getting packet loss with check_icmp

[Thomas Guyot-Sionnest]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/02/08 10:14 PM, Dwyer, Simon wrote:
> Hey everyone,
> 
>  
> 
> I have been running a nagios server for a while.  We made some large
> changes ot our layout which broke the parenting of config which I just
> got around to fixing.  The problem I am having is that I am getting
> check_icmp fails for a few switches every few minutes.  They are
> pingable throughout the whole time with ping command.
> 
>  
> 
> Anyone seen this before?

If you set check_icmp to send multiple packets it can sends them pretty
fast; are you sure your switches won't start rejecting some icmp packets
under load? Also is the timeout large enough to get the replies?

The only way to confirm it's check_icmp is to run a packet capture while
you reproduce the problem manually (running check_icmp from the command
line) and show that there were as many replies than sent packets. Be
sure that:

1. check_icmp is the only thing pinging the target (to make the capture
easier to read). If running from your Nagios box disabling active host
checks for that switch should be enough.

2. You note the times at which you run each check_icmp (to match them
against the capture). you can for example run:
$ date && <check_icmp_command>

3. Wait a few seconds between each time you run check_icmp to make each
run clearly identifiable in the dump.

Either use wireshatk with the following filter: "icmp and host <host>"
Or the following command (then you can transfer <dump> wherever you want
and open it in Wireshark):
# tcpdump -s 1500 -w <dump> icmp and host <host>
(if you need to specify an interface for tcpdump use -i. Ex: "-i eth0"
_before_ the filtering expression).

Thomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHppFQ6dZ+Kt5BchYRAiyAAJsG8JrPrL2F79TRnCqh+SMucGEh/QCggp1V
1RvLDaFx/mWJMxPmc/u+KR8=
=8A5C
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null