Zenping correlation problem 4.2.3

[Michal Rusak]

Michal Rusak [http://community.zenoss.org/people/gryyzli] created the discussion

"Zenping correlation problem 4.2.3"

To view the discussion, visit: http://community.zenoss.org/message/73366#73366

--------------------------------------------------------------
Hi all,

sicne I have updated our zenoss form 3.2.1 to 4.2.3 layer3 correlation between devices doesn't work.
When remote site goes down zenoss is sending several alerts insted of one for a router.
For example:

tracepath.py Server-Bydgoszcz
Getting path from zenoss to Server-Bydgoszcz...
zenoss -> SC10 -> fw-a -> 192.168.16.4 -> Router_Bydgoszcz -> Server-Bydgoszcz

tracepath.py Router_Bydgoszcz
Getting path from zenoss to Router_Bydgoszcz...
zenoss -> SC10 -> fw-a -> 192.168.16.4 -> Router_Bydgoszcz

In 3.2.1 alert was sent for Router_Bydgoszcz only, in 4.2.3 - two alerts for Server-Bydgoszcz and Router_Bydgoszcz
Is it a bug??

Zenping configuration:
duallog False
allowduplicateclears False
zenhubpinginterval 30
ping-backend nmap
watchdog False
eventflushseconds 5.0
hubhost localhost
traceroute-interval 5
monitor localhost
hubusername admin
maxqueuelen 5000
duplicateclearinterval 0
initialHubTimeout 30
logseverity 20
maxlogsize 10240
disable-correlator False
maxbackuplogs 3
connected-ip-suppress True
maxparallel 500
logTaskStats 0
disable-event-deduplication False
eventflushchunksize 50
hubport 8789
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73366#73366]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Michal Rusak]

Michal Rusak [http://community.zenoss.org/people/gryyzli] created the discussion

"Re: Zenping correlation problem 4.2.3"

To view the discussion, visit: http://community.zenoss.org/message/73464#73464

--------------------------------------------------------------
sooooo, no one has such a problem?? or am I the only person in the world that monitor remote servers with zenoss 4.2? :)
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73464#73464]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jcurry]

jcurry [http://community.zenoss.org/people/jcurry] created the discussion

"Re: Zenping correlation problem 4.2.3"

To view the discussion, visit: http://community.zenoss.org/message/73577#73577

--------------------------------------------------------------
I have seen the same thing but only with my raddle emulated devices.  The internal connectivity map now uses nmap rather than building the map by gathering snmp routes.  Try digging around nmap to test routes and see if that gives you the correct routing picture.

Cheers,
Jane
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/73577#73577]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Duane Wylie]

Duane Wylie [http://community.zenoss.org/people/ldwylie] created the discussion

"Re: Zenping correlation problem 4.2.3"

To view the discussion, visit: http://community.zenoss.org/message/74410#74410

--------------------------------------------------------------
I am using Zenoss Core 4.2.4, and I'm seeing similar issues, but not identical.  I have a particular PDU that lives on the other side of a router (see nmap traceroute below).  When the link between 192.168.4.254 and 10.50.0.2 drops, Zenoss generates events for both the 10.50.0.2 device AND the 10.13.0.2 device (and several others that live behind that router.)

Remodeling the devices seems to have had no effect.  On a whim, I deleted and re-added the devices in the order of the traceroute, but to no avail.  Based on the tracepath.py tool, it appears that Zenoss is not learning the topology at all.

I'd like to look into the internals a bit to see how the topology works (or doesn't, in this case).  Can anyone share a few pointers on how to look under the hood?

======  nmap traceroute ======

[***@zenoss ~]$ nmap -sP --traceroute -n 10.13.0.2

Starting Nmap 5.51.4 ( http://nmap.org http://nmap.org ) at 2013-08-21 08:37 CDT
Nmap scan report for 10.13.0.2
Host is up (0.0015s latency).

TRACEROUTE (using proto 1/icmp)
HOP RTT     ADDRESS
1   0.29 ms 10.0.10.97
2   0.83 ms 192.168.4.254
3   1.02 ms 10.50.0.2
4   2.41 ms 10.13.0.2

Nmap done: 1 IP address (1 host up) scanned in 0.10 seconds

====== tracepath.py ======

[***@zenoss ~]$ tracepath.py 10.13.0.2
Getting path from localhost to 10.13.0.2...
zenoss -> 10.13.0.2
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74410#74410]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Michal Rusak]

Michal Rusak [http://community.zenoss.org/people/gryyzli] created the discussion

"Re: Zenping correlation problem 4.2.3"

To view the discussion, visit: http://community.zenoss.org/message/74432#74432

--------------------------------------------------------------
Hi Duane,
I think that tracepath.py is not usefull anymore.
You may look at $ZENHOME/Products/ZenStatus/SimpleCorrelator.py and ZENHOME/Products/ZenStatus/nmap/NmapPingTask.py to see how it works, check options in zenping.conf file (disable-corrlerator, connected-ips) - maybe theres a problem?
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/74432#74432]

Start a new discussion in zenoss-users at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]