<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>All –</div>
<div> </div>
<div>I know I did something bad, but don’t know exactly what… </div>
<div> </div>
<div>I ran across this posting from Henrik (<a href="http://lists.xymon.com/archive/2011-August/032267.html"><font color="blue"><u>http://lists.xymon.com/archive/2011-August/032267.html</u></font></a>) indicating one could see the data coming across to the
server from all the clients using a command similar to this:</div>
<div> </div>
<div> xymoncmd xymond_channel --channel=data egrep "egrep '^\@\@'"</div>
<div> </div>
<div>(Henrik’s example used “status” rather than “data”)</div>
<div> </div>
<div>So, I kicked it off and walked away for about an hour. Fine. When I returned some colleagues came by with worried expressions asking me to look at our Non-Green report. Rather than the usual handful of non-green hosts, there were rows and rows of hosts
showing ‘purple’ in various columns. I killed my manual “xymond_channel…” command and watched as the Non-Green report shrank quickly to a normal display.</div>
<div> </div>
<div>What happened? </div>
<ul style="margin:0;padding-left:36pt;">
<li>It appeared the appearance of various “purple” hosts in the environment was random: random hosts with random columns (but I won’t swear to that)</li><li>At least one monitored host’s “proc”s ended up as “red”, rather than “purple”, but this transition was long after the initial onset of my command. The user believes there was no real “crash” of his procs on his host.</li><li>We have two servers monitoring the same hosts in our environment. On the host used to run my manual command, pretty much all graph data for the Xymon server itself shows a gap: no data available while my command ran.</li><li>From the brother server, looking at graphs for the deranged server, we see an odd *<b>decrease</b>* in CPU load for the duration of my extra command, and an *<b>increase</b>* in TCP traffic</li></ul>
<div> </div>
<div>I’m guessing my manual command competed / randomly intercepted incoming data for this server, but does this fit all the oddities observed?</div>
<div> </div>
<div>In any case, I’m back at square one for my original goal of *<b>safely</b>* seeing what raw data is coming into the server from my clients. (FWIW – all hosts are Solaris 10 / Xymon 4.3.3)</div>
<div> </div>
<div>Help?</div>
<div> </div>
<div>Thanks!</div>
<div> </div>
<div>david</div>
<div style="margin-top:5pt;margin-bottom:5pt;"><font face="Arial" size="2"><span style="font-size:10pt;">~~~~~~~~~~~~~~~~~~~<font face="Times New Roman" size="3"><span style="font-size:12pt;">
<br>
</span></font><font face="Times New Roman" size="3" color="blue"><span style="font-size:12pt;"><b>David Mills</b></span></font><font face="Times New Roman" size="3"><span style="font-size:12pt;">
<br>
</span></font>Systems Administrator<font face="Times New Roman" size="3"><span style="font-size:12pt;">
<br>
</span></font><b><i>Northrop Grumman</i></b> </span></font></div>
<div><font face="Arial" size="2"><span style="font-size:10pt;">512-595-1238<font face="Calibri" size="2"><span style="font-size:11pt;">
<br>
</span></font>david.mills@ngc.com<font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></span></font></div>
<div> </div>
<div> </div>
<div> </div>
</span></font>
</body>
</html>