NetXMS Support Forum

Quote from: Filipp Sudanov on March 19, 2024, 10:08:33 AMЭто именно на Windows системах? Какой версии Windows? Сколько ядер/процессоров?

Системы все Windows
На проблемных установлен Windows Server 2022 Datacenter
на одном 40 ядер (2 процессора по 20)
на втором 56 (2 процессора)
на третьем 40 (2 процессора)

Это именно на Windows системах? Какой версии Windows? Сколько ядер/процессоров?

Well, my bad, seems that I did not fully test the script that I've posted initially. It should be like this:

function main(oid, name) {
  transport = $node->createSNMPTransport();
  if (transport == null) return null;
  v = transport->getValue(oid);
  h = %{};
  for (a : v->split(",")) {
    b = a->split("=");
    if (b->size == 2) h[b[0]] = b[1];
  }
  return h[name];
}
The way it works - v->split(",") produces array where elements are "voltage=121.0" and so on. We loop through that array, so variable "a" has the value of each element of that array.
Now we need to split by "=" character and variable "b" becomes an array with two elements: [voltage, 121.0]. To access these elements we use index, so b[0] is "voltage" and b[1] is "121.0".
Now, h is a hashmap - sort of an array, but instead of numeric index elements are identified by string. We initialize it empty with h = %{}; And then we fill h with values with this code: h[b[0]] = b[1]; (and I now see the reason of the wrong code - forum editor is garbling the h[b[0]] part when pasting)

Добрый день! Участники форума. Прошу содействия в моей ситуации.

Установлен NetXMS последней версии (на ранних версиях та же самая проблема)

Часто CPU: usage (%) показывает нереальные показатели: например 26157,48%, 6594,98% и т.д.

Данная проблема наблюдается только с физическими машинами, с виртуальными проблем нет

На момент "нереальных" показателей на машине все стабильно (нагрузка ЦП около 10%), не смотря на это NetXMS показывает другие значения: 0,33%, 0,38%, 0,42% через какое-то время может показать 60000+%.

DataCollection что на физический что на виртуальных машинах одинаковая стандартная неизмененная
Пробовал переустанавливать агента. На новой машине с чистой Windows Server такая же проблема
Пробовал изменить Data Type с integer на Float - не помогло.

Подскажите, может кто сталкивался? Возможно есть решение?

can someone help me with above topic...

I did manage to get events when trying simple regexes that didn't try to match multiple lines of windows log messages.
But I'm a bit confused now about what is the tested string, since the docs only mention single lines, but the windows event is multiple lines and when I simply put (.*) as the match regex, in the event %1 was a multi line string with the full windows event message; which is strange since as far as I know . matches everything except new line; but either way the regex I used had . and explicit \r\n matched multiple times so it should've catched each case, also it worked when I tested it on regexr.com

Hi Victor,

Has there been any progress on this?

I'm afraid to upgrade my Grafana for fear of losing the NetXMS abilities!

However, I've recently run into an issue where any queries from Grafana peg the CPU at 100%.

It seems to make at least 5 sessions for each refresh of the page!

As you can see, I don't have a very large installation and this has been fine up until very recently.  Memory is only using about half of 16GB.

Thanks!

V returns a valid result namely the full OID value "type=Master,,voltage=121.0,current=0.000,activePower=0.000,powerFactor=1.000,energy=3.446,temperature=-1,humidity=-1

I thought the next function was stuck on the second comma because the only result I get for b is "type=Master" That led me to try this

function main(oid, name) {
  transport = $node->createSNMPTransport();
  if (transport == null) return null;
  v = transport->getValue(oid);
  z = string(v);
  x = substr(z, 13);

  h = %{};
  for (a : x->split(",")) {
    b = a->split("=");
 println(b);
    if (b->size == 2) h = b[1];
  }
    return h[name];
}

Apparently I can't change the value to a string before passing it to h.

I'd guess the unit is ms, but I'll check.

And if your try policy as simple as that:
<parser checkInterval="10000" name="">
  <macros/>
  <file>*Security</file>
  <rules>
      <rule name="">
        <match repeatCount="0" repeatInterval="1">.*</match>
        <event>A</event>
        <metrics class="java.util.ArrayList"/>
        <agentAction action=""></agentAction>
      </rule>
  </rules>
</parser>
will there be any events?

Checklist of things:
- agent should have this in it's config:
SubAgent = logwatch
- template with the policy should be applied to node

I tried creating a template and added a log parser policy with the following content:
<parser checkInterval="1" name="Admin activity parser">
   <macros/>
   <file>*Security</file>
   <rules>
      <rule name="Login">
         <match repeatCount="0" repeatInterval="3600" reset="false">Emelt szintű jogkivonat:\s+Igen(?:.|\r\n)+Fióknév:\s+(\w+)</match>
         <event>VV_ADMIN_LOGON</event>
         <id>4624</id>
         <push group="1"></push>
         <agentAction action=""></agentAction>
      </rule>
   </rules>
</parser>It didn't crash the server however it also doesn't trigger the event, I tried to:

• reduce the checkInterval from the default 10000 to 1 (what is the unit for this?)
• make the regex match the whole message
• use literal \r\n and \t in the expression

I made sure that the template is applied to the node I'm testing with, and in the windows events view I can see the windows event for the login. Also I'm still running netxmsd from gdb and I can only see entries like this and nothing else when I log into an account on the client:
*D* [agent.conn.10794   ] AgentConnectionEx::onWindowsEvent(): Received event from agent at 10.255.7.114, node ID 1814