<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"> <meta name=ProgId content=Word.Document> <meta name=Generator content="Microsoft Word 9"> <meta name=Originator content="Microsoft Word 9"> <link rel=File-List href="cid:filelist.xml@01C2D8FF.0D742210">  <style>  </style> </head> <body lang=EN-US style='tab-interval:.5in'> <div class=Section1> I might also add that the instances parameter had to be increased/set.. basically xinetd is thinking theres a Dos attack going on..<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> Gerald Wichmann<o:p></o:p> Senior Systems Development Engineer<o:p></o:p> Zantaz, Inc.<o:p></o:p> 925.598.3099 (w)<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> -----Original Message----- From: Gerald Wichmann Sent: Thursday, February 20, 2003 4:45 PM To: Gerald Wichmann; Nagios (E-mail) Subject: RE: [Nagios-users] NSCA daemon deactivated due to excessive incoing connections? <![if !supportEmptyParas]> <![endif]><o:p></o:p> Nevermind found the problem.. newer versions of xinetd have a “cps” parameter that by default in xinetd.conf is set to “25 30”.. this parameter dictates the max # of connections per second (25) that a service can handle before xinetd shuts it down (DOS attack protection).. the second argument specifies how many seconds it waits before starting the service again (30)..<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> I just had to edit /etc/xinetd.d/nsca and add “cps 200 10” to increase the # of connections per second it can handle.<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> Gerald Wichmann<o:p></o:p> Senior Systems Development Engineer<o:p></o:p> Zantaz, Inc.<o:p></o:p> 925.598.3099 (w)<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> -----Original Message----- From: Gerald Wichmann Sent: Thursday, February 20, 2003 2:37 PM To: Nagios (E-mail) Subject: [Nagios-users] NSCA daemon deactivated due to excessive incoing connections?<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> I have 2 distributed servers and 1 central nagios server. The central nagios server in /var/log/messages I see regular entries “xinetd[717]: Deactivating service nsca due to excessive incoming connections. Restarting in 30 seconds.” And then the service is activated again.<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> I’m rather surprised by it as I don’t really have that many services that I’m monitoring.. around 130 in total. Any ideas what I should look at to rectify these messages?<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> <o:p></o:p> Thanks,<o:p></o:p> Gerald<o:p></o:p> <![if !supportEmptyParas]> <![endif]><o:p></o:p> </div> </body> </html> This e-mail has been captured and archived by the ZANTAZ Digital Safe(tm) service. For more information, visit us at www.zantaz.com. IMPORTANT: This electronic mail message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by telephone or directly reply to the original message(s) sent. Thank you. This e-mail has been captured and archived by the ZANTAZ Digital Safe(tm) service. For more information, visit us at www.zantaz.com. IMPORTANT: This electronic mail message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately by telephone or directly reply to the original message(s) sent. Thank you.