nrpe-1.5 on AIX 4.3.3

Tyson Harker <[email protected]>
Newsgroups gmane.network.netsaint.user
Message-ID <90830E6818F0D411B880000629D54CEC03B913FE@sym_ntfs1.symitar.com>
I had everything running great and with no problems, then I found out that
the nrpe daemon wouldnt allow me to "down" the software that my company uses
so I decided to go in and play with the permissions that nrpe runs under.
After getting no luck, I decided to put everything back as it was, but when
I go to run the daemon useing ./nrpe -d /etc/nrpe.cfg it never runs.  I go a
grep for the process and it never shows up.  So I wiped out every instance
of nrpe that I could find then reconfigured it and I still get the same
problem.  Does anyone have any idea why I suddenly cannot run this?

-----Original Message-----
From: [email protected]
[mailto:[email protected]]
Sent: Saturday, August 10, 2002 12:03 PM
To: [email protected]
Subject: Netsaint-users digest, Vol 1 #1431 - 3 msgs


Send Netsaint-users mailing list submissions to
	[email protected]

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/netsaint-users
or, via email, send a message with subject or body 'help' to
	[email protected]

You can reach the person managing the list at
	[email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Netsaint-users digest..."


Today's Topics:

   1. Re: System time problem with NetSaint (amol sapkal)
   2. Detecting anomalies in time series. Was: checking for glacial changes
(Stanley Hopcroft)
   3. Re: Detecting anomalies in time series. Was: checking for glacial
changes (Stanley Hopcroft)

--__--__--

Message: 1
Date: Fri, 9 Aug 2002 15:45:38 -0700 (PDT)
From: amol sapkal <[email protected]>
Subject: Re: [netsaint] System time problem with NetSaint
To: Stanley Hopcroft <[email protected]>,
  [email protected]
Cc: [email protected]

--0-1857066914-1028933138=:31770
Content-Type: text/plain; charset=us-ascii


Dear Sir, 
Thx for the solution! 
But im unable to decipher the command here.. 
perl -i.bak -pe 's#^\[(\d+)\]#$1 - Your_Time_Correction(eg 2*3600)#e' 
netsaint.log 

is it necessary that it has to be in multiples of 3600 (1 hr)

also pls tell me where this command has to be executed.

 

Also, I was unable to find any relations between the 10 digit time stamps
(eg. 10288....), and the corresponding time value. Please help me to know
the logic behind the generation of these time stamps. I dont find any common
link between the sequence of the time stamps. Is it using some knind of
algorithm?


Will manual edition help, once the relation is known?


PS : I got 2 log files automatically generated for that day (8 august), one
with the name.. 
netsaint-08-08-2002-00.log 
and other with 
netsaint-08-08-2002-18.log 
The system date change was approximately 18-19 hrs ahead of the original
time. Is the value 18 in the 2nd log file to do anything with it? 
your kind help is appreciated. 
Warm Regds, 
Amol Sapkal 
GTL Ltd., Mumbai

 
 Stanley Hopcroft wrote:Dear Sir,



On Thu, Aug 08, 2002 at 02:20:52PM -0700, amol sapkal wrote:
> 
> Hi All,
> 
> I'm facing a strange but yet significant problem, where in my machine's
system timing was changed unknowingly. The NetSaint logs now show me wrong
log entries.
> 
> Is there anyway to get back the correct entries?
> 

I thhink that the only way of getting them back is editing them with the 
swiss army chainsaw, making sure that you are careful not to take your 
legs off.

> Do I need to edit the netsaint logs manually.
> 

perl -i.bak -pe 's#^\[(\d+)\]#$1 - Your_Time_Correction(eg 2*3600)#e' 
netsaint.log 

may be something like what you want, provided you know that the log 
entries are __all__ are out by the same constant amount.

(in any case, you should try your auto edit program [if you choose to
use one] on a copy of the log. -i.bak will give you the original log
with a '.bak' suffix/extension).

Otherwise, you'll have to identify when the log got the bad timestamps 
and then fix that bit.

> I have restored the correct system timing now.

It really sounds like you must 

. identify the bad bits in the log
. cut them out and save them somewhere
. correct them 
. put the corrected bits back in

This is feasable (I have done something like it) but messy and risky if 
you get lost.

Yours sincerely.

-- 
------------------------------------------------------------------------
Stanley Hopcroft
------------------------------------------------------------------------

'...No man is an island, entire of itself; every man is a piece of the
continent, a part of the main. If a clod be washed away by the sea,
Europe is the less, as well as if a promontory were, as well as if a
manor of thy friend's or of thine own were. Any man's death diminishes
me, because I am involved in mankind; and therefore never send to know
for whom the bell tolls; it tolls for thee...'

from Meditation 17, J Donne.


---------------------------------
Do You Yahoo!?
HotJobs, a Yahoo! service - Search Thousands of New Jobs
--0-1857066914-1028933138=:31770
Content-Type: text/html; charset=us-ascii

<P>Dear Sir, 
<P>Thx for the solution! 
<P>But im unable to decipher the command here.. 
<P>perl -i.bak -pe 's#^\[(\d+)\]#$1 - Your_Time_Correction(eg 2*3600)#e'
<BR>netsaint.log </P>
<P>is it necessary that it has to be in multiples of 3600 (1 hr)</P>
<P>also pls tell me where this command has to be executed.</P>
<P>&nbsp;</P>
<P>Also, I was unable to find any relations between the 10 digit time stamps
(eg. 10288....), and the corresponding time value. Please help me to know
the logic behind the generation of these time stamps. I dont find any common
link between the sequence of the time stamps. Is it using some knind of
algorithm?</P>
<P><BR>Will manual edition help, once the relation is known?</P>
<P>
<P>PS : I got 2 log files automatically generated for that day (8 august),
one with the name.. 
<P>netsaint-08-08-2002-00.log 
<P>and other with 
<P>netsaint-08-08-2002-18.log 
<P>The system date change was approximately 18-19 hrs ahead of the original
time. Is the value 18 in the 2nd log file to do anything with it? 
<P>your kind help is appreciated. 
<P>Warm Regds, 
<P>Amol Sapkal 
<P>GTL Ltd., Mumbai</P>
<P>&nbsp;
<P>&nbsp;<B><I>Stanley Hopcroft
<[email protected]></I></B>wrote:
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff
2px solid">Dear Sir,<BR><BR><BR><BR>On Thu, Aug 08, 2002 at 02:20:52PM
-0700, amol sapkal wrote:<BR>&gt; <BR>&gt; Hi All,<BR>&gt; <BR>&gt; I'm
facing a strange but yet significant problem, where in my machine's system
timing was changed unknowingly. The NetSaint logs now show me wrong log
entries.<BR>&gt; <BR>&gt; Is there anyway to get back the correct
entries?<BR>&gt; <BR><BR>I thhink that the only way of getting them back is
editing them with the <BR>swiss army chainsaw, making sure that you are
careful not to take your <BR>legs off.<BR><BR>&gt; Do I need to edit the
netsaint logs manually.<BR>&gt; <BR><BR>perl -i.bak -pe 's#^\[(\d+)\]#$1 -
Your_Time_Correction(eg 2*3600)#e' <BR>netsaint.log <BR><BR>may be something
like what you want, provided you know that the log <BR>entries are __all__
are out by the same constant amount.<BR><BR>(in any case, you should try
your auto edit program [if you choose to<BR>use one] on a copy of the
 log. -i.bak will give you the original log<BR>with a '.bak'
suffix/extension).<BR><BR>Otherwise, you'll have to identify when the log
got the bad timestamps <BR>and then fix that bit.<BR><BR>&gt; I have
restored the correct system timing now.<BR><BR>It really sounds like you
must <BR><BR>. identify the bad bits in the log<BR>. cut them out and save
them somewhere<BR>. correct them <BR>. put the corrected bits back
in<BR><BR>This is feasable (I have done something like it) but messy and
risky if <BR>you get lost.<BR><BR>Yours sincerely.<BR><BR>--
<BR>------------------------------------------------------------------------
<BR>Stanley
Hopcroft<BR>----------------------------------------------------------------
--------<BR><BR>'...No man is an island, entire of itself; every man is a
piece of the<BR>continent, a part of the main. If a clod be washed away by
the sea,<BR>Europe is the less, as well as if a promontory were, as well as
if a<BR>manor of thy friend's or of thine own were. Any man's death
diminishes<BR
>me, because I am involved in mankind; and therefore never send to
know<BR>for whom the bell tolls; it tolls for thee...'<BR><BR>from
Meditation 17, J Donne.</BLOCKQUOTE><p><br><hr size=1><b>Do You
Yahoo!?</b><br>
<a
href="http://rd.yahoo.com/careers/mailsig/new/*http://www.hotjobs.com">HotJo
bs, a Yahoo! service</a> - Search Thousands of New Jobs
--0-1857066914-1028933138=:31770--


--__--__--

Message: 2
Date: Sat, 10 Aug 2002 09:20:36 +1000
From: Stanley Hopcroft <[email protected]>
To: [email protected]
Subject: [netsaint] Detecting anomalies in time series. Was: checking for
glacial changes

Dear Ladies and Gentlmen,

I am writing with hopefully the last words about this matter. This may
be an important matter that my poor words are unfortunately obfuscating.

On Fri, Aug 09, 2002 at 07:36:48AM -0400, Bishop, Dean wrote:
> maybe you could use something like tcpdump to capture specific network
> traffic??
> 
> This assumes that this is a network app.
> 

Collecting the data is not an issue - sorry, former letters made this
unclear.

The problem is that for the monitor to make sense of time series data
and especially to recognise anomalies.

Applications are straightforward :-

. InOctet time series: does it look right
. Mails/time_units   : is the mail server actually working
. Syn packets        : is this a DOS
. Number processed   : is the processing system alive ?
. VMStat, SAR etc    : is the box Ok


So given a time series collected by some method and most familiarly
represented (for people) as a graph, how does one recognise if the graph
looks Ok ?

The Cricket people have phrased it better than I can at

http://cricket.sourceforge.net/aberrant

(There is also a paper by Luca Deri at http://luca.ntop.org/ADS.pdf -
Senior Deri is the ntop author - about this matter but it doesn't seem
to be specific enough to help me. I probably should read it again)

In a nutshell, you have a whole bunch of time series data (that you
probably graph), how can one automatically conclude that a dataset
indicates a fault ?

This I think is a reasonable thing for Netsaint to take an interest in.

The Cricket approach to anomaly detection is to

. have a modified RRD with a prediction Consolidation function in it
. check the actual values against the predicted (and the confidence
intervals/error bands)

Has anyone had any experience with a time series anomaly detector
(Cricket based or otherwise) ?

Yours sincerely.

-- 
------------------------------------------------------------------------
Stanley Hopcroft
------------------------------------------------------------------------

'...No man is an island, entire of itself; every man is a piece of the
continent, a part of the main. If a clod be washed away by the sea,
Europe is the less, as well as if a promontory were, as well as if a
manor of thy friend's or of thine own were. Any man's death diminishes
me, because I am involved in mankind; and therefore never send to know
for whom the bell tolls; it tolls for thee...'

from Meditation 17, J Donne.


--__--__--

Message: 3
Date: Sat, 10 Aug 2002 13:07:57 +1000
From: Stanley Hopcroft <[email protected]>
To: [email protected]
Subject: Re: [netsaint] Detecting anomalies in time series. Was: checking
for glacial changes

Dear Ladies and Gentlemen,

The development branch of rrdtool (1.1.x) apparently has the new RRAs
HWPREDICT (and friends, see the Cricket articles) for anomaly detection
in time series.

Has anyone any experience with them ?

Yours sincerely.

-- 
------------------------------------------------------------------------
Stanley Hopcroft
------------------------------------------------------------------------

'...No man is an island, entire of itself; every man is a piece of the
continent, a part of the main. If a clod be washed away by the sea,
Europe is the less, as well as if a promontory were, as well as if a
manor of thy friend's or of thine own were. Any man's death diminishes
me, because I am involved in mankind; and therefore never send to know
for whom the bell tolls; it tolls for thee...'

from Meditation 17, J Donne.



--__--__--

_______________________________________________
Netsaint-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/netsaint-users


End of Netsaint-users Digest


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.