<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 26/02/13 8:26 PM, Adam Goryachev
wrote:<br>
</div>
<blockquote cite="mid:512C7FD7.9090103@websitemanagers.com.au"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">On 26/02/13 19:47, Neil Simmonds
wrote:<br>
</div>
<blockquote
cite="mid:1BF7D566CC4F514288455EF3C9B7CF830C32A693@EXSVIRTUAL.express.findel.co.uk"
type="cite">
<meta name="Generator" content="Microsoft Word 11 (filtered
medium)">
<o:smarttagtype
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceType"> <o:smarttagtype
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceName"> <o:smarttagtype
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place">
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Bookman Old Style";
panose-1:2 5 6 4 5 5 5 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<div class="Section1">
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">Hi
all,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">I’ve
got a strange problem that I’m trying to diagnose
and would appreciate any help you can give.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">We
have 2 new servers that have recently been set up
that are Aix servers running the hobbit client. We
have 62 other Aix server with the same client
running absolutely fine.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">The
problem is that the client data is getting cut off
mid stream. It’s always in the ps output. I’ve
checked the MAX settings and there all ok, in fact
we have other clients that are sending data files
larger than these that are working fine. I’ve
checked the data on the client and it’s complete
but if I look in /xymon/data/hostdata on the
server the data seems to be almost always getting
truncated to 69518 bytes. Occasionally a full
message (approx 93k) gets through.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">There
are no messages regarding truncated data in the
server logs and the only message I can find on the
client is the following,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">2013-02-26
08:41:21 Write error while sending message to
bbd@xymonserver:1984<o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">2013-02-26
08:41:21 Whoops ! bb failed to send message -
write error <o:p></o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt; font-family:Arial">I’ve
googled this extensively and can’t find anything
that seems relevant to our problem. <o:p></o:p></span></font></p>
<br>
</div>
</o:smarttagtype></o:smarttagtype></o:smarttagtype></blockquote>
I get this from time to time, primarily when the xymon host has
very limited bandwidth. It seems to me that Xymon will accept
whatever data has been received prior to the connection being
broken/interrupted, and pretend it is complete (as opposed to
discarding it away).<br>
<br>
</blockquote>
The problem is that there isn't a well defined "end of message" on a
standard client report. The message starts with "client HOSTNAME.OS
CLASS" line then consists of a bunch of sections starting with
"[section]" lines followed by lines of text. When the client has
finished sending its message it just does a shutdown on the write
socket and reads any returned data until EOF. That's it. The server
probably doesn't care if the client even reads the data it sends
back, and has no way of communicating with it anyway.<br>
<br>
So if the client connection to the server is interrupted mid-stream,
the server quite probably just handles it as a socket shutdown and
accepts whatever has been received so far as the whole message.<br>
<blockquote cite="mid:512C7FD7.9090103@websitemanagers.com.au"
type="cite"> If this is happening frequently/all the time, I would
suspect firewall settings, and/or MTU issues (if it is packet size
related). Check that you are not blocking all ICMP, or that path
MTU discovery is working properly, check any firewall is not
timing out or blocking the connection for some reason, and that
there is enough bandwidth for the messages.<br>
<br>
Potentially, a tcpdump at both client and server could be
educational, possibly load these into wireshark for analysis.<br>
<br>
PS, I wonder when we will get compression, and/or encryption for
the status messages? Both would assist in making sure the complete
message arrives un-altered...<br>
<br>
</blockquote>
Indeed. There are other ways of delivering/fetching messages - maybe
worth exploring for more reliable transmission.<br>
<br>
David.<br>
<blockquote cite="mid:512C7FD7.9090103@websitemanagers.com.au"
type="cite"> Regards,<br>
Adam<br>
<br>
<pre class="moz-signature" cols="72">--
Adam Goryachev
Website Managers
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.websitemanagers.com.au">www.websitemanagers.com.au</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Xymon mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Xymon@xymon.com">Xymon@xymon.com</a>
<a class="moz-txt-link-freetext" href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Information and Communication Technology Services
Australian Sports Commission <a class="moz-txt-link-freetext" href="http://ausport.gov.au">http://ausport.gov.au</a>
Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616
<a class="moz-txt-link-abbreviated" href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617
</pre>
<br>
<hr>
Keep up to date with what's happening in Australian sport visit <a href="http://www.ausport.gov.au">www.ausport.gov.au</a>
<br><br>
<font size="-2" face="arial">This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.</font>
<hr>
</body>
</html>