-----Original Message----- From: Henrik Størner [mailto:henrik at hswn.dk] Sent: Thursday, February 26, 2009 11:22 To: hobbit at hswn.dk Subject: Re: [hobbit] hobbitping latency reporting with multiple hosts
On Wed, Feb 25, 2009 at 10:29:40AM +0100, nick.nauwelaerts at thomsonreuters.com wrote:
We are having some discrepancies with the latencies xymon reports in it's conn tests as opposed to what we were seeing in other monitoring programs. What we're seeing is that xymon reports a much higher latency for certain hosts than what we're used to. We are using hobbitping from xymon 4.2.2 on x64, novell suse linux enterprise server 10 sp2.
We think we've tracked it down to the following:
We are testing with 3 hosts: 194.109.6.92 - www.xs4all.nl 195.130.131.39 - www.telenet.be 212.27.48.10 - www.free.fr
hobbitping in the current version isn't really designed to do very accurate RTT measurements - it's primary purpose is to see if the server is responding at all, not how fast it responds.
What happens is that hobbitping is extremely sensitive to delays induced by ARP lookups and brief spikes in e.g. the load on a network switch or router passing the ping packets. That is because hobbitping will only ping each host once (if the host responds to the first ping within the timeout period), and the first ping will often vary a lot more in RTT than subsequent ones.
So I'd recommend using fping if you want some more accurate RTT measurements.
There is a new ping daemon in the works for a later Xymon release, and indications are that it performs much better in this respect.
Even using hobbitping with the same host trice guives these strange results, so the arp entries over most of the link chain should already be cached. That being said, for the time being we'll migrate to fping because we do look at the RTT variations.
thx
// nick