Re: [xymon] Data flooding from x.x.x.x

[Henrik "Størner" <henrik (at) hswn.dk>]

In <4CC17F18.7040309 (at) shihad.org> Iain M Conochie <iain (at) shihad.org> writes:

>Good afternoon xymoners.

>  Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 
>10MB to try to avoid these error messages?

>Latest errormessages:
>Data flooding from X.X.X.X, closing connection


Running out of memory on your Xymon server would be one of the concerns,
since all of the status messages that Xymon receives are stored in
memory.

Also, the MAX_....BUFZ parameters wouldn't be enough when you go
above 10 MB. You would have to change this line in hobbitd.c:

#define MAX_HOBBIT_INBUFSZ (10*1024*1024)       /* 10 MB */

which is really what triggers the "Data flooding..." message.


Also, do consider that these boxes are transferring 10 MB+ data
every 5 minutes to your Xymon server. I know we have gigabit
Ethernet etc, but that's 350 kbit/sec for each of those boxes.


>  These are windows boxes and most likely there is something wrong with 
>the client but we are seeing this very consistently.

I've seen this lately, triggered by huge Windows event-logs.
On Windows-systems, that's probably the only piece of data
that can get so huge.

If you know which hosts are causing this - look at the IP's - 
then I would recommend that the first action should be to look
at why there are so many log-entries in the eventlog. And
since eventlog-scanning can load a system rather heavily, you
may want to consider turning off eventlog monitoring completely.
Or at least for the particular log that generates so much data.


Regards,
Henrik