In <4CC17F18.7040309 at shihad.org> Iain M Conochie <iain at shihad.org> writes:
Good afternoon xymoners.
Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 10MB to try to avoid these error messages?
Latest errormessages: Data flooding from X.X.X.X, closing connection
Running out of memory on your Xymon server would be one of the concerns, since all of the status messages that Xymon receives are stored in memory.
Also, the MAX_....BUFZ parameters wouldn't be enough when you go above 10 MB. You would have to change this line in hobbitd.c:
#define MAX_HOBBIT_INBUFSZ (10*1024*1024) /* 10 MB */
which is really what triggers the "Data flooding..." message.
Also, do consider that these boxes are transferring 10 MB+ data every 5 minutes to your Xymon server. I know we have gigabit Ethernet etc, but that's 350 kbit/sec for each of those boxes.
These are windows boxes and most likely there is something wrong with the client but we are seeing this very consistently.
I've seen this lately, triggered by huge Windows event-logs. On Windows-systems, that's probably the only piece of data that can get so huge.
If you know which hosts are causing this - look at the IP's - then I would recommend that the first action should be to look at why there are so many log-entries in the eventlog. And since eventlog-scanning can load a system rather heavily, you may want to consider turning off eventlog monitoring completely. Or at least for the particular log that generates so much data.
Regards, Henrik