[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [hobbit] hobbitping latency reporting with multiple hosts

> -----Original Message-----
> From: Henrik Størner [mailto:henrik (at) hswn.dk] 
> Sent: Thursday, February 26, 2009 11:22
> To: hobbit (at) hswn.dk
> Subject: Re: [hobbit] hobbitping latency reporting with multiple hosts
> 
> On Wed, Feb 25, 2009 at 10:29:40AM +0100, 
> nick.nauwelaerts (at) thomsonreuters.com wrote:
> > We are having some discrepancies with the latencies xymon reports in
> > it's conn tests as opposed to what we were seeing in other 
> monitoring
> > programs. What we're seeing is that xymon reports a much 
> higher latency
> > for certain hosts than what we're used to. We are using 
> hobbitping from
> > xymon 4.2.2 on x64, novell suse linux enterprise server 10 sp2.
> > 
> > We think we've tracked it down to the following:
> > 
> > We are testing with 3 hosts:
> > 194.109.6.92 - www.xs4all.nl
> > 195.130.131.39 - www.telenet.be
> > 212.27.48.10 - www.free.fr
> 
> hobbitping in the current version isn't really designed to do very
> accurate RTT measurements - it's primary purpose is to see if the
> server is responding at all, not how fast it responds.
> 
> What happens is that hobbitping is extremely sensitive to delays
> induced by ARP lookups and brief spikes in e.g. the load on a
> network switch or router passing the ping packets. That is because
> hobbitping will only ping each host once (if the host responds
> to the first ping within the timeout period), and the first ping
> will often vary a lot more in RTT than subsequent ones.
> 
> So I'd recommend using fping if you want some more accurate RTT
> measurements.
> 
> There is a new ping daemon in the works for a later Xymon release,
> and indications are that it performs much better in this respect.

Even using hobbitping with the same host trice guives these strange results, so the arp entries over most of the link chain should already be cached. That being said, for the time being we'll migrate to fping because we do look at the RTT variations.

thx

// nick