Ad Widget

Collapse

ICMPPING fails but ICMPPINGSEC works

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • EW_Kidd
    Junior Member
    • Oct 2010
    • 3

    #1

    ICMPPING fails but ICMPPINGSEC works

    I've got an interesting situation. I've got several remote firewalls that I'm monitoring. I've got two ping related items for each. The items keys are simply "icmpping" and "icmppingsec" without the [] or any additional variables.

    Where things get weird is that there are times that icmpping returns 0 while at the same time icmppingsec returns valid data.



    This is one of the sites that just shows icmpping. The above graph shows that at 8:05 am, icmpping returns 0 consistently, yet icmppingsec is returning values between 84 and 98 ms.

    My understanding is that fping is used for both items, so how can it get a 0 response (dead) while still getting a response time?

    I can also SSH into my Zabbix server and run fping manually and consistently returns X.X.X.X is alive for the above firewall.

    Some of my other hosts will show icmpping going back and forth between returning 1 (Alive) and 0 (unreachable) yet like above, icmppingsec returns consistent valid data.

    Any ideas what can be causing this and what direction I might head off to fix this?
    Last edited by EW_Kidd; 01-10-2010, 18:50. Reason: Image didn't display
  • EW_Kidd
    Junior Member
    • Oct 2010
    • 3

    #2
    Here's one of the other firewalls that is having the same issue...


    This firewall has the IP Address 192.168.0.1 and is showing down for quite a while, yet I'm getting response times.

    So I watched to see what command is being issues to fping and decided to run it on my own. The results are below.


    Zabbix:/tmp # sh -c /usr/sbin/fping -q -C3 </tmp/zabbix_server_29811.pinger
    192.168.200.187 is alive
    192.168.200.145 is alive
    192.168.200.204 is alive
    192.168.200.207 is alive
    192.168.200.186 is alive
    10.10.10.205 is alive
    10.10.10.32 is alive
    192.168.200.251 is alive
    192.168.0.1 is alive
    192.168.200.217 is alive
    192.168.200.109 is alive
    10.10.10.35 is alive
    192.168.168.200 is alive
    192.168.200.208 is alive
    10.10.10.24 is alive
    10.10.10.45 is alive
    192.168.200.250 is alive
    192.168.200.185 is alive
    10.10.10.23 is alive
    ICMP Host Unreachable from 10.10.10.40 for ICMP Echo sent to 10.10.10.16
    ICMP Host Unreachable from 10.10.10.40 for ICMP Echo sent to 10.10.10.20
    ICMP Host Unreachable from 10.10.10.40 for ICMP Echo sent to 10.10.10.16
    ICMP Host Unreachable from 10.10.10.40 for ICMP Echo sent to 10.10.10.16
    ICMP Host Unreachable from 10.10.10.40 for ICMP Echo sent to 10.10.10.20
    10.10.10.16 is unreachable
    10.10.10.20 is unreachable
    192.168.3.1 is unreachable

    As you can see 192.168.0.1 reports as being alive, yet when it makes it into Zabbix it shows a value of 0, not 1.

    Comment

    • DoubleP
      Junior Member
      • Dec 2007
      • 10

      #3
      Fping Response Time

      If "icmpping" uses Fping to check if a host is alive, what utility is used to calculate the "icmppingsec"? Maybe that is the difference.

      Comment

      • richlv
        Senior Member
        Zabbix Certified Trainer
        Zabbix Certified SpecialistZabbix Certified Professional
        • Oct 2005
        • 3112

        #4
        what are item refresh intervals for both ?
        are both using default parameters ?
        Zabbix 3.0 Network Monitoring book

        Comment

        • DoubleP
          Junior Member
          • Dec 2007
          • 10

          #5
          The polling interval is 30 seconds. Both are using default perameters. While latest data "icmpping" shows a particular host down...manual execution of fping with the host that shows down in Zabbix comes right back as "host is alive".

          Comment

          • richlv
            Senior Member
            Zabbix Certified Trainer
            Zabbix Certified SpecialistZabbix Certified Professional
            • Oct 2005
            • 3112

            #6
            no specific ideas... maybe something weird with ipv6, maybe something else. maybe you can try enabling debuglevel 4 and seeing whether anything interesting pops up when icmpping declares host as being down. make sure to increase max logfile size considerably as well.
            Zabbix 3.0 Network Monitoring book

            Comment

            • EW_Kidd
              Junior Member
              • Oct 2010
              • 3

              #7
              IPv6 is disabled at the OS level using ipv6.disable=1 in /boot/grub/menu.lst.

              Debuglevel=4 doesn't show much. I can see the command to fping, but not the responses. I didn't see anything else interesting in the log during that time. I'll let it keep running for a while though and see if anything else shows up...

              Comment

              Working...