NetXMS Support Forum

If the "installation" is the only problem, the agent can be just "copied".
Only few files are needed to run the agent.

If this is not possible, what about "polling" the services itself ?
Depends on the service though... e.g. sending a simple query to test if sql is up and responding, etc.

With regards,
Milan

Hi,

do a snmpwalk on the device with .1.3.6.1.2.1.2.2.1.16 value.
It should list all subsequent oids (.1.3.6.1.2.1.2.2.1.16.0, .1.3.6.1.2.1.2.2.1.16.1 etc..) with values and see if there are values in 1, 2, 9, 10, 33.

One more thing - Instance discovery method should be SNMP Walk - OIDs (but I suppose you've got that right).

With regards,
Milan

Hello, I will reply here so others can try to help too.

QuoteDESCRIPTION -interface traffic: {instance}
PARAMETER -1.3.6.1.2.1.2.2.1.16.{instance}
base OID to .1.3.6.1.2.1.2.2.1.16
snmp = CreateSNMPTransport($node);
return SNMPGetValue(snmp, ".1.3.6.1.2.1.2.2.1.16." . $1) != 0;

Not sure if it is the problem you encountered but I had problems with this structure because there is no guarantee there will be 0 value, there can be null too so I wrote it like this:

snmp = CreateSNMPTransport($node);
x = SNMPGetValue(snmp, ".1.3.6.1.2.1.2.2.1.16." . $1);
if  (x != null) return (x > 0);
else return 0;

p.s. does it mean you get the desired DCI with correct OID on all of your nodes but the value there is 0 or it creates unwanted DCIs with wrong OID?

Thanks for the explanation.

I have completely skipped rsyslog configuration and then tried to send TCP with the @@ parameter in the rsyslogd.conf too.
After correctly setting rsyslogd.conf file to send UDP the syslog is filling as expected.

Now I have to explore syslog more to set forwarding only for nxagent/desired events.

With regards,
Milan Sperl

There is no DCI for "node down". DCI is just collecting inspected parameter value over time and can have action based on threshold of these values.

Not sure what you need then but for the record, how to recreate "Node Down" discussed in this topic:

- in Script Library create script called "OnNodeDown" - SetCustomAttribute($node, "DowntimeStart", time());
- in Actions Configuration create Action "OnNodeDown" - Type: Execute NXSL Script, Script name: OnNodeDown
- in Event Processing Policy edit node down rule (usually no.1) and add Action - Server Action - OnNodeDown

This is just the part that "writes" exact time when node went down.

To calculate downtime and include it in the SYS_NODE_UP event:
- create a script "DownTime" - return SecondsToUptime(time() - GetCustomAttribute($node, "DowntimeStart"));
- add macro to desired place (action, event...) - %[DownTime]

There can be some errors when calling the DownTime macro and no "DowntimeStart" value exists, but these should not happen eventually (script can be adjusted to handle these events too).

With regards,
Milan

Hello, still no results starting the syslog server, or rather not receiving any data...
I am totally new to the syslog problematics so I cannot say if there is something I am doing wrong.

Not sure what you mean by "opposite" because that is how I understood it in the first place:

Set up server (in NetXMS Server Configuration console):
- EnableSyslogDaemon: 1
- SyslogListenPort: 514
- SyslogRetentionTime: 90

Set up server logging to syslog:
- netxmsd.conf: LogFile = {syslog}

Set up local and one remote agent logging to syslog:
- nxagentd.conf: LogFile = {syslog}

Even added firewall rule, just to be sure
- iptables: -A INPUT -p udp -m state --state NEW -m udp --dport 514 -j ACCEPT

Restarted iptables. Restarted agent and server by shuttting both down and then starting agent first, server second. Restarted remote agent too.

Still no results.

I suppose parameter in Server Configuration - ExternalAuditPort: 514 is not interfering (it is there by default)?
Even tried to overwrite LogFile = {syslog} to LogFile = {serverIPaddress:514} (and restart server as usual).

Really dont know how to try to solve this problem anymore...

With regards,
Milan Sper

Thanks for the help. This is what I came up with:

The idea is to filter alerts and to prioritize those that are not secondary in terms of node down status.
If node is down and node above in the infrastructure is also down, the chances are high that the problem is only at the uppermost node and all other node down events are only "flooding" the supervisors attention.
Assuming I have nodes sorted in the infrastructure to fit the needs - based on dependency.

There was one thing to decide first - whether to filter the events or just actions based on the events.

a) events start only for nodes that fulfill the filter criteria
pro: event log and/or actions based on all events contain only the uppermost alerts
con: if there are problems with other nodes too (or if the problem starts in the meantime), after the uppermost node is resolved (up) - other problems are not shown in the log or taken action upon

b) events start and show for each node down but actions (e-mails) start only for events that pass the filter
pro: solves the problem in variant a)
con: event log contains all down nodes for the duration of the uppermost node downtime, effectively making the view unusable (if there are alot of depending nodes)

I decided for variant b) (with tagging the events to have some sort of control in the event log)

Event Processing Policy
- create a "copy" of the default rule 1. (Show alarm when node is down)
Filter:
- IF: SYS_NODE_DOWN
- AND:
nparents = GetNodeParents($node); // get parent objects of tested node
foreach(i : nparents)
{
if (i->type == 5) // if it is infrastructure object (container)...
{
oparents = GetObjectParents(i); //... get parents of the object too...
foreach(j : oparents)
{
if (j->type == 5) //... and if it is infrastructure object (container) again...
{
children = GetObjectChildren(j); //... get object children...
foreach(k : children)
{
if ((k->status == 4) && (classof(k)!="NetObj")) return 0; //... and if the status of any of the children objects is "critical" (bypassing non-node objects) do not take action.
}
}
}
}
}
return 1; // else allow action
Action: send e-mail (for example)

I used the same script as macro in the events SYS_NODE_DOWN to tag it whether the e-mail was sent or muted.
Basically adding the script into script library too and adding to the SYS_NODE_DOWN the %[Dependency] macro which is the same as above with the exceptions:
- "return 0" changed to "return " (e-mail muted)"
- "return 1" changed to "return " (e-mail sent)"

I decided not to differentiate what node above the chain is down (basically if any of the upper ones is down it means all below will go down as well anyway), but can pick with the like operation if needed.

Any thoughts on drawbacks ?

Thanks! Work like a charm 

p.s. could I get my old topic Dependency script based on infrastructure unlocked to post what I came up with to share with others ?

Thank you,

   if I understand it - just by configuring these options and having LogFile = {syslog} in netxmsd.conf (by default) should (after server restart) start up syslog in NetXMS console and start filling it with NetXMS log ?

Tried to check it in View-Syslog and Monitor-Syslog with no results.

/var/log/messages is receiving a few NetXMS server lines but nothing appears in the NetXMS syslog.

Attaching messages log - after server restart.

With regards,
Milan Sperl

Hello,

   there is no description for GetInterfaceName/Object functions so I am constructing script with GetNodeInterfaces or GetObjectChildren (with the same results).

The goal is to list peer nodes of subjected node.
The following macro works fine, returning a list of all ports and then another list with ports which have any peer connection listed.
ports = "PORTs:\n";
peers = "PEERs:\n";
interfaces = GetObjectChildren($node); (or GetNodeInterfaces function)
foreach (i : interface)
{
ports = ports."- name=".i->name.", id=".i->id."\n";
if (i->peerNode != null)
{
peers = peers."- name=".i->name.", IP=".i->ipAddr.", peer=".i->peerNode."\n";
}
}
return ports.peers;

Whole macro works fine except the last statement which returns error message.
After removing the "i->peerNode" part I get nice output in this form:

QuotePORTs:
* name='Vl1 id=5699'
* name='Vl91 id=5700'
* name='Fa0/1 id=5701'
* name='Fa0/2 id=5702'
...
* name='Fa0/23 id=5723'
* name='Fa0/24 id=5724'
* name='Gi0/1 id=5725'
* name='Gi0/2 id=5726'
* name='Nu0 id=5727'
PEERs:
* name='Gi0/1' IP=0.0.0.0 peer='
* name='Gi0/2' IP=0.0.0.0 peer='

Tried to use structure with GetInterfaceObject in the foreach loop...
iface = GetInterfaceObject(i,  $5];
... to get iface->peerNode, but I get immediately "Function not found" on the line with GetInterfaceObject function.

With regards,
Milan Sperl

In the GetNodeInterfaces example there are used two parameters - name and id.

My question is - can other parameters from Interfaces be used the same way or it is not possible at all ?

I'm trying to get a list of peers with "i->peerInterface", no results with GetNodeIntefaces or GetObectChildren too - script fails at this point with "invalid operation on object".

Any help?

Hello,

   I have read as much as I could about syslog watching and parsing here, but I found out that I cannot start with this functionality as I have problems setting up syslog functionality by itself.

I noticed that netxmsd.conf file has LogFile = {syslog} by default and yet the log in console Syslog is empty.
Somewhere here I read that server log is managed by the agent so I changed agent configuration file (by LogFile = {syslog}), but with no results. Tried with remote agent also.

Is there something specific needed or configured to have syslog accept log from agent ?

My current configuration is:
DBDriver = /opt/netxms/lib/libnxddr_mysql.so
DBServer = localhost
DBName = ******
DBLogin = ******
DBPassword = ******
LogFailedSQLQueries = yes
LogFile = {syslog}
JavaPath=/usr/bin/java
JavaLibraryDirectory=/opt/netxms/java-lib
JDBCDriver=com.mysql.jdbc.Driver
JDBCUrl=jdbc:mysql://localhost:3306/netxms

MasterServers = 127.0.0.1, netxmsserver.company.domain
LogFile = {syslog}

MasterServers = netxmsserverIPaddress
LogFile = {syslog}
FileStore = /var/nxagentd

No subagents or parsing yet.
All we need for the time being is to store larger logs from devices that are not suitable for maintaining large logs by itself (and to keep the logs in one place).

With regards,
Milan Sperl

Solved by adding the subnet to the Address Filters section.
It just took longer time than expected...

Hello,

   we have subnets 172.17.0.0/24 and 172.17.1.0/24 as a part of our infrastructure but NetXMS is not recognizing these subnets and does not show them in the Entire Network section. Is this set by default or is there something we might have done wrong?

IPs (e.g. 172.17.1.10) of devices in those networks are pingable, reachable and visible in NetXMS in other subnet just fine (128.0.0.0/2).
There is subnet 172.0.0.0/24 showing for NetXMS server too...

With regards,

Milan Sperl

Hi,

   ever since I saw the script for filtering out consequent alarms as shown on wiki page Situations Overview I was trying to think of not needing to specify what depends on what, but base it on actual topology instead.

I came up with an idea to filter out alarms based on topology availability. For example - if dependent node triggers alarm, it first checks if the node it is topologically dependent on is down or not.
Sorting nodes in Infrastructure based on this is logical anyway...

The infrastructure looks like this:
-Infrastructure Services
|- X01-locality
||- N-nodeA
||- D-dependency_node
||- X11-sub
|||- N-nodeB
|- X02-locality
...

The problem with the script might be trivial because I need some string related comparison for the names of containers and node names.

What I am trying to do is list node parents of "N-nodeB" with
nparents = GetNodeParents(FindObject($1));
foreach(i : nparents)
{
    println "Parent name='" . i->name;
}
... I get bunch of parents like this:

QuoteParent name='10.0.5.0/24'
Parent name...
...
Parent name='X11-sub' <=Infrastructure Services Folder

At this point I cannot get the right command to filter out just the infrastructure folder "X11-sub" because I need to compare just a part of the name, not the whole string. I only need to see if the name starts with "X" and that cannot be done by - if i->name=="X".

After that I will be looking for object parents of that folder, then for object children and find those with dependency status "D" and trigger the alarm based on availibility of that node.

I cannot get past this "compare based on part of the string" part only... any hints?

With regards

Milan Sperl