[Xymon] Unexpected times on "Connection Times" graph

[Ralph Mitchell]

An ICMP ping is a low-level, very small packet exchange:

   xymon:  Hey, server1
   server1: what??
   xymon: <wanders off>

On the other hand, ssh should be setting up and tearing down an encrypted
connection, even though it doesn't actually login.  I assume there would be
multiple packets bouncing back and forth, agreeing on an encryption
protocol and swapping keys, or whatever.  I'm not very surprised that it
takes longer than a ping to complete the connection.

Ralph Mitchell



On Mon, Aug 24, 2015 at 11:04 PM, Jeremy Laidman <jlaidman at rebel-it.com.au>
wrote:

> I've noticed the same thing on many of my servers.  Without really
> thinking about it, I just assumed that the xymonnet TCP connection
> measurements were taking into account (removing) network latency time, and
> only giving the latency within the server being tested.  Thinking about it
> now, I'm not sure how xymonnet would do this.
>
> Yes, I believe xymonping uses ICMP.  You can run xymonping directly like:
>
> sudo -u xymon /usr/lib/xymon/server/bin/xymonping 10.100.2.17
>
> and see how it compares with the graph, or "ping" or "time telnet
> 10.100.2.17 22 </dev/null".
>
> J
>
>
> On 25 August 2015 at 08:02, Shawn Heisey <hobbit at elyograg.org> wrote:
>
>> Here is a "connection times" graph from Xymon:
>>
>> https://www.dropbox.com/s/voyqnzfnsqaact9/xymonresponsegraph.png?dl=0
>>
>> This shows "conn" times in the 40 millisecond rang, and "ssh" times in
>> the 200 microsecond range.
>>
>> What is the source of the "conn" graph?  I would have guessed ICMP, but
>> it doesn't make any sense for a ping to take longer than an ssh
>> connection, especially not that much longer.  This is what I get if I
>> ping that machine from the xymon server ... it doesn't take anywhere
>> even CLOSE to 40 milliseconds:
>>
>> [root at mcp xymon]# ping palazzo
>> PING palazzo.REDACTED.com (10.100.2.17) 56(84) bytes of data.
>> 64 bytes from palazzo.REDACTED.com (10.100.2.17): icmp_seq=1 ttl=62
>> time=0.572 ms
>> 64 bytes from palazzo.REDACTED.com (10.100.2.17): icmp_seq=2 ttl=62
>> time=0.582 ms
>> 64 bytes from palazzo.REDACTED.com (10.100.2.17): icmp_seq=3 ttl=62
>> time=0.573 ms
>> 64 bytes from palazzo.REDACTED.com (10.100.2.17): icmp_seq=4 ttl=62
>> time=0.611 ms
>> 64 bytes from palazzo.REDACTED.com (10.100.2.17): icmp_seq=5 ttl=62
>> time=0.890 ms
>> ^C
>> --- palazzo.REDACTED.com ping statistics ---
>> 5 packets transmitted, 5 received, 0% packet loss, time 4003ms
>> rtt min/avg/max/mdev = 0.572/0.645/0.890/0.126 ms
>>
>> Can anyone shed light on this?  My server config includes the following
>> line:
>>
>> FPING="xymonping"
>>
>> My xymon server is version 4.3.14.
>>
>> Thanks,
>> Shawn
>> _______________________________________________
>> Xymon mailing list
>> Xymon at xymon.com
>> http://lists.xymon.com/mailman/listinfo/xymon
>>
>
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20150824/4fcf0902/attachment.html>