MAXMSG_STATUS and MAXMSG_CLICHG - Long email 🔗 link

Hi folks. I've been trying to validate that my analysis.cfg and alerts.cfg settings are set up right to get good info for certain ports and services (SQL Ports, and SQL services on windows machines).

While tweaking things I noticed my messages may have been truncated, which I believe leads to invalidate status and emails (now using html_mail.pl)
I changed the values in xymonserver.cfg as shown below:
MAXLINE="32768"
MAXMSG_STATUS="384"
MAXMSG_CLIENT="1024"
MAXMSG_DATA="1024"

Are there going to be problems on the xymon server with me making these values larger?  Should I add a MAXMSG_CLICHG setting to fix the "Oversize clichg" truncation?

Here is a snip from the xymond.log file showing truncated msgs…

012-04-26 13:58:35 Oversize clichg msg from xymond for SERVERNAME truncated (n=3985606, limit=524288)
2012-04-26 13:58:35 Oversize clichg msg from xymond for SERVERNAME truncated (n=3985606, limit=524288)
2012-04-26 16:01:41 Oversize data/client msg from xxx.xx.xx.xx truncated (n=4471230, limit 1048576)
2012-04-26 16:06:48 Oversize data/client msg from xxx.xx.xx.xx truncated (n=4471517, limit 1048576)

Should I be doing something else for the analysis.cfg to watch SQL ports and services?

I'm sending another email with the analysis.cfg and alerts.cfg settings to keep this from being too long.

Any thoughts appreciated.

Thanks

Don K

*snip*

Any thoughts appreciated.

Thanks

Don K

I've been running at:

 MAXMSG_STATUS=4096
 MAXMSG_CLIENT=5120
 MAXMSG_DATA=4096
 MAXMSG_NOTES=4096

... for years now, mainly due to some legacy installs that sent high-res
sar data in client messages and some bulky xml in http content checks.

I haven't noticed any problems outside of the increased memory usage.

IIRC, unless you set it manually MAXMSG_CLICHG will take the value of
MAXMSG_CLIENT


HTH,

-jc