NetXMS Support Forum

Hi,

Here you can get a little insight about that: https://www.netxms.org/documentation/adminguide/zones.html
Basically a proxy agent is needed in remote location, then just setup connections, allow ports (FW etc.).

Regards,
Nikk

Hi,

here is a part of log file (there is no error messages), but I'm trying this only as exercise. Actual file i wish to parse ir backup systems log file, where i wish to parse error messages.

Quote[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(KURMIS): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(KURMIS [786]): unable to get system uptime
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(LAPSA): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(KURMIS [786]): unable to get agent uptime
[28-Apr-2014 11:52:49.631] [DEBUG] Finished status poll for node KURMIS (ID: 786)
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(LAPSA [783]): unable to get system uptime
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(LAPSA [783]): unable to get agent uptime
[28-Apr-2014 11:52:49.631] [DEBUG] Finished status poll for node LAPSA (ID: 783)
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(PELE): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(PELE [788]): unable to get system uptime
[28-Apr-2014 11:52:49.631] [DEBUG] StatusPoll(PELE [788]): unable to get agent uptime
[28-Apr-2014 11:52:49.631] [DEBUG] Finished status poll for node PELE (ID: 788)
[28-Apr-2014 11:52:49.646] [DEBUG] StatusPoll(192.168.44.254): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.646] [DEBUG] Node::createAgentConnection(Proxy [383])
[28-Apr-2014 11:52:49.646] [DEBUG] Routing table updated for node TUKU [461]
[28-Apr-2014 11:52:49.646] [DEBUG] Node::createAgentConnection(Proxy [383]): conn=00000000096BC610
[28-Apr-2014 11:52:49.834] [DEBUG] Node::createAgentConnection(Proxy [383])
[28-Apr-2014 11:52:49.834] [DEBUG] Node::createAgentConnection(Proxy [383])
[28-Apr-2014 11:52:49.849] [DEBUG] Node::createAgentConnection(Proxy [383]): conn=0000000009578E40
[28-Apr-2014 11:52:49.865] [DEBUG] Routing table updated for node Liepaja [407]
[28-Apr-2014 11:52:49.865] [DEBUG] Node::createAgentConnection(Proxy [383]): conn=00000000092EA150
[28-Apr-2014 11:52:49.912] [DEBUG] StatusPoll(BALV): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.928] [DEBUG] StatusPoll(BALV [415]): boot time set to 1395040633 from agent
[28-Apr-2014 11:52:49.928] [DEBUG] StatusPoll(valmiera): bAllDown=false, dynFlags=0x00001001
[28-Apr-2014 11:52:49.959] [DEBUG] StatusPoll(valmiera [409]): boot time set to 1393231678 from agent
[28-Apr-2014 11:52:49.959] [DEBUG] Finished status poll for node BALV (ID: 415)
[28-Apr-2014 11:52:49.974] [DEBUG] Finished status poll for node valmiera (ID: 409)

But this event spam happens even if the log file is empty, so there must be something with the configuration, i think.
Whatever i define in match section, it results in event spam.

Windows event monitoring (*System etc.) works fine. But why doesn't the file option work?

Regards,
Nikk

Thanks for your responses!

Borgso, i will try smbstatus, but ProcessCount with smbd is faulty, because, there are still many smbd processes running, while samba itself is down. :/

Victor, what are the status return codes?

Using this Net.RemoteShareStatus(share,domain,login,password)
It shows 0, also when i type incorrect domain, respectively OK for Text.

Hello,

Is there a way to monitor samba similar to this https://www.netxms.org/forum/configuration/monitoring-ftp-daemon/msg10341/#msg10341 with externalparameter using smbclient //server/service -U user?

Because with ProcessCount it's not possible to tell whether samba is running or not.

Regards,
Nikk

Hi,

I wanted to do a simple log parsing. Set simple match regexp - (error.*) and event with param on netxms log file. When I enabled the parser file on agent config, it started to spam a lot of events (~10 each sec), although there were no matching lines.

Then i tried on a blank file, same thing, just spaming alot of events.
Tried matching just a letter, the same.
Anything i did, resulted in event spam.

Parser:
<parser>
    <file>C:\NetXMS\log</file>
    <rules>
        <rule>
            <match>(error.*)</match>
            <event params="1">100049</event>
        </rule>
    </rules>
</parser>


SubAgent = logwatch.nsm
*LOGWATCH
Parser = C:\NetXMS\logwatch\Test.xml

Subagent is loaded successfully.
Log:

Quote
[22-Apr-2014 14:18:56.050] [DEBUG] EVENT 100049 (ID:42456 F:0x0001 S:4 TAG:"") FROM Node:
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_EVENTLOG_RECORDS
[22-Apr-2014 14:18:56.050] [DEBUG] Event 42456 match EPP rule 67
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: event BACKUP_CRIT id 42457 source Node [100]
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: finished, rootId=0
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_ALARM_UPDATE
[22-Apr-2014 14:18:56.050] [DEBUG] EVENT 100049 (ID:42457 F:0x0001 S:4 TAG:"") FROM Node:
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_EVENTLOG_RECORDS
[22-Apr-2014 14:18:56.050] [DEBUG] Event 42457 match EPP rule 67
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: event BACKUP_CRIT id 42458 source Node [100]
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_ALARM_UPDATE
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: finished, rootId=0
[22-Apr-2014 14:18:56.050] [DEBUG] EVENT 100049 (ID:42458 F:0x0001 S:4 TAG:"") FROM Node:
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_EVENTLOG_RECORDS
[22-Apr-2014 14:18:56.050] [DEBUG] Event 42458 match EPP rule 67
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: event BACKUP_CRIT id 42459 source Node [100]
[22-Apr-2014 14:18:56.050] [DEBUG] [CLSN-0] Sending message CMD_ALARM_UPDATE
[22-Apr-2014 14:18:56.050] [DEBUG] CorrelateEvent: finished, rootId=0

etc.

Is this bug or I miss something?

Regards,
Nikk

Hi,

So, is this bug or it isn't implemented yet? Maybe there is another way how to send events to local server?
The thing is, that our main devices are located in remote areas, but monitoring should be local. And Proxy-agent connections just occupy the network.

Respectfully,
Nikk

Thank you, Victor! Works great

Hi,

How can i get clean formatted value in last value window (or better as event parameter)? What I want to do is format or round disk space value.
The value shows up like 12.410000 , but it should be like 12.41 (as it shows in history table)  because transformation script is: format($1,1,2) or round($1,2).

And event parameter %4 is also taking those zeros. How can I get rid of those zeros?

Nikk

Hi,

Everything works fine on Windows server 2012! Thanks a lot, for efforts!

Nikk

Hi,

Yes, zones are being used.

Nikk

Hi,

I managed to get rid of the previous error, but now i'm getting another:

On Remote_Server:

Quote
[12-Mar-2014 14:10:40.651] [DEBUG] EVENT 17 (ID:1822 F:0x0001 S:1 TAG:"") FROM Remote_Server: Threshold reached for data collection item "Inbound traffic on enp10s1 (packets/sec)" (Parameter: Net.Interface.PacketsIn(2); Threshold value: 10; Actual value: 11)
[12-Mar-2014 14:10:40.651] [DEBUG] Event 1822 match EPP rule 15
[12-Mar-2014 14:10:40.651] [DEBUG] [CLSN-2] Sending message CMD_EVENTLOG_RECORDS
[12-Mar-2014 14:10:40.652] [DEBUG] *actions* Executing action 1 (New action) of type FORWARD EVENT
[12-Mar-2014 14:10:40.652] [DEBUG] [CLSN-2] Sending message CMD_ALARM_UPDATE
[12-Mar-2014 14:10:40.652] [DEBUG] *actions* Forwarding event to "Local_server"
[12-Mar-2014 14:10:40.665] [WARN ] Failed to forward event to server Local_server: Object not found

And on Local_server

Quote
[12-Mar-2014 14:10:41.376] [DEBUG] New ISC connection from Remote_Server
[12-Mar-2014 14:10:41.376] [DEBUG] ISC<Remote_Server>: received control message CMD_GET_NXCP_CAPS
[12-Mar-2014 14:10:41.378] [DEBUG] ISC<Remote_Server>: message CMD_KEEPALIVE received
[12-Mar-2014 14:10:41.378] [DEBUG] ISC<Remote_Server>: sending message CMD_REQUEST_COMPLETED
[12-Mar-2014 14:10:41.381] [DEBUG] ISC<Remote_Server>: message CMD_ISC_CONNECT_TO_SERVICE received
[12-Mar-2014 14:10:41.381] [DEBUG] ISC<Remote_Server>: attempt to connect to service 1
[12-Mar-2014 14:10:41.381] [DEBUG] ISC<Remote_Server>: connected to service 1
[12-Mar-2014 14:10:41.381] [DEBUG] ISC<Remote_Server>: sending message CMD_REQUEST_COMPLETED
[12-Mar-2014 14:10:41.384] [DEBUG] ISC<Remote_Server>: message CMD_FORWARD_EVENT received
[12-Mar-2014 14:10:41.384] [DEBUG] Event forwarding request from Remote_Server
[12-Mar-2014 14:10:41.384] [DEBUG] ISC<Remote_Server>: sending message CMD_REQUEST_COMPLETED
[12-Mar-2014 14:10:41.386] [DEBUG] ISC<Remote_Server>: connection closed
[12-Mar-2014 14:10:41.386] [DEBUG] ISC<Remote_Server>: session closed

But in reverse situation (local -> remote) everything worked fine!
Then i have a question, what is this object which cannot be found?

On both servers ISCListener enabled and ReceiveForwardedEvents enabled.
On both servers there is identical (except ID) node object with the same ip address.

Local_Server - 1.2.12,  Ubuntu 12.04 LTS
Remote_Server - 1.2.10, Ubuntu 12.04 LTS

Nikk

Hi,

Any news to this? Having the same problem on Ubuntu 12.04.

Nikk

Hi,

I wanted to monitor some linux services (not network services) using Service.Check(*) parameter. But all i got is status response 2. Is this status response the same as other ServiceCheck.Http etc. like :
Service check return:
0 - success (server was connected and return expected response)
1 - invalid arguments was passed
2 - cannot connect to server
3 - bad server's response
??

Or I'm just using this parameter wrong.

Nikk

Thank you for response

Nikk