nagios.cmd write order (cronological?)

[Marcel Mitsuto Fucatu Sugano]

On Thu, 2006-08-10 at 16:09 -0500, Marc Powell wrote:

> > > > Nagios 2.5, SuSE9.3.
> > > > Syslog-ng 1.6.8.
> > > >
> > > > I am configuring some passive checks to be transported by
> syslog-ng.
> > > >
> > > > So i've configured syslog to write directly to nagios.cmd.
> Everything
> > > > working fine, but as we are receiving check results from diferent
> > > > distributed nagios servers, I wonder if whether or not msgs
> written at
> > > > nagios.cmd has to be cronological. I mean, if some distributed
> server
> > > > lost the synchronization with ntp, and the epoch time of one msg
> gets
> > > > written to the nagios pipe with a timestamp lower than the one
> before
> > > > that, will Nagios drop the delayed check result?
> > > >
> > > > Thanks for any comments on this matter.
> > >
> > > Timestamps are important, but the order isn't.
> > >
> > 
> > By observation, it shows that timestamp and arrival (written) order
> does
> > matter! Does anyone else knows anything about concurrent writes to
> 
> Are you sure about that? My reading of commands.c (ver 2.3) is that the
> timestamp (entry_time) is used for logging/debugging purposes only. This
> is in line with my past experience.

No, not sure. Haven't read any nagios source code to confirm this. Just
watching the second destination configured on syslog-ng and nagios.log
entries, i've noticed that some entries never gets to nagios.log. Was
just guessing about. And my past experience is just about one year
administrating Nagios. 

> > matter! Does anyone else knows anything about concurrent writes to
> > nagios.cmd? Syslog-ng and nsca are writing to nagios.cmd pipe, but
> nsca
> > is configured to append mode.
> 
> Not really but... I'm surprised that using append mode for nsca works.
> That was originally used because the external command file used to be a
> real file, not a pipe. Since Netsaint 0.0.7 that functionality shouldn't
> be used for Nagios' external command functions. Could it be that your
> submissions to nagios.cmd are clobbering each other? Are they all atomic
> writes under the max pipe size for your OS (~512 bytes)?

Well, here i can confirm! :) When using nsca in "open pipe for writing"
mode instead of "open pipe for append" mode, and when starting syslog-ng
with the nagios.cmd as a destination, i've ended up with thousands of
staled results, because syslog-ng opens (locking) the pipe not allowing
nsca to write on it.

here is nsca.cfg's snippet:
********************************
# APPEND TO FILE OPTION
# This option determines whether or not the nsca daemon will
# will open the external command file for writing or appending.
# This option should almost *always* be set to 0!
# Values: 0 = open file for writing, 1 = open file for appending

append_to_file=1
*********************************

and syslog-ng's:
*********************************
destination d_nagios {
        pipe ("/opt/nagios/var/rw/nagios.cmd" template("$MSGONLY\n") template_escape(no));
        file ("/tmp/test.log" template("$MSGONLY\n") template_escape(no));
};
*********************************

About writing to nagios pipe, i am not sure if all writes are under the
max pipe size, but i am sure they're all atomic, as syslog-ng and nsca
is.

Here is a example of one of the bigger lines that syslog-ng writes to
nagios.cmd:
[10/08/2006 18:30:12]  PROCESS_SERVICE_CHECK_RESULT;sensei20-b;Server Check;1;Monitores do servidor alarmando warning:  disk:disk=86%(/opt) disk:disk=89%(/export)

I think it's below the max pipe size for my OS, although i cannot tell
for sure even how big the pipe is.

TIA.


AVISO: A informação contida neste e-mail, bem como em qualquer de seus anexos, é CONFIDENCIAL e destinada ao uso exclusivo do(s) destinatário(s) acima referido(s), podendo conter informações sigilosas e/ou legalmente protegidas. Caso você não seja o destinatário desta mensagem, informamos que qualquer divulgação, distribuição ou cópia deste e-mail e/ou de qualquer de seus anexos é absolutamente proibida. Solicitamos que o remetente seja comunicado imediatamente, respondendo esta mensagem, e que o original desta mensagem e de seus anexos, bem como toda e qualquer cópia e/ou impressão realizada a partir destes, sejam permanentemente apagados e/ou destruídos. Informações adicionais sobre nossa empresa podem ser obtidas no site http://sobre.uol.com.br/.

NOTICE: The information contained in this e-mail and any attachments thereto is CONFIDENTIAL and is intended only for use by the recipient named herein and may contain legally privileged and/or secret information. If you are not the e-mail´s intended recipient, you are hereby notified that any dissemination, distribution or copy of this e-mail, and/or any attachments thereto, is strictly prohibited. Please immediately notify the sender replying to the above mentioned e-mail address, and permanently delete and/or destroy the original and any copy of this e-mail and/or its attachments, as well as any printout thereof. Additional information about our company may be obtained through the site http://www.uol.com.br/ir/.

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null