Subject: Too agressive - Multiple instances running???

From: "Scott Hiemstra" <[email-masked]>
Date: Thu, 14 Feb 2008 14:38:56 -0500

I recently had my monitoring server crash, oh what a day when the server
that monitors everything else has a raid controller failure.  The previous
system was FreeBSD 4.11 with Perl 5.6.  I now have Argus running on a Ubuntu
Linux system with Perl 5.8.8.  Not enjoying Ubuntu but it gets the job
done...

I copied the exact same config from a backup just prior to the crash so I
know my config is good.  Basically what I am seeing is Argus appears to be
hitting the same items multiple times (3 right now) and sometimes that
number seems to go as high as 5 during the same testing cycle.  Another
issue is if something does go down, I seem to get many duplicate
notifications.  Argus is being started with the default rc.argusd from
rc3.d.

Sample FTP Logs from target:
Feb 14 14:29:12 thor ftpd[80526]: connection from 192.168.2.10
(192.168.2.10)
Feb 14 14:29:12 thor ftpd[80527]: connection from 192.168.2.10
(192.168.2.10)
Feb 14 14:29:12 thor ftpd[80528]: connection from 192.168.2.10
(192.168.2.10)

Sample Web Logs from target:
192.168.2.10 - - [14/Feb/2008:14:30:22 -0500] "HEAD / HTTP/1.0" 200 0 "-"
"-"
192.168.2.10 - - [14/Feb/2008:14:30:22 -0500] "HEAD / HTTP/1.0" 200 0 "-"
"-"
192.168.2.10 - - [14/Feb/2008:14:30:22 -0500] "HEAD / HTTP/1.0" 200 0 "-"
"-"

Output of: ps auxw | grep -i perl
root     13527  0.0 17.1 457532 354408 ?       S    Feb05   9:37
/usr/bin/perl /usr/local/lib/argus/graphd

Output of: ps auxw | grep -i argus
root      5292  0.0  0.7 162376 16032 ?        Ss   Feb05   0:00 Argus
root     13479  0.7  1.2 174008 26692 ?        S    Feb05  92:40 Argus
root     13527  0.0 17.1 457532 354432 ?       S    Feb05   9:37
/usr/bin/perl /usr/local/lib/argus/graphd
root     21116  0.7  1.2 174012 26064 ?        S    Feb11  31:07 Argus
root     21118  0.7  1.2 173996 26044 ?        S    Feb11  30:51 Argus
root     27358  4.0  0.0      0     0 ?        Z    14:31   0:00 [argusd]
<defunct>

Output of: argusctl status
ARGUS/2.0 200 OK
status:    running
version:   3.5
perlver:   5.8.8
osinfo:    Linux 2.6.23.9-85.fc8 x86_64
darpmode:  disabled
objects:   245
services:  141
notifies:  2
uptime:    9d 3:26:47
idle:      98.42% 99.14% 99.09%
monrate:   2.27 2.26 2.27 per second

Any thoughts would be appreciated, if more info is needed just ask,
Scott

---

From: Jeremy Kister <[email-masked]>
Date: Thu, 14 Feb 2008 15:01:20 -0500

> Any thoughts would be appreciated, if more info is needed just ask,

does a single 'argusctl stop' stop all of argus from running ?

-- 

Jeremy Kister
http://jeremy.kister.net./

---

From: "Scott Hiemstra" <[email-masked]>
Date: Thu, 14 Feb 2008 15:58:04 -0500

Please excuse a duplicate if you get one, I believe I sent a reply from the
wrong address...

> does a single 'argusctl stop' stop all of argus from running ?

Never and if I go in and kill off the abandoned children, the same thing
will happen again upon restart.

Scott

> -----Original Message-----
> From: [email-masked] [mailto:arguslist-
> [email-masked]] On Behalf Of Jeremy Kister
> Sent: Thursday, February 14, 2008 3:01 PM
> To: Discussion about Argus
> Subject: Re: Too agressive - Multiple instances running???
> 
> _______________________________________________
> http://argus.tcp4me.com/
> [email-masked]
> http://www.tcp4me.com/mailman/listinfo/arguslist