Xymon Mailing List Archive search

hobbitping latency reporting with multiple hosts

list Nick Nauwelaerts
Thu, 26 Feb 2009 11:39:50 +0100
Message-Id: <user-daec5c788b74@xymon.invalid>

-----Original Message-----
From: Henrik Størner [mailto:user-ce4a2c883f75@xymon.invalid] 
Sent: Thursday, February 26, 2009 11:22
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] hobbitping latency reporting with multiple hosts

On Wed, Feb 25, 2009 at 10:29:40AM +0100, 
user-18dd505c6204@xymon.invalid wrote:
We are having some discrepancies with the latencies xymon reports in
it's conn tests as opposed to what we were seeing in other 
monitoring
programs. What we're seeing is that xymon reports a much 
higher latency
for certain hosts than what we're used to. We are using 
hobbitping from
xymon 4.2.2 on x64, novell suse linux enterprise server 10 sp2.

We think we've tracked it down to the following:

We are testing with 3 hosts:
194.109.6.92 - www.xs4all.nl
195.130.131.39 - www.telenet.be
212.27.48.10 - www.free.fr
hobbitping in the current version isn't really designed to do very
accurate RTT measurements - it's primary purpose is to see if the
server is responding at all, not how fast it responds.

What happens is that hobbitping is extremely sensitive to delays
induced by ARP lookups and brief spikes in e.g. the load on a
network switch or router passing the ping packets. That is because
hobbitping will only ping each host once (if the host responds
to the first ping within the timeout period), and the first ping
will often vary a lot more in RTT than subsequent ones.

So I'd recommend using fping if you want some more accurate RTT
measurements.

There is a new ping daemon in the works for a later Xymon release,
and indications are that it performs much better in this respect.
Even using hobbitping with the same host trice guives these strange results, so the arp entries over most of the link chain should already be cached. That being said, for the time being we'll migrate to fping because we do look at the RTT variations.

thx

// nick