False ICMP check success
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
False ICMP check success - 28.Jun.2005 6:39:00 AM
|
|
|
mmarriot
Posts: 4
Joined: 4.May2005
Status: offline
|
I have about 40 ICMP checks every two minutes on NSM 6 build 20050513. I noticed when I powered down a system that was being monitored I recieved a failure alert but then a few minutes later get a success alert even though the system is still off and nothing else is using that IP address. I tested this some more by setting up a check for an IP address that was not assigned to anything and I get the same result - a failure at first as expected but then a few minutes later a success. I then continued to get a success for quite a while. Will this bug be addressed soon?
|
|
|
|
RE: False ICMP check success - 28.Jun.2005 11:07:00 PM
|
|
|
mps_surcouf
Posts: 67
Joined: 5.Oct.2004
Status: offline
|
I have exactly same bug with NSM 5.5
I think this is a long standing issue
Sorry I have no solution. I think that can only come from GFI.
I think some people have written vbscript to run standard windows ping to get round the problem.
Regards
Mike
|
|
|
|
RE: False ICMP check success - 30.Jun.2005 4:43:00 AM
|
|
|
mmarriot
Posts: 4
Joined: 4.May2005
Status: offline
|
I hope someone from GFI will reply to this thread and provide the status of a fix for this problem. This is a core function of the program and the fact it doesn't work properly should be addressed.
|
|
|
|
|
RE: False ICMP check success - 1.Jul.2005 2:43:00 AM
|
|
|
Calin Ghibu
Posts: 1194
Joined: 15.Dec.2002
Status: offline
|
Hi, a similar issue should have been already fixed in the last build which you seem to have.
It is very strange. Can you please describe the network setup a bit? Are the NSM computer and the pinged device on same network segment? What route does the ping request have? Do you use DHCP?
Best regards,
Calin
|
|
|
|
|
RE: False ICMP check success - 1.Jul.2005 4:31:00 AM
|
|
|
mmarriot
Posts: 4
Joined: 4.May2005
Status: offline
|
The NSM server and most of the monitored systems are all on the same switch so there are no routers between them. We do have a DHCP server but all of our servers are assigned static addresses. I have NSM pinging the IP address, not the host name, so there aren't any name resolution issues. I can ping the IP address from the Windows command prompt and get no response at the same time NSM activity monitor shows the ICMP check was succuessful on the same IP address.
It appears we might also have the issue described in other threads where email notification fails although I haven't been able to reproduce that yet. When our one server went down last week I never received an email alert and then when I was told it was down and checked my NSM status monitor it showed it was up. Since we purchased NSM to monitor our servers it is frustrating when it doesn't work as it should. Thank you for your interest.
|
|
|
|
|
RE: False ICMP check success - 3.Jul.2005 4:28:00 PM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
Hi Calin,
Please define "latest build." When we moved from 5.5 to the original build of v6, the problem seemed to disappear. When something went down, NSM reported it immediately. When we went to the 5/13 build for one of the things it fixed, the ICMP problem came back.
Honestly, I'm about ready to send you folks a video of NSM showing the system is up, the "Monitor now" showing it's up and ping from the command line of the NSM box showing it's down because I don't think your engineers really believe there is a problem.
This is not that difficult. Either a response came back from the target IP address or it didn't.
I have systems that are NEVER faster than 40ms because they are several router hops and a thousand miles away. Yet when NSM shows the system is up even though it's down, NSM reports the response as less than 10ms. I don't know how the ICMP checks work, but it sure sounds like it's confusing someone else's ICMP response with the one it's really looking for.
This is only an example. We, too, have systems on the same gigabit switch as the NSM box that go down and NSM keeps happily reporting they are up. Same subnet, same switch, about six inches away in the same rack.
Ray
|
|
|
|
|
RE: False ICMP check success - 3.Jul.2005 9:27:00 PM
|
|
|
Calin Ghibu
Posts: 1194
Joined: 15.Dec.2002
Status: offline
|
Hi,
We are working hard to reproduce in the test labs. Without reproduction locally it is very difficult to debug.
This is a top priority task for the test labs who are trying hard to reproduce.
Will keep you posted,
Best regards,
Calin
[ July 04, 2005, 04:16 AM: Message edited by: Calin Ghibu ]
|
|
|
|
|
RE: False ICMP check success - 5.Jul.2005 2:44:00 AM
|
|
|
Calin Ghibu
Posts: 1194
Joined: 15.Dec.2002
Status: offline
|
Hi,
Email not being sent and ICMP checks not working as expected, are two separate issues. The issue with email stopped being sent, was reproduced here and it occurs mainly in the situation where the mailserver runs ok, goes down and is restarted. Even if the mail server is restarted and running ok, emails were not sent in some situations. This will be fixed soon.
However, the issue with ICMP false positives was not reproduced.
Please , if any of you is able to send me some debuglogs regarding this situaiton follow the below procedure:
1. enable deubg HKLM\Software\GFI\NSM6\Config set values Debug and DebugLevel to 1
2. restart NSM modules (mainly the engine)
3. wait for the icmp issue to reproduce
4. zip and send me at calin@gfitemasoft.com the contents of the debuglogs folder in the NSM home folder, mentioning if possible the time when the ICMP false positives arrived.
Best regards,
Calin
|
|
|
|
|
RE: False ICMP check success - 5.Jul.2005 2:29:00 PM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
So it would be OK to create a new rule executing every two minutes to ping a known unused IP address?
I'll see if I can do it tomorrow, although I suspect that the ICMP rules don't execute every two minutes.
Will a "monitor now" failing (or not failing) work also?
One odd thing I noticed happened when we had an entire site go down due to a power failure. I have a folder set up with all of the edge routers and another folder for each site. I set a dependency for the site folder on the edge router.
When the site went down, even the router, the router showed as up and less than 10ms even though it's one of those far-away sites.
Ray
Ray
|
|
|
|
|
RE: False ICMP check success - 5.Jul.2005 8:58:00 PM
|
|
|
Calin Ghibu
Posts: 1194
Joined: 15.Dec.2002
Status: offline
|
Hi Ray,
Any situation, even monitor now will do.
Thanks and regards,
Calin
|
|
|
|
|
RE: False ICMP check success - 6.Jul.2005 2:55:00 PM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
Check your Inbox!
|
|
|
|
|
RE: False ICMP check success - 8.Jul.2005 6:33:00 AM
|
|
|
mmarriot
Posts: 4
Joined: 4.May2005
Status: offline
|
I started the NSM engine service and after 10 minutes NSM was reporting that my ICMP check for the IP that is not in use was successful. Based on Ray's observation about response times I looked at my checks for remote routers and sure enough they were all showing less than 10ms after 10 minues - when I started the engine they were all over 100ms. I then stopped the engine and enabled debugging as Calin instrusted. Upon starting the engine again my ICMP check for the IP that is not in use continued to report success. The remote router checks also still showed responses of less than 10ms. After about 10 minutes I noticed that the remote router response times were back to over 100ms and my ICMP check on the IP not is use starting reporting a failure again. Calin - I have sent you the debug files. Please let me know what can be done to address this. At this point I have little confidence in the product.
|
|
|
|
|
RE: False ICMP check success - 8.Jul.2005 9:49:00 AM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
They have my files as well as some packet captures of the traffic and are looking at them both. I'm confident they will get it figured out shortly. I've been using their products for years and their support and response has always been great. Unfortunately, it's tough to fix something that you can't duplicate, so hopefully the files we both sent them can narrow it down faster.
Ray
|
|
|
|
|
RE: False ICMP check success - 13.Sep.2005 1:12:00 PM
|
|
|
KindredS
Posts: 4
Joined: 12.Sep.2005
From: Utah
Status: offline
|
Any status on this bug??? It's driving us nutz.
|
|
|
|
|
RE: False ICMP check success - 13.Sep.2005 1:12:00 PM
|
|
|
KindredS
Posts: 4
Joined: 12.Sep.2005
From: Utah
Status: offline
|
Any status on this bug??? It's driving us nutz.
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
