName.437272576 = STRING: Ethernet3/5
IF-MIB::ifName.437276672 = STRING: Ethernet3/6
IF-MIB::ifName.437280768 = STRING: Ethernet3/7
IF-MIB::ifName.437284864 = STRING: Ethernet3/8
IF-MIB::ifName.437780480 = STRING: Ethernet4/1
IF-MIB::ifName.437784576 = STRING: Ethernet4/2
IF-MIB::ifName.437788672 = STRING: Ethernet4/3
IF-MIB::ifName.437792768 = STRING: Ethernet4/4
IF-MIB::ifName.437796864 = STRING: Ethernet4/5
IF-MIB::ifName.437800960 = STRING: Ethernet4/6
IF-MIB::ifName.437805056 = STRING: Ethernet4/7
IF-MIB::ifName.437809152 = STRING: Ethernet4/8
IF-MIB::ifName.637534209 = STRING: Ethernet3/1
IF-MIB::ifName.637534210 = STRING: Ethernet3/2
IF-MIB::ifName.637534211 = STRING: Ethernet3/3
IF-MIB::ifName.637534212 = STRING: Ethernet4/1
IF-MIB::ifName.637534213 = STRING: Ethernet4/2
IF-MIB::ifName.637534214 = STRING: Ethernet4/3
IF-MIB::ifName.637534215 = STRING: Ethernet4/4
IF-MIB::ifName.637534216 = STRING: Ethernet4/5
IF-MIB::ifName.637534217 = STRING: Ethernet4/6
IF-MIB::ifName.637534218 = STRING: Ethernet3/4
IF-MIB::ifName.637534219 = STRING: Ethernet3/5

2016-12-20 9:32 GMT+01:00 W.J.M. Nelis <Wim...@nl...>:

> Hello Peter,
>
> > I currently want to monitor our cisco n7000 switch using devmon.
> >
> > I took the current cisco-n6000 template, since it is using the 10GB
> > Highspeed ports and our 7000 switch is using many of these 10Gbps ports.
> It
> > is also based on this article with suggestions from Joshua Krause:
> > https://sourceforge.net/p/devmon/mailman/message/19631280/
> >
> > The good part: It does gather all kind of data. ;-)
> >
> > The bad part: It shows over time many spikes whereas the scale is boosted
> > to T of even P-bit, making the output less useful.
> Are the occurrences of these spikes related to certain events?
> A spike can be caused by a reset of the SNMP-counters. If the DS type is
> COUNTER, a huge spike is generated, as the reset to zero is interpreted as
> a counter wrap. In case of a 64-bit counter, the result will be in the
> range you describe.
>
> (Note: Devmon does not know if a counter is 32-bit or 64-bit. If the value
> decreases from one sample to the next, and if the value of the oldest of
> the two samples is less than 2^32, it assumes that it is a 32-bit counter.
> Thus the height of the spike will be much less for a rarely used
> interface.)
>
>
> > Perhaps this has to do with the template that was copied, but perhaps it
> is
> > just just the flapping from the maximum number of positions.
> > (32bits/64-bits). But then again, I read 64-bits counters.
> >
> > I try to add ifInErrors, to remove redundant interfaces that were
> > previously shown. Lending this from the if_err-test the number of
> interface
> > shown reduced to the same amount that is shown with if_err and
> if_dsc-test.
> > But underneath the output for all devices is shown to devmon and perhaps
> > that makes it want to update for example Ethernet4_6 twice?!
> Do you see the interfaces multiple times in an snmpwalk of ifName (OID
> .1.3.6.1.2.1.31.1.1.1.1)?
>
> Regards,
>    Wim Nelis.
>
>
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/intel
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>

Re: [Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[W.J.M. N. <Wim...@nl...>]

Hello Peter,

> I currently want to monitor our cisco n7000 switch using devmon.
>
> I took the current cisco-n6000 template, since it is using the 10GB
> Highspeed ports and our 7000 switch is using many of these 10Gbps ports. It
> is also based on this article with suggestions from Joshua Krause:
> https://sourceforge.net/p/devmon/mailman/message/19631280/
>
> The good part: It does gather all kind of data. ;-)
>
> The bad part: It shows over time many spikes whereas the scale is boosted
> to T of even P-bit, making the output less useful.
Are the occurrences of these spikes related to certain events?
A spike can be caused by a reset of the SNMP-counters. If the DS type is 
COUNTER, a huge spike is generated, as the reset to zero is interpreted as 
a counter wrap. In case of a 64-bit counter, the result will be in the 
range you describe.

(Note: Devmon does not know if a counter is 32-bit or 64-bit. If the value 
decreases from one sample to the next, and if the value of the oldest of 
the two samples is less than 2^32, it assumes that it is a 32-bit counter. 
Thus the height of the spike will be much less for a rarely used interface.)


> Perhaps this has to do with the template that was copied, but perhaps it is
> just just the flapping from the maximum number of positions.
> (32bits/64-bits). But then again, I read 64-bits counters.
>
> I try to add ifInErrors, to remove redundant interfaces that were
> previously shown. Lending this from the if_err-test the number of interface
> shown reduced to the same amount that is shown with if_err and if_dsc-test.
> But underneath the output for all devices is shown to devmon and perhaps
> that makes it want to update for example Ethernet4_6 twice?!
Do you see the interfaces multiple times in an snmpwalk of ifName (OID 
.1.3.6.1.2.1.31.1.1.1.1)?

Regards,
   Wim Nelis.

[Devmon] T or even P bits speed output in 'home made'-cisco-n7000 switch template

[Peter W. <pet...@gm...>]

Hi all,

I currently want to monitor our cisco n7000 switch using devmon.

I took the current cisco-n6000 template, since it is using the 10GB
Highspeed ports and our 7000 switch is using many of these 10Gbps ports. It
is also based on this article with suggestions from Joshua Krause:
https://sourceforge.net/p/devmon/mailman/message/19631280/

The good part: It does gather all kind of data. ;-)

The bad part: It shows over time many spikes whereas the scale is boosted
to T of even P-bit, making the output less useful.

Perhaps this has to do with the template that was copied, but perhaps it is
just just the flapping from the maximum number of positions.
(32bits/64-bits). But then again, I read 64-bits counters.

I try to add ifInErrors, to remove redundant interfaces that were
previously shown. Lending this from the if_err-test the number of interface
shown reduced to the same amount that is shown with if_err and if_dsc-test.
But underneath the output for all devices is shown to devmon and perhaps
that makes it want to update for example Ethernet4_6 twice?!

<!--DEVMON RRD: if_load 0 0DS:ds0:COUNTER:600:0:U
DS:ds1:COUNTER:600:0:Umgmt0 8247429506:11580776867loopback0
14745470623:141164664Ethernet3_1 5024101631:4880010244Ethernet3_2
267190518641421:582376841373790Ethernet3_3
1061257241170259:918475959620772Ethernet3_4
43733156719628:62129716240585Ethernet3_5
387225909706:2117721457106Ethernet3_6 193459968:193459968Ethernet3_7
193459968:193459968Ethernet3_8 193459968:193459968Ethernet4_1
3032003211948657:477064488094919Ethernet4_2
405547772930228:633038828152786Ethernet4_3
100789170897194:402774159473780Ethernet4_4
152242467964572:651974813592615Ethernet4_5
289092901131472:1332084582328113Ethernet4_6
44824458994027:307337337507073Ethernet4_7
193459968:193459968Ethernet4_8 193459968:193459968Ethernet3_1
0:0Ethernet3_2 0:0Ethernet3_3 0:0Ethernet4_1 0:0Ethernet4_2
0:0Ethernet4_3 0:0Ethernet4_4 0:0Ethernet4_5 0:0Ethernet4_6
0:0Ethernet3_4 0:0Ethernet3_5 0:0-->


My current devmon setting is to query the switch every 60seconds

CYCLETIME=60

DEADTIME=180

CLEARTIME=180

NUMFORKS=10

MAXPOLLTIME=30

SNMPTIMEOUT=2

SNMPTRIES=5


Any hints would be very welcome.

Peter Welter

[Devmon] Devmon on Ubuntu

[<joh...@ac...>]

Does anyone have devmon working on Ubuntu (16.04.1 LTS)?

I have tried 3 different servers and I keep ending up with the following error:

[16-12-16@07:20:40] Querying new hosts /w custom cids using snmp v2
Undefined subroutine &dm_snmp::encode_oid called at /home/xymon/devmon/modules/dm_snmp.pm line 480, <__ANONIO__> line 9.

I have found a couple of suggestions that either BER.pm or SNMP_Session.pm are not installed but both are installed.  Links within the installation doc for SNMP Session are no longer valid.

What else can I try?
What am I doing wrong?

Thanks,
John
_____________________________________________________________________
John Rothlisberger
IT Strategy, Infrastructure & Security - Technology Growth Platform
TGP for Business Process Outsourcing
Accenture
312.693.3136 office
_____________________________________________________________________


________________________________

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
______________________________________________________________________________________

www.accenture.com

Re: [Devmon] devmon errors with OS X/Darwin SNMP

[Jeremy L. <jla...@re...>]

Bruce

You can't do MATH on a SPEED value.  ifOutSpeed will look something like
"1.2 Kbps".  So you're trying to do something like:

ifOutLoad    : MATH        : (1.2Kbps / 2395) x 100

I suspect what you want is ifOutBps instead of ifOutSpeed:

ifInLoad    : MATH        : ({ifInBps} / {ifSpeed}) x 100
ifOutLoad    : MATH        : ({ifOutBps} / {ifSpeed}) x 100

J


On 23 July 2016 at 02:44, Bruce Ferrell <bfe...@ba...> wrote:

> another set of eye would be helpful here.  snmpwalk works every time for
> the oids
>
> The error seen in the log:
>
> Error(s) while parsing 'ifOutSpeed'
>
> Error(s) while parsing 'ifInSpeed' on Mac-Mini
>
> My template:
>
> -oids:
>
> ifDescr        : .1.3.6.1.2.1.2.2.1.2        : branch
> ifSpeed        : .1.3.6.1.2.1.2.2.1.5        : branch
> ifInOctets    : .1.3.6.1.2.1.2.2.1.10        : branch
> ifOutOctets    : .1.3.6.1.2.1.2.2.1.16        : branch
>
> --Transforms:
>
> # Create a human-readable ifc speed
> # Get bit speed delta (so we dont have to provide custom delta limit)
> ifInOps      : DELTA        : {ifInOctets}
> ifOutOps     : DELTA        : {ifOutOctets}
> # Convert our octets delta into bits per second
> ifInBps        : MATH        : {ifInOps} x 8
> ifOutBps    : MATH        : {ifOutOps} x 8
> # Make some easily readable speed variables
> ifInSpeed    : SPEED        : {ifInBps}
> ifOutSpeed    : SPEED        : {ifOutBps}
> # Now determine our percentage load, based on traffic and ifc speed
> ifInLoad    : MATH        : ({ifInSpeed} / {ifSpeed}) x 100
> ifOutLoad    : MATH        : ({ifOutSpeed} / {ifSpeed}) x 100
> # Create an alias in a bracketed box, or nothing if alias is blank
> #ifAliasBox      : REGSUB        : {ifAlias} /(\S+.*)/ [$1]/
>
> --message:
>
> <b>Interface error rates:</b>
> Input load:  yellow={ifInLoad.thresh:yellow}%, red={ifInLoad.thresh:red}%
> Output load: yellow={ifOutLoad.thresh:yellow}%,
> red={ifOutLoad.thresh:red}%
> TABLE:rrd(DS:ds0:ifInOctets:DERIVE; DS:ds1:ifOutOctets:DERIVE)
> Ifc name|Ifc Speed|Rate in (load %)|Rate out (load %)
> {ifDescr}|{ifSpeed}|{ifInLoad.color}{ifInSpeed}
> ({ifInLoad}%){ifInLoad.errors}|{ifOutLoad.color}{ifOutSpeed}
> ({ifOutLoad}%){ifOutLoad.errors}
>
>
>
>
> ------------------------------------------------------------
> ------------------
> What NetFlow Analyzer can do for you? Monitors network bandwidth and
> traffic
> patterns at an interface-level. Reveals which users, apps, and protocols
> are
> consuming the most bandwidth. Provides multi-vendor support for NetFlow,
> J-Flow, sFlow and other flows. Make informed decisions using capacity
> planning
> reports.http://sdm.link/zohodev2dev
> _______________________________________________
> Devmon-support mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devmon-support
>

[Devmon] Grow Your Business Effectively with White-Hat SEO!

[Ella <el...@on...>]

Hi

 

I am Ella, SEO Consultant. Online advertising has become a powerful & highly
effective method of promoting a business, reaching a large scale of
potential customers. I was surfing through your website and noticed that
despite having a great design, interface and quality service & products, it
was not ranking higher on any of the search engines (Google, Yahoo, Bing)
for most keywords related to your business profile.

 

We are an India based SEO Company offering organic SEO, helping businesses
successfully rank higher in search engine results for most of the
competitive keywords, leading to an improved branding and sales. We provide
structured and optimized SEO service which is aimed at long-term solution in
getting the site rank higher with organic search results. We have handled
hundreds of projects in the last year, manually building backlinks with
white hat techniques, improving keyword rankings and boosting real time
traffic.

 

Our team of professional & innovative SEO experts will perform proactive SEO
maintenance, regular SEP campaign reports to give desirable results. This
proposal is a sample proposal in terms of analysis, strategy and
optimization recommendation. Please let me know if you are interested so
that we can proceed further. I will prepare a tailored proposal for a custom
SEO action plan, specific to give you desirable results. We have a
structured & cost-effective work process, which gives you good amount of
margin on your investment. Your company & customer details will be kept
confidential.

 

I look forward to your mail.

 

Warm Regards

Ella

SEO Consultant