On Thu, 2006-08-10 at 16:09 -0500, Marc Powell wrote: > > > > Nagios 2.5, SuSE9.3. > > > > Syslog-ng 1.6.8. > > > > > > > > I am configuring some passive checks to be transported by > syslog-ng. > > > > > > > > So i've configured syslog to write directly to nagios.cmd. > Everything > > > > working fine, but as we are receiving check results from diferent > > > > distributed nagios servers, I wonder if whether or not msgs > written at > > > > nagios.cmd has to be cronological. I mean, if some distributed > server > > > > lost the synchronization with ntp, and the epoch time of one msg > gets > > > > written to the nagios pipe with a timestamp lower than the one > before > > > > that, will Nagios drop the delayed check result? > > > > > > > > Thanks for any comments on this matter. > > > > > > Timestamps are important, but the order isn't. > > > > > > > By observation, it shows that timestamp and arrival (written) order > does > > matter! Does anyone else knows anything about concurrent writes to > > Are you sure about that? My reading of commands.c (ver 2.3) is that the > timestamp (entry_time) is used for logging/debugging purposes only. This > is in line with my past experience.
No, not sure. Haven't read any nagios source code to confirm this. Just watching the second destination configured on syslog-ng and nagios.log entries, i've noticed that some entries never gets to nagios.log. Was just guessing about. And my past experience is just about one year administrating Nagios. > > matter! Does anyone else knows anything about concurrent writes to > > nagios.cmd? Syslog-ng and nsca are writing to nagios.cmd pipe, but > nsca > > is configured to append mode. > > Not really but... I'm surprised that using append mode for nsca works. > That was originally used because the external command file used to be a > real file, not a pipe. Since Netsaint 0.0.7 that functionality shouldn't > be used for Nagios' external command functions. Could it be that your > submissions to nagios.cmd are clobbering each other? Are they all atomic > writes under the max pipe size for your OS (~512 bytes)? Well, here i can confirm! :) When using nsca in "open pipe for writing" mode instead of "open pipe for append" mode, and when starting syslog-ng with the nagios.cmd as a destination, i've ended up with thousands of staled results, because syslog-ng opens (locking) the pipe not allowing nsca to write on it. here is nsca.cfg's snippet: ******************************** # APPEND TO FILE OPTION # This option determines whether or not the nsca daemon will # will open the external command file for writing or appending. # This option should almost *always* be set to 0! # Values: 0 = open file for writing, 1 = open file for appending append_to_file=1 ********************************* and syslog-ng's: ********************************* destination d_nagios { pipe ("/opt/nagios/var/rw/nagios.cmd" template("$MSGONLY\n") template_escape(no)); file ("/tmp/test.log" template("$MSGONLY\n") template_escape(no)); }; ********************************* About writing to nagios pipe, i am not sure if all writes are under the max pipe size, but i am sure they're all atomic, as syslog-ng and nsca is. Here is a example of one of the bigger lines that syslog-ng writes to nagios.cmd: [10/08/2006 18:30:12] PROCESS_SERVICE_CHECK_RESULT;sensei20-b;Server Check;1;Monitores do servidor alarmando warning: disk:disk=86%(/opt) disk:disk=89%(/export) I think it's below the max pipe size for my OS, although i cannot tell for sure even how big the pipe is. TIA. AVISO: A informação contida neste e-mail, bem como em qualquer de seus anexos, é CONFIDENCIAL e destinada ao uso exclusivo do(s) destinatário(s) acima referido(s), podendo conter informações sigilosas e/ou legalmente protegidas. Caso você não seja o destinatário desta mensagem, informamos que qualquer divulgação, distribuição ou cópia deste e-mail e/ou de qualquer de seus anexos é absolutamente proibida. Solicitamos que o remetente seja comunicado imediatamente, respondendo esta mensagem, e que o original desta mensagem e de seus anexos, bem como toda e qualquer cópia e/ou impressão realizada a partir destes, sejam permanentemente apagados e/ou destruídos. Informações adicionais sobre nossa empresa podem ser obtidas no site http://sobre.uol.com.br/. NOTICE: The information contained in this e-mail and any attachments thereto is CONFIDENTIAL and is intended only for use by the recipient named herein and may contain legally privileged and/or secret information. If you are not the e-mail´s intended recipient, you are hereby notified that any dissemination, distribution or copy of this e-mail, and/or any attachments thereto, is strictly prohibited. Please immediately notify the sender replying to the above mentioned e-mail address, and permanently delete and/or destroy the original and any copy of this e-mail and/or its attachments, as well as any printout thereof. Additional information about our company may be obtained through the site http://www.uol.com.br/ir/. ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Nagios-users mailing list Nagios-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nagios-users ::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. ::: Messages without supporting info will risk being sent to /dev/null