On Fri, 18 Aug 2023 at 04:27, J.C. Cleaver <cleaver at terabithia.org> wrote:
On Mon, August 14, 2023 21:10, Berry van Sleeuwen wrote:
We recently migrated our server to SLES15 SP4 and found there are a few network tools missing in the base, arp, netstat, ifconfig and route are supposed to be replaced by "ip" and "ss" command. While similar the output of these commands differs from the traditional tools so I guess that would interfere with the processing of the command output. For now it's solved by installing net-tools-deprecated but this might not be available in future versions so we might need support for these commands. I don't now if that is also the direction for other distributions, but it's at least the case for Suse and OpenSuse.
Agreed; it's similar in the RHEL side. xymond_client updates that can interpret the output of ip and ss are probably called for now. While deprecated net-tools will stick around for sure for current systems, it's only a matter of time until they're removed, and in the meantime it's one less package to have to pull in for compatibility (and to explain).
This probably goes higher on the list.
Two brief comments about this.
To me, xymond_client always seemed to be a good candidate for making it a bit more modular. The code is written in a modular way, to make it fairly easy to add new ways of collecting the same metrics from different OSes and OS versions (which would presumably make it possible for even me to add support for "ip" and "ss", albeit with bloated code and buffer overruns). But I thought it would be neat to be able to plug in some kind of run-time process to handle new scenarios - bit it a dynamic library, or a shared memory protocol or a worker module launched by xymond_channel or similar and written in whatever language was available and familiar to the sysadmin at the time.
The emergence of "sar" as a universally available system metric reporting tool seems to solve this problem in a different way. If xymond_client had a "sar" module, it could pretty much support any popular modern OS apart from Windows (so Linux, Solaris, MacOS/*BSD, HPUX, even IRIX). While sar provides only a subset of the info obtained from the client script (so it couldn't replace ss/netstat or ip/ifconfig) it would reduce the overhead of having to support a range of different tools for plenty of metrics. It would probably standardise the output of metrics so that the parsing cond in xymond_client can be much simpler, easier to write and maintain, and less likely to have bugs. Generally speaking, parsing is something that can be difficult to do safely; programs that parse files and data streams are notoriously common targets for hackers.
Any further work on Xymon needs to ensure that it works with up-to-date OSes, and anything that can be done to make that easier is likely to help the cause.
J