<div dir="ltr">Barrie<div><br></div><div>This is quite interesting. On the one hand, most of the gaps in the lines don't line up with gaps in other lines. On the other hand, on the graph with four lines, the red and pink lines appear to have gaps in the same place 100% of the time. And the green line only appears when the blue line appears. It's as if there are two concurrent problems that are masking each others' symptoms.</div><div><br></div><div>Yes, you can run xymond_rrd with the "--debug" switch, to enable more output in the log file.</div><div><br></div><div>Rather than re-configuring the parameters for xymond_rrd in tasks.cfg and restarting, you can run a second copy of it, which runs independently of the main one, creating and updating its own copy of the RRD files, and logging to STDOUT for you to peruse in real time.</div><div><br></div><div>Typically there are two xymond_rrd processes running, one for status messages and the other for data messages. The one we're interested in is the one for the status messages, because the data are parsed from the "disk" message body. You can run the following (as xymon user) to see what's going on with this:</div><div><br></div><div><font face="monospace, monospace">$ sudo -u xymon mkdir -p /tmp/myrrd</font></div><div><font face="monospace, monospace">$ sudo -u xymon xymoncmd xymond_channel --channel=status \</font></div><div><font face="monospace, monospace"> --filter='^@@status.*/hostname.example.com.*\|disk\|' xymond_rrd \</font></div><div><font face="monospace, monospace"> --rrddir=/tmp/myrrd --debug</font></div><div><br></div><div>This will create RRD files in /tmp/myrrd for the named host and for only the "disk" data. You can then use rrdtool to view the data and look for signs of gaps. Note that xymond_rrd will cache updates to the RRD file, and so you might not get updates to the RRD file straight away, so you can either wait 30 minutes to review, or add the --no-cache switch. Also note that RRD requires more than just one sample for it to start trusting the data, so you would want to wait for at least two samples before relying on the contents of the RRD file.</div><div><br></div><div>If that doesn't show any hints, then a more systematic approach may be warranted. There are several stages between the Xymon client creating the client data message and the RRD file being created, where messages could go missing. Here's a rough summary:</div><div><br></div><div>xymon-client.sh => df</div><div> => xymon [Client message]</div><div> => xymond</div><div> => xymond_client -> [status message]</div><div> => xymond</div><div> => xymond_channel --status</div><div> => xymond_rrd</div><div> => rrd</div><div><br></div><div>What I'd be doing is checking each phase of this to determine where the messages are being dropped/corrupted. In most cases, you can impersonate the existing process and review the results to infer what's happening in the actual process.</div><div><br></div><div>J</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 10 August 2017 at 01:41, Stephen Barrie <span dir="ltr"><<a href="mailto:sbarrie@brightsolid.com" target="_blank">sbarrie@brightsolid.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div class="m_-2974955901124798135WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Hello<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Attached are sample memory and disk graphs. You will see the gaps in one line do not equate with the gaps in others. The gaps vary
in length and there is no clear pattern. Sometimes it is for minutes but they could be for more than an hour. The output from the df command in the client still updates the server every few minutes and this never seems to miss any data. It is difficult to
get the df output that coincides with gaps in the graphs as we don’t see the graphs are missing data until after the fact, but we can see that the gaps are not at the same times for all machines or all disks.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">The server where we are not experiencing the problem is running 4.3.17 on Red Hat Linux. The others are 4.3.25 on Ubuntu 16.04 and
4.3.7 on Ubuntu 14.04. There are no RRD or other related errors in the logs.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">A problem with the RRD parser seems a logical explanation. Is there a way of tracking what this is doing?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Stephen<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Jeremy Laidman [mailto:<a href="mailto:jlaidman@rebel-it.com.au" target="_blank">jlaidman@rebel-it.com.<wbr>au</a>]
<br>
<b>Sent:</b> 09 August 2017 14:51<br>
<b>To:</b> Stephen Barrie <<a href="mailto:sbarrie@brightsolid.com" target="_blank">sbarrie@brightsolid.com</a>><br>
<b>Cc:</b> <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>
<b>Subject:</b> Re: [Xymon] Graph lines for disk and memory showing gaps<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Can you show an example/screencap of a graph with the gaps? Do all servers and/or disks have gaps at the same time? How big are the gaps - one or two 5-minute sample size, or much larger?<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The Windows disk usage message is parsed by different code to that which parses the UNIX and Linux "df" output. That might have something to do with it.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is 4.3.25 in use on all Xymon servers?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Check the Xymon logs for error messages. Perhaps the RRD parser is crashing.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It's possible that the "df" output is sometimes not parseable by the RRD parser, and so the data is ignored. Can you show the [df] section from the client data during one of the gaps, and at another time when there are no gaps?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">J<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On 9 August 2017 at 22:13, Stephen Barrie <<a href="mailto:sbarrie@brightsolid.com" target="_blank">sbarrie@brightsolid.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">Hi<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">We have a few Xymon servers running on Ubuntu 14.04 and 16.04 that show gaps in the graphs for disk and memory metrics. This specifically relates to Linux and Unix clients reporting
to these servers. The graph lines for Windows clients look ok.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">If the same Unix and Linux clients are pointed to another server running Red Hat we do not see the same gaps in the graphs. Upgrading the client version does not resolve this. So
it seems there is a problem with graph data being created on the Xymon server on Ubuntu. We are using the package version 4.3.25. Is there a known issue with this?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Regards<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Stephen Barrie<u></u><u></u></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<h5>This message is confidential and may contain privileged information. You should not disclose its contents to any other person. If you are not the intended recipient, please notify the sender named above immediately. It is expressly declared that this e-mail
does not constitute nor form part of a contract or unilateral obligation. Opinions, conclusions and other information in this message that do not relate to the official business of brightsolid shall be understood as neither given nor endorsed by it.<u></u><u></u></h5>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><br>
______________________________<wbr>______________________________<wbr>______________<br>
<br>
This email has been checked for virus and other malicious content prior to leaving our network.<br>
______________________________<wbr>______________________________<wbr>______________<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________<wbr>_________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/<wbr>mailman/listinfo/xymon</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div><div><div class="h5">
<hr>
<h5>This message is confidential and may contain privileged information. You should not disclose its contents to any other person. If you are not the intended recipient, please notify the sender named above immediately. It is expressly declared that this e-mail
does not constitute nor form part of a contract or unilateral obligation. Opinions, conclusions and other information in this message that do not relate to the official business of brightsolid shall be understood as neither given nor endorsed by it.</h5>
<hr>
<br clear="both">
______________________________<wbr>______________________________<wbr>______________<br>
<br>
This email has been checked for virus and other malicious content prior to leaving our network.<br>
______________________________<wbr>______________________________<wbr>______________<br>
</div></div></div>
</blockquote></div><br></div>