Good afternoon xymoners.
Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 10MB to try to avoid these error messages?
Latest errormessages: Data flooding from X.X.X.X, closing connection
These are windows boxes and most likely there is something wrong with the client but we are seeing this very consistently.
Regards Iain Conochie NetBenefit
In <4CC17F18.7040309 at shihad.org> Iain M Conochie <iain at shihad.org> writes:
Good afternoon xymoners.
Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 10MB to try to avoid these error messages?
Latest errormessages: Data flooding from X.X.X.X, closing connection
Running out of memory on your Xymon server would be one of the concerns, since all of the status messages that Xymon receives are stored in memory.
Also, the MAX_....BUFZ parameters wouldn't be enough when you go above 10 MB. You would have to change this line in hobbitd.c:
#define MAX_HOBBIT_INBUFSZ (10*1024*1024) /* 10 MB */
which is really what triggers the "Data flooding..." message.
Also, do consider that these boxes are transferring 10 MB+ data every 5 minutes to your Xymon server. I know we have gigabit Ethernet etc, but that's 350 kbit/sec for each of those boxes.
These are windows boxes and most likely there is something wrong with the client but we are seeing this very consistently.
I've seen this lately, triggered by huge Windows event-logs. On Windows-systems, that's probably the only piece of data that can get so huge.
If you know which hosts are causing this - look at the IP's - then I would recommend that the first action should be to look at why there are so many log-entries in the eventlog. And since eventlog-scanning can load a system rather heavily, you may want to consider turning off eventlog monitoring completely. Or at least for the particular log that generates so much data.
Regards, Henrik
Henrik Størner wrote:
In <4CC17F18.7040309 at shihad.org> Iain M Conochie <iain at shihad.org> writes:
Good afternoon xymoners. Is there a large risk in increasing the MAX_HOBBIT_INBUFSZ to above 10MB to try to avoid these error messages? Latest errormessages:
Data flooding from X.X.X.X, closing connection
These are windows boxes and most likely there is something wrong with the client but we are seeing this very consistently.
I've seen this lately, triggered by huge Windows event-logs. On Windows-systems, that's probably the only piece of data that can get so huge.
If you know which hosts are causing this - look at the IP's - then I would recommend that the first action should be to look at why there are so many log-entries in the eventlog. And since eventlog-scanning can load a system rather heavily, you may want to consider turning off eventlog monitoring completely. Or at least for the particular log that generates so much data.
In my experience, this is caused by the BBWin client and as Henrik suspects from event logs. If you have Success Auditing turned on it is almost a certainty that the messages will be too big on a busy server.
My workaround for these is to disable the eventlog reporting in BBWin.cfg by commenting out the following line:
<!-- load name="msgs" value="msgs.dll"/ -->This probably breaks reporting on other (filesystem-based) log files.
I was unable to work out how to set up filtering or disabling of eventlogs any other way in BBWin centralised mode.
David.
-- David Baldwin - IT Unit Australian Sports Commission www.ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au
This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
participants (3)
-
david.baldwin＠ausport.gov.au
-
henrik＠hswn.dk
-
iain＠shihad.org