Adding a host 🔗 link

I am trying to monitor my home firewall. I ran a sniff on the hobbit
server, and saw traffic, so I do not believe it is being blocked. But
the CPU, MEM, etc tests never show up. In bb-hosts on the server, I
listed the server with its FQDN. Am I missing something ?  I tried FQDN
and Hostname..

On Mon, Aug 08, 2005 at 03:18:58PM -0400, Aiello, Steve (Corporate, consultant) wrote:

The Hobbit client uses the hostname obtained from "uname -n" as the
hostname it reports for the cpu, memory etc. tests. If that's not
identical to what you have in the bb-hosts file, add a "CLIENT:hostname"
tag on the entry in your bb-hosts file.


Henrik

On Mon, 2005-08-08 at 15:18 -0400, Aiello, Steve (Corporate, consultant)
wrote:

I am trying to monitor my home firewall.

What flavor?  I use a Cisco PIX at home, and it can be monitored
primarily with snmp.

Blocked by... what?

But
the CPU, MEM, etc tests never show up. 

On the firewall?  What client is it running?

Which server?  The firewall?

Am I missing something ?

Maybe, I can't figure out what you are asking...

  I tried FQDN
and Hostname..  

FQDN, with hobbit, always.

-- 
Daniel J McDonald, CCIE # 2495, CNX, CISSP # 78281
Austin Energy

user-290ce4e24e19@xymon.invalid

Sorry I should have been more clear about my firewall. It is a linux
router/firewall. Hobbit client running locally on it.

The hobbit client running on the firewall, is not blocked by the
firewall's iptable rules.

Sorry, I should have been more clear.

I added the CLIENT tag, and I see the alias listed in info for that
host. Still not seeing the CPU, MEM, etc. What I have in my hosts file
is:

I added the CLIENT tag, and I see the alias listed in info for that

host. When I do 'uname -n' on the firewall I get the short hostname. I
am still not seeing the CPU, MEM, etc. What I have in my hosts file on
the hobbit server is:
192.168.123.1	loki.home.net		# CLIENT:loki

On Mon, Aug 08, 2005 at 04:59:35PM -0400, Aiello, Steve (Corporate, consultant) wrote:

Give it a few minutes - hobbitd only loads the bb-hosts file once
in a while and needs to pick up this change first. (You can do 
"killall -HUP hobbitd" to make it reload immediately).

Then your client needs to send in a report, which also happens
at 5 minute intervals - check the timestamp on the
~hobbit/client/tmp/msg.txt file.

Checking for connectivity: From the client machine (your firewall),
try doing "telnet <your Hobbit server IP-address> 1984" - if it
says "Connected to <ip-address>" then the connectivity is OK. If not,
then you need to check firewall rules.

And do check that your client has the right configuration - I've
made the mistake myself of having BBDISP set wrongly in the 
client config in ~hobbit/client/etc/hobbitclient.cfg ...


Regards,
Henrik

That file is being updated.

Checking for connectivity: From the client machine (your firewall), try doing "telnet <your Hobbit server IP-address> 1984" - if it says "Connected to <ip-address>" then the connectivity is OK. If not, then you need to check firewall rules.

Connection is good.

And do check that your client has the right configuration - I've made the mistake myself of having BBDISP set wrongly in the client config in ~hobbit/client/etc/hobbitclient.cfg ...

That is right too.

I even ran a network sniff on the Hobbit server, and see the firewall
talking to hobbit.

I am stumped. The firewall is a gentoo Linux system. Not sure what the
cause is.

On Mon, Aug 08, 2005 at 05:47:09PM -0400, Aiello, Steve (Corporate, consultant) wrote:

Could you send me a copy of it ? It might be some oddity in the
way it's formatted.

Anything in the /var/log/hobbit/clientdata.log file ?

Worst case, add "--trace=IP.OF.YOUR.CLIENT" to the hobbitd command
in etc/hobbitlaunch.cfg - that will cause hobbitd to dump the raw
data it receives from that IP to a file in the ~hobbit/server/tmp/
directory.


Henrik

On Mon, Aug 08, 2005 at 09:09:33PM -0400, Aiello, Steve (Corporate, consultant) wrote:

Anything in the /var/log/hobbit/clientdata.log file ?

Yes, lots of:

"Worker process died with exit code 132, terminating"

OK, should have checked that first, of course. The hobbitd module that processes the data from your client is crashing, which explains why you dont see any statuses on the web display.

"code 132" usually means it was killed by a signal 4, which is SIGILL. Looking at the data from your client I notice that:

[free]
             total       used       free     shared    buffers     cached
Mem:        239100     152428      86672          0      35020      19500
-/+ buffers/cache:      97908     141192
Swap:            0          0          0

total swap-space is 0. The client module in 4.1.1 has a bug that makes it do a divide-by-zero with those data, which could well explain this. Could you try installing the latest Hobbit snapshot on your server ? It's available from http://www.hswn.dk/beta/

That was the problem. I installed the latest snapshot, and it works
fine. After that I fixed not having swap mounted :)

Thanks for all of your help.