Subject: Re: Too agressive - Multiple instances running???

From: Jeff Weisberg <[email-masked]>
Date: Fri, 15 Feb 2008 14:21:33 -0500 (EST)

| I copied the exact same config from a backup just prior to the crash so I
| know my config is good.  Basically what I am seeing is Argus appears to be
| hitting the same items multiple times (3 right now) and sometimes that
| number seems to go as high as 5 during the same testing cycle.  Another
| issue is if something does go down, I seem to get many duplicate
| notifications.  Argus is being started with the default rc.argusd from
| rc3.d.

| root      5292  0.0  0.7 162376 16032 ?        Ss   Feb05   0:00 Argus
| root     13479  0.7  1.2 174008 26692 ?        S    Feb05  92:40 Argus
| root     21116  0.7  1.2 174012 26064 ?        S    Feb11  31:07 Argus
| root     21118  0.7  1.2 173996 26044 ?        S    Feb11  30:51 Argus

you don't remember whether anything interesting happened on Feb11?

what are the parent-process-ids of the Feb11 processes?
5292? 13479? other?

try:

shut down argus.
verify with ps that the extra processes are gone. (kill until dead).
make sure syslog is enabled in your config.
restart argus.

how long until these extra processes appear?
is there anything in syslog around the time this happens?

---

From: "Scott Hiemstra" <[email-masked]>
Date: Fri, 15 Feb 2008 15:36:23 -0500

> you don't remember whether anything interesting happened on Feb11?

On Feb 11, qmail-smtpd stopped responding for about 10 minutes, nothing else
strange happening on that day.  I think I got 4 or 5 pages regarding that
incident which seemed high at the time considering it was only 10 minutes.
That was the only outage and there were no edits to the config or restarts
on that day.  No patches were applied to the monitoring server, no one even
logged onto it.

> what are the parent-process-ids of the Feb11 processes?

I actually killed off all the processes last night so I can't tell anymore.
Doh!

> make sure syslog is enabled in your config.

Done, I don't know how I missed the syslog directive.  Very Nice.

> is there anything in syslog around the time this happens?

I will let you know if it happens again and provide a full syslog.

As always, thank you sir for a great piece of software,
Scott