[Xymon] "purple storm" example

[Jon Dustin]

>>> On 5/14/2012 at 1:32 AM, in message <4FB098DB.1000808 at hswn.dk>,
Henrik
Størner<henrik at hswn.dk> wrote:
> On 14-05-2012 04:04, Jon Dustin wrote:
>>> What's logged in your xymonnet.log file ?
>>
>> All I found were the following two entries:
>>
>> 2012-05-12 20:58:14 WARNING: Runtime 481 longer than time limit
(300)
>> 2012-05-12 22:07:20 WARNING: Runtime 767 longer than time limit
(300)
> 
> OK, if you look at the history of "xymonnet" status column, do you
have 
> a yellow status from around that time ? If you do, then check what
line 
> takes the longest time to complete.
> 

Yes, I DO have a yellow test result (481 seconds), and it looks like
LDAP was the culprit! 

DNS lookups completed                       4791966.865311        
17.502010 
Test engine setup completed                 4791966.870284         
0.004972 
TCP tests completed                         4791978.812050        
11.941766 
PING test completed (604 hosts)             4791979.652874         
0.840824 
PING test results sent                      4791979.656317         
0.003442 
Test result collection completed            4791979.656625         
0.000307 
LDAP test engine setup completed            4791979.656705         
0.000080 
LDAP tests executed                         4792364.927759       
385.271054 
LDAP tests result collection completed      4792364.927760         
0.000000 
DNS tests executed                          4792429.956221        
65.028460

These test times were *before* I added your DNS patch to Xymon.

> How many systems are you testing, btw ?
> 

726 hosts in the configuration report

> There is one thing that I know of which can trigger this: xymonnet 
> relies on two external tools (ntpdate and rpcinfo) for checking 
> NTP-servers and RPC services. I know from personal experience that a

> failed NTP server can cause ntpdate to hang for a very long time, and

> this can block xymonnet from completing the test cycle.

I DO have a few NTP servers (and a couple of them were the failed DNS
servers). No RPC tests however.

Thanks for reading.

-- 
 
Jon Dustin - Network Specialist
University of Southern Maine
Portland, ME  207-780-4152