[Xymon] FreeBSD [ifstat] processing

[Jeremy Laidman]

Hiya

I have some FreeBSD systems that run IPv6, and the numbers that Xymon are
graphing are not quite right.  I think I've pinned down the cause as being
the ifstat matching regexp, not being able to handle either multiple bound
IP addresses, or IPv6 addresses.  My system has output from "netstat -i -b
-n" something like this:

Name    Mtu Network       Address              Ipkts Ierrs     Ibytes
 Opkts Oerrs     Obytes  Coll
em0    1500 <Link#1>      aa:bb:cc:dd:ee:ff 855109239   246 119882177806
4445784528     0 1678631985244     0
em0    1500 fe80:1::666:6 fe80:1::666:66ff:     5652     -     403008
8487     -     565928     -
em0    1500 192.168.1.0 192.168.1.66      3669836     -  327402522
4441615751     - 1612495913591     -
em0    1500 6006:6000:0:6 6006:6000:0:6006:   186828     -   13051632
33119395     - 3319372758     -
<snipped>
lo0   16384 <Link#3>                         2420387     0  296603593
 2420667     0  296585785     0
lo0   16384 ::1/128       ::1                 193448     -   17014491
217323     -   22687570     -
lo0   16384 fe80:6::1/64  fe80:6::1                0     -          0
 0     -          0     -
lo0   16384 127.0.0.0/8   127.0.0.1          2227042     -  279599853
 2226396     -  279550576     -
lo1   16384 <Link#4>                          398523     0   55461313
398523     0   55461150     0
lo1   16384 192.168.2.0 192.168.2.66    317552009     - 63772241684
383671     -   50695917     -
lo1   16384 6006:6000:600 6006:6000:600::66 29688469     - 10867392950
   4     -       2982     -
<snipped>


The Xymon client explicitly excludes the "link" lines, and all of the "lo"
lines.  Makes sense, except that it doesn't work for me.

It seems that the Xymon server-side parsing is only picking up the line
with the IPv4 address (192.168.1.66) and ignores all the others for the
interface.  Also, I can't see where Xymon handles multiple lines for the
same interface, and I don't think it does.

And finally, this server has loopback interfaces lo1, lo2 and so on, with
alternative IP addresses for this server.  Most of the traffic that arrives
at this server is addressed to the loopback interfaces.  So even if Xymon
could parse these lines, multiple of them, the client script excludes all
of the loopback interfaces.

What's the best way to solve this?  The lo[1-n] NICs could be added back
in.  But I don't know that this is very useful.  The intent of the [ifstat]
data is to record and display bytes that come in and out of physical NICs
that communicate with the outside world, but my extra loopback interfaces'
traffic isn't being counted.

For this reason, it seems to make sense that the "link" lines are probably
the best for this, as I would think that they would show packets contained
only in physical frames (ethernet or some other medium).  However, I think
the "link" lines also show things like ARP and other layer-2 traffic that
might not be as useful.

Has anyone else looked into this, or done monitoring of FreeBSD interfaces?
 Is there a better command to run on FreeBSD for this?  I'd really like to
get this fixed up.

Cheers
Jeremy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20140217/89f601dd/attachment.html>