<html><head><title>Re: [smokeping-users] TCPping Probe not alerting</title>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-15">
</head>
<body>
<br><br>
<span style=" font-family:'Courier New'; font-size: 9pt;">1)Be sure that the RRD is actually seeing these losses from the TCP ping.<br>
[I'm fairly certain you've checked this - but if there is packet loss does the TCPPing probe accurately return, to the RRD, the actual loss.]<br>
<br>
If so, the losses are hitting the RRD file.<br>
Next step.<br>
<br>
2) Make sure your alert pattern is right.<br>
In the logs, you should see the alert get triggered.<br>
If you don't see the alert get triggered, then it's probably your pattern. [And other than pretty simple patterns, I don't grok them very well - and further it's hard to "test" them to be sure they function as you expect. So, I tended to [when I used SP for alerting] to keep them quite simple. Say, three losses of 5%+ over ten minutes. ]<br>
<br>
[I don't see anything ugly in your patterns, though the "<span style=" font-family:'calibri'; color: #1f497d;"><b>loss 3 times in a row" </b><span style=" font-family:'Courier New'; color: #000000;">isn't doing what you have in the comment. [It's, IIRC finding loss >0% for three occurrences in 24 minutes.]<br>
<br>
But I assume you're noticing that you'll get an alert for a target for fping, but not for TCPping for the same target and the same pattern, right? - That's how you're "noticing" that the TCP isn't working, right?<br>
<br>
<br>
3) If both #1 and #2 are good, then perhaps it's your "alert" system that's failing. [i.e. An alert is generated by smokeping, but the email isn't reaching you because of some odd reason.]<br>
<br>
---<br>
I can't see why TCP would make any difference in any of the above steps, vs ICMP/Fping - but perhaps there's some reason I can't think of...<br>
<br>
I'm using TCP pings on a few hosts and don't notice any substantial difference - but I'm using Nagios to generate email alerts - so the finesse of patterns, alerting in smokeping, etc are lost to me. [Nagios polls the RRD's to find losses and handles them itself.]<br>
<br>
But I think the TCP ping in my case is pushing losses appropriately into the RRD's as far as I can tell. [Though they're not always the same data [fping vs. TCPping]- I have some targets that respond to TCPing very differently than they do for fpings - thus the RRD data is different - and obviously the pattern/alert output will be different.]<br>
<br>
HTH<br>
<br>
-Greg<br>
<br>
</span></span></span><table>
<tr>
<td width=2 bgcolor= #0000ff><br>
</td>
<td width=1022><span style=" font-family:'calibri'; font-size: 11pt;">Hi <br>
<br>
I have been using smokeping fine for the last few years using the fping probe and had no issues at all.<br>
Now I’m using the TCPping Probe I’m having trouble getting SmokePing to alert when hosts are un-reachable or high packet loss.<br>
Below is some of my config and replaced sensitive information with x’s.<br>
<br>
Example from Alerts file.<br>
<br>
<span style=" font-size: 9pt;"><b>*** Alerts ***<br>
to = xxxxx@xxxxx.com, <br>
from = xxxxx@xxxxx.com<br>
<br>
<span style=" color: #1f497d;">+bigloss<br>
type = loss<br>
# in percent<br>
pattern = >0%,>0%,>0%,>0%,>0%<br>
comment = !!!!!!URGENT!!!!!!<br>
<br>
+someloss<br>
type = loss<br>
# in percent<br>
pattern = >0%,*12*,>0%,*12*,>0%<br>
comment = loss 3 times in a row<br>
<br>
+startloss<br>
type = loss<br>
# in percent<br>
pattern = ==S,>0%,>0%,>0%<br>
comment = loss at startup<br>
<br>
+rttdetect<br>
type = rtt<br>
# in milli seconds<br>
pattern = <10,<10,<10,<10,<10,<100,>100,>100,>100<br>
comment = routing messed up again ?<br>
</span></b> <br>
<span style=" font-size: 11pt;"> <br>
Example from Target file.<br>
<span style=" color: #1f497d;"> <br>
<span style=" font-size: 9pt;"><b>+ xxx-xx<br>
menu = xxx-xx<br>
title = xxxxxx.xxxxx<br>
<br>
++ xx- xx-1<br>
menu = xxx-xx-x<br>
probe = TCPPing<br>
alerts = bigloss<br>
title = TCP-Over-443-To-x.x.x.x<br>
host = x.x.x.x<br>
pings = 5<br>
port = 443<br>
:<br>
</b><span style=" font-size: 11pt; color: #000000;"> <br>
<br>
Please can someone help or guide me in what I am doing wrong, the aim is to get the alert to trigger when un-reachable or very high loss is seen.<br>
<br>
Kind Regards<br>
Chris<br>
<br>
<span style=" font-family:'courier new'; font-size: 9pt;">---------------------------------------------------------------------<br>
Research In Motion UK Limited<br>
Registered in England and Wales. Registered No. 04022422, with registered office at 200 Bath Road, Slough, Berkshire, SL1 3XE, United Kingdom<br>
<br>
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.</td>
</tr>
</table>
<br><br>
<span style=" font-family:'arial'; color: #c0c0c0;"><i>-- <br>
Gregory Sloop, Principal: Sloop Network & Computer Consulting<br>
Voice: 503.251.0452 x82<br>
EMail: </i></span><a style=" font-family:'arial';" href="mailto:gregs@sloop.net">gregs@sloop.net</a><br>
<a style=" font-family:'arial';" href="http://www.sloop.net">http://www.sloop.net</a><br>
<span style=" font-family:'arial'; color: #c0c0c0;"><i>---</body></html>