Ping monitoring "loosing" data

[lbon]

I have been setting up a monitoring, where an agent fpings different host, filters the reply time and presenting in a graph like this:



The agent is also pinging itself as a control mechanism

This is the config:

UserParameter=net.ping_cloudflare,c:\drift\fping 1.1.1.1 -n 1 -i -l | "C:\Program Files (x86)\GnuWin32\bin\gawk.exe" "{print substr($5,6); }"
UserParameter=net.ping_localhost,c:\drift\fping 127.0.0.1 -n 1 -i -l | "C:\Program Files (x86)\GnuWin32\bin\gawk.exe" "{print substr($5,6); }"

So in this case, it seems that cloudflare times out around 08:58:43

But I do not that cloudflare is down around that time... So to prove this, I have created an extra control at the localhost:

c:\drift\fping 1.1.1.1 -i -l -D -T -c >> c:\drift\cloudflare.txt

and the cloudflare.txt shows this the the time period:

2023/01/05 08:58:37.110 : Reply[74096] from 1.1.1.1: bytes=32 time=1.4 ms TTL=56
2023/01/05 08:58:38.114 : Reply[74097] from 1.1.1.1: bytes=32 time=2.5 ms TTL=56
2023/01/05 08:58:39.115 : Reply[74098] from 1.1.1.1: bytes=32 time=1.3 ms TTL=56
2023/01/05 08:58:40.117 : Reply[74099] from 1.1.1.1: bytes=32 time=1.3 ms TTL=56
2023/01/05 08:58:41.119 : Reply[74100] from 1.1.1.1: bytes=32 time=2.1 ms TTL=56
2023/01/05 08:58:42.121 : Reply[74101] from 1.1.1.1: bytes=32 time=1.3 ms TTL=56
2023/01/05 08:58:43.123 : Reply[74102] from 1.1.1.1: bytes=32 time=1.7 ms TTL=56
2023/01/05 08:58:44.124 : Reply[74103] from 1.1.1.1: bytes=32 time=1.4 ms TTL=56
2023/01/05 08:58:45.127 : Reply[74104] from 1.1.1.1: bytes=32 time=1.5 ms TTL=56
2023/01/05 08:58:46.128 : Reply[74105] from 1.1.1.1: bytes=32 time=1.2 ms TTL=56
2023/01/05 08:58:47.130 : Reply[74106] from 1.1.1.1: bytes=32 time=1.5 ms TTL=56
2023/01/05 08:58:48.133 : Reply[74107] from 1.1.1.1: bytes=32 time=2.0 ms TTL=56
2023/01/05 08:58:49.141 : Reply[74108] from 1.1.1.1: bytes=32 time=8.0 ms TTL=56
2023/01/05 08:58:50.143 : Reply[74109] from 1.1.1.1: bytes=32 time=1.4 ms TTL=56
2023/01/05 08:58:51.144 : Reply[74110] from 1.1.1.1: bytes=32 time=1.3 ms TTL=56
2023/01/05 08:58:52.146 : Reply[74111] from 1.1.1.1: bytes=32 time=1.2 ms TTL=56
2023/01/05 08:58:53.149 : Reply[74112] from 1.1.1.1: bytes=32 time=2.1 ms TTL=56

indicating no problems at all.

I would like to trust the zabbix monitoring - but I cannot figure out, where the issue is. I was thinking that it might be because the agent is not able to deliver its collection in certain time periods, but I have change the buffersend and buffersize as in my prior post. Any other clues?

Regards, Lars.

[Markku]

You could increase the logging level in the agent to see what it is doing.

You could capture and analyze the agent traffic, see this blog post: https://majornetwork.net/2022/10/zab...oregistration/

Capturing and analyzing traffic also on that agent host you can see how it really pings CloudFlare.

How is your item configured?

Markku

[lbon]

How is your item configured?

Markku

Like this:

[Markku]

You are using 5s interval which is quite unusual for Zabbix items.

How is your agent configured?

Anyway, I already suggested you how to investigate the agent so there is that.

Markku

[lbon]

How is your agent configured?

Anyway, I already suggested you how to investigate the agent so there is that.

Markku

Yeah, thanks.. I will look in to the package capture thing later.

agent conf:


### Option: LogFile
# Log file name for LogType 'file' parameter.
#
# Mandatory: no
# Default:
# LogFile=

LogFile=c:\zabbix\logs\zabbix_agentd.log

### Option: LogFileSize
# Maximum size of log file in MB.
# 0 - disable automatic log rotation.
#
# Mandatory: no
# Range: 0-1024
# Default:
# LogFileSize=1

### Option: DebugLevel
# Specifies debug level:
# 0 - basic information about starting and stopping of Zabbix processes
# 1 - critical information
# 2 - error information
# 3 - warnings
# 4 - for debugging (produces lots of information)
# 5 - extended debugging (produces even more information)
#
# Mandatory: no
# Range: 0-5
# Default:
# DebugLevel=3

### Option: SourceIP
# Source IP address for outgoing connections.
#
# Mandatory: no
# Default:
#SourceIP=

### Option: EnableRemoteCommands
# Whether remote commands from Zabbix server are allowed.
# 0 - not allowed
# 1 - allowed
#
# Mandatory: no
# Default:
EnableRemoteCommands=1

### Option: LogRemoteCommands
# Enable logging of executed shell commands as warnings.
# 0 - disabled
# 1 - enabled
#
# Mandatory: no
# Default:
LogRemoteCommands=1

##### Passive checks related

### Option: Server
# List of comma delimited IP addresses, optionally in CIDR notation, or hostnames of Zabbix servers.
# Incoming connections will be accepted only from the hosts listed here.
# If IPv6 support is enabled then '127.0.0.1', '::127.0.0.1', '::ffff:127.0.0.1' are treated equally and '::/0' will allow any IPv4 or IPv6 address.
# '0.0.0.0/0' can be used to allow any IPv4 address.
# Example: Server=127.0.0.1,192.168.1.0/24,::1,2001:db8::/32,zabbix.domain
#
# Mandatory: no
# Default:
# Server=

Server=zabbixproxy.xxx.dk

### Option: ListenPort
# Agent will listen on this port for connections from the server.
#
# Mandatory: no
# Range: 1024-32767
# Default:
# ListenPort=10050

### Option: ListenIP
# List of comma delimited IP addresses that the agent should listen on.
# First IP address is sent to Zabbix server if connecting to it to retrieve list of active checks.
#
# Mandatory: no
# Default:
#ListenIP=

### Option: StartAgents
# Number of pre-forked instances of zabbix_agentd that process passive checks.
# If set to 0, disables passive checks and the agent will not listen on any TCP port.
#
# Mandatory: no
# Range: 0-100
# Default:
# StartAgents=3

##### Active checks related

### Option: ServerActive
# List of comma delimited IPort (or hostnameort) pairs of Zabbix servers for active checks.
# If port is not specified, default port is used.
# IPv6 addresses must be enclosed in square brackets if port for that host is specified.
# If port is not specified, square brackets for IPv6 addresses are optional.
# If this parameter is not specified, active checks are disabled.
# Example: ServerActive=127.0.0.1:20051,zabbix.domain,[::1]:30051,::1,[12fc::1]
#
# Mandatory: no
# Default:
# ServerActive=

ServerActive=10.45.30.73

### Option: Hostname
# Unique, case sensitive hostname.
# Required for active checks and must match hostname as configured on the server.
# Value is acquired from HostnameItem if undefined.
#
# Mandatory: no
# Default:
# Hostname=

#Hostname=Windows host

### Option: HostnameItem
# Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
# Does not support UserParameters or aliases.
#
# Mandatory: no
# Default:
#HostnameItem=system.hostname

### Option: HostMetadata
# Optional parameter that defines host metadata.
# Host metadata is used at host auto-registration process.
# An agent will issue an error and not start if the value is over limit of 255 characters.
# If not defined, value will be acquired from HostMetadataItem.
#
# Mandatory: no
# Range: 0-255 characters
# Default:
HostMetadata=prod,windows

### Option: BufferSend
# Do not keep data longer than N seconds in buffer.
#
# Mandatory: no
# Range: 1-3600
# Default:
# BufferSend=5

BufferSend=5

### Option: BufferSize
# Maximum number of values in a memory buffer. The agent will send
# all collected data to Zabbix server or Proxy if the buffer is full.
#
# Mandatory: no
# Range: 2-65535
# Default:
# BufferSize=100

BufferSize=60000



### Option: Timeout
# Spend no more than Timeout seconds on processing.
#
# Mandatory: no
# Range: 1-30
# Default:
Timeout=20


# Include=c:\zabbix\zabbix_agentd.userparams.conf
# Include=c:\zabbix\zabbix_agentd.conf.d\
#Include=c:\zabbix\zabbix_agentd.conf.d\*.conf
Include=c:\zabbix\zabbix_agentd\*.conf

####### USER-DEFINED MONITORED PARAMETERS #######

### Option: UnsafeUserParameters
# Allow all characters to be passed in arguments to user-defined parameters.
# The following characters are not allowed:
# \ ' " ` * ? [ ] { } ~ $ ! & ; ( ) < > | # @
# Additionally, newline characters are not allowed.
# 0 - do not allow
# 1 - allow
#
# Mandatory: no
# Range: 0-1
# Default:
UnsafeUserParameters=1

[cyber]

fping 1.1.1.1 -n 1 -i -l

Are the fping parameters for windows different from linux? These don't make sense to me... "-n 1"? I think linux does not even have a value for that switch... it just tells to resolve names... and "-l" .. loop indefinitely? and "-i" would require parameter value... and after all that address after options...:P not as here...

But as Markku said... 5sec interval is unusual for Zabbix, it may as well not be finished with previous run...

[lbon]

Are the fping parameters for windows different from linux? These don't make sense to me... "-n 1"? I think linux does not even have a value for that switch... it just tells to resolve names... and "-l" .. loop indefinitely? and "-i" would require parameter value... and after all that address after options...:P not as here...

But as Markku said... 5sec interval is unusual for Zabbix, it may as well not be finished with previous run...

-n 1
is number of pings (here only one)

-l
limits the output

I would guess it is the same on linux.

c:\drift\fping 1.1.1.1 -n 1 -i -l | "C:\Program Files (x86)\GnuWin32\bin\gawk.exe" "{print substr($5,6); }"
returns:
1.1
instantly which is what I need.

c:\drift\fping 1.1.1.1 -n 1 -i -l
returns:
Reply[1] from 1.1.1.1: bytes=32 time=1.1 ms TTL=55
and nothing more

The pipe takes the value from time= and returns only this

[cyber]

man fping

-i, --interval=MSEC
The minimum amount of time (in milliseconds) between sending a ping packet to any target (default is 10, minimum is 1).
-n, --name
If targets are specified as IP addresses, do a reverse-DNS lookup on them to
-l, --loop
Loop sending packets to each target indefinitely. Can be interrupted with Ctrl-C; statistics about responses for each target are then displayed.

So differences are significant...

But again.. try to ping not so often and see, what comes out of it..