<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">This is not just a Debian thing -- it
looks like it results from output changes in recent versions of
netstat/net-tools (recent Fedora is affected too). <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I think the easiest fix will be to move
to PCRE parsing to catch the differing versions, which is how
we're handling the BSDs and some of the esoteric unicies.
(Although there's a legacy RHEL3 Linux OS type from back in the
day, this is one of the things we'll want to catch centrally
moving forward.) <br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Additionally, it's probably time to
start adding 'ss' output into the client for future use.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Regards,<br>
</div>
<div class="moz-cite-prefix">-jc<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 3/13/2019 7:53 AM, SebA wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAOGA4529ZonoO4p8bacgxBt8VDVVv-L50aeuR3JZw89Xogc6fw@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">
<div>Hi John,</div>
<div><br>
</div>
<div>I can confirm that we have the same issue on Debian 9
clients on the Network I/O (as labelled) graph.<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr"><span>
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div style="TEXT-ALIGN:left"><span
style="FONT-SIZE:12px"><span
style="FONT-FAMILY:arial,helvetica,sans-serif">Kind
regards,<br>
<br>
SebA<br>
<br>
</span></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</div>
</div>
<br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, 12 Mar 2019 at
22:48, John Horne <<a
href="mailto:john.horne@plymouth.ac.uk"
moz-do-not-send="true">john.horne@plymouth.ac.uk</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
We have three Debian 9 (stretch) servers running the
xymon-client package<br>
(version 4.3.28-2). I noticed yesterday that the 'trends'
column for these<br>
clients was showing a 'TCP/IP statistics' graph, but was
only showing values<br>
for the 'In' graph. Both the 'Out' and 'Retrans' values were
NaN.<br>
<br>
If anyone else is running the Xymon client on a Debian 9
server, or may be even<br>
Debian 8, could they check their 'trends' graphs and see if
the same problem<br>
exists for them. Thanks.<br>
<br>
As far as I can tell this started when we upgraded the
client server O/S from<br>
Debian 7 to 9 (a few months ago now!). It seems there were
values for all 3<br>
graph lines when they ran Debian 7.<br>
<br>
The RRD netstat file, which is used for the statistics
graph, shows a 'U' for<br>
the 'Out' and 'Retrans' values. Looking at the actual code
(in<br>
xymond/rrd/do_netstat.c), it seems that the netstat output
is expected to be<br>
the same for most Linux distributions and versions. It
shows:<br>
<br>
=========<br>
/* This one matches all Linux systems */<br>
static char *netstat_linux_markers[] = {<br>
"packets received",<br>
"packets sent",<br>
"packet receive errors",<br>
"active connections openings",<br>
"passive connection openings",<br>
"failed connection attempts",<br>
"connection resets received",<br>
"connections established",<br>
"",<br>
"",<br>
"",<br>
"",<br>
"segments send out", /* Yes, they really do write
"send" */<br>
"segments received",<br>
"",<br>
"segments retransmited",<br>
NULL<br>
};<br>
=========<br>
<br>
However, the netstat output collected by the clients shows,
looking at the TCP<br>
section:<br>
<br>
=========<br>
Tcp:<br>
3045575 active connection openings<br>
251770 passive connection openings<br>
9335 failed connection attempts<br>
4520 connection resets received<br>
37 connections established<br>
1359715245 segments received<br>
1330630207 segments sent out<br>
119457 segments retransmitted<br>
10 bad segments received<br>
32339 resets sent<br>
InCsumErrors: 2<br>
=========<br>
<br>
<br>
Some things seem to be wrong:<br>
<br>
1) The code looks for 'active connections openings', but
netstat shows 'active<br>
connection openings'. Singular on the 'connection' word.<br>
<br>
2) The code looks for 'segments send out', but netstat shows
'segments sent<br>
out'. So despite the comment in the code, the output uses
'sent' rather than<br>
'send'.<br>
<br>
3) The code looks for 'segments retransmited', but the
netstat output shows<br>
'segments retransmitted'. So there is a double 't' in
retransmitted (or 3 all<br>
together).<br>
<br>
4) The order of the 'segments' lines is different from the
code, but I'm not<br>
sure if that is important. (Haven't looked at the code that
much in depth.)<br>
<br>
<br>
I'm not sure if this is the cause of the TCP/IP stats graph
not showing values,<br>
but it doesn't seem right.<br>
<br>
<br>
Thanks,<br>
<br>
John.<br>
<br>
--<br>
John Horne | Senior Operations Analyst | Technology and
Information Services<br>
University of Plymouth | Drake Circus | Plymouth | Devon |
PL4 8AA | UK<br>
________________________________<br>
[<a href="http://www.plymouth.ac.uk/images/email_footer.gif"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://www.plymouth.ac.uk/images/email_footer.gif</a>]<<a
href="http://www.plymouth.ac.uk/worldclass"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://www.plymouth.ac.uk/worldclass</a>><br>
<br>
This email and any files with it are confidential and
intended solely for the use of the recipient to whom it is
addressed. If you are not the intended recipient then
copying, distribution or other use of the information
contained is strictly prohibited and you should not rely on
it. If you have received this email in error please let the
sender know immediately and delete it from your system(s).
Internet emails are not necessarily secure. While we take
every care, University of Plymouth accepts no responsibility
for viruses and it is your responsibility to scan emails and
their attachments. University of Plymouth does not accept
responsibility for any changes made after it was sent.
Nothing in this email or its attachments constitutes an
order for goods or services unless accompanied by an
official order form.<br>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank"
moz-do-not-send="true">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote>
</div>
</div>
</blockquote>
<br>
</body>
</html>