Hiya
I have some FreeBSD systems that run IPv6, and the numbers that Xymon are graphing are not quite right. I think I've pinned down the cause as being the ifstat matching regexp, not being able to handle either multiple bound IP addresses, or IPv6 addresses. My system has output from "netstat -i -b -n" something like this:
Name Mtu Network Address Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll em0 1500 <Link#1> aa:bb:cc:dd:ee:ff 855109239 246 119882177806 4445784528 0 1678631985244 0 em0 1500 fe80:1::666:6 fe80:1::666:66ff: 5652 - 403008 8487 - 565928 - em0 1500 192.168.1.0 192.168.1.66 3669836 - 327402522 4441615751 - 1612495913591 - em0 1500 6006:6000:0:6 6006:6000:0:6006: 186828 - 13051632 33119395 - 3319372758 - <snipped> lo0 16384 <Link#3> 2420387 0 296603593 2420667 0 296585785 0 lo0 16384 ::1/128 ::1 193448 - 17014491 217323 - 22687570 - lo0 16384 fe80:6::1/64 fe80:6::1 0 - 0 0 - 0 - lo0 16384 127.0.0.0/8 127.0.0.1 2227042 - 279599853 2226396 - 279550576 - lo1 16384 <Link#4> 398523 0 55461313 398523 0 55461150 0 lo1 16384 192.168.2.0 192.168.2.66 317552009 - 63772241684 383671 - 50695917 - lo1 16384 6006:6000:600 6006:6000:600::66 29688469 - 10867392950 4 - 2982 - <snipped>
The Xymon client explicitly excludes the "link" lines, and all of the "lo" lines. Makes sense, except that it doesn't work for me.
It seems that the Xymon server-side parsing is only picking up the line with the IPv4 address (192.168.1.66) and ignores all the others for the interface. Also, I can't see where Xymon handles multiple lines for the same interface, and I don't think it does.
And finally, this server has loopback interfaces lo1, lo2 and so on, with alternative IP addresses for this server. Most of the traffic that arrives at this server is addressed to the loopback interfaces. So even if Xymon could parse these lines, multiple of them, the client script excludes all of the loopback interfaces.
What's the best way to solve this? The lo[1-n] NICs could be added back in. But I don't know that this is very useful. The intent of the [ifstat] data is to record and display bytes that come in and out of physical NICs that communicate with the outside world, but my extra loopback interfaces' traffic isn't being counted.
For this reason, it seems to make sense that the "link" lines are probably the best for this, as I would think that they would show packets contained only in physical frames (ethernet or some other medium). However, I think the "link" lines also show things like ARP and other layer-2 traffic that might not be as useful.
Has anyone else looked into this, or done monitoring of FreeBSD interfaces? Is there a better command to run on FreeBSD for this? I'd really like to get this fixed up.
Cheers Jeremy