Duane, >From your log I see two consecutive custom service checks: GET / HTTP/1.1 followed by GET /public/servlet/snoop HTTP/1.1 This looks as if you have two instances of a custom service defined and applied to the device. I could not re-create your problem, but I would remove the first service from the device. Another thing to try is to modify your Expected Response so that you are looking for a more specific pattern match. Change:Expected Response=~.*Snoop Servlet.* To:Expected Response=~<TITLE>Snoop Servlet</TITLE> This would eliminate any possibility that you are finding your pattern in the returned header. Joe In reply to 29 May message from [EMAIL PROTECTED]: >Daniel, >Below are the service parameters + the debug log, of a good and bad request. The >custom service I >have defined is to monitor Websphere Application Server (Servlet Engine) under IIS >4.0. You can see >that on the good request (the 1st one), I get back a valid HTTP response from the >webserver/servlet >engine. In the 2nd request, the servlet engine is specifically shut down with the >webserver up. >I realize that there is a bug in IIS/Websphere that is causing the combination to not >return HTTP 500 >(or 404 or something) when the servlet engine is dead. But, until that's fixed, I'd >like to be able >to catch the condition in What'sUp. >Thanks for the help. >--D >Duane Waddle >[EMAIL PROTECTED] >"With sufficient thrust, pigs fly just fine..." -- RFC1925 >Custom Service + Debug logs below >-------------------------------------------------------------------- >TCP Port 80, Timeout=10 >EOC=(null) >SOC=GET /public/servlet/snoop HTTP/1.1\r\nHost: localhost\r\n\r\n Expected >Response=~.*Snoop >Servlet.* >Send to Disc=(null) >(E:\Program Files\WhatsUp\mymap.wup) map poll start ping 172.25.20.20 returned in 0 >ms. 0 >>>> COHS CHECK 80 on 172.25.20.20 >connected >GET / HTTP/1.1 >Host: localhost >HTTP/1.0 302 Object Moved >Location: >https://authform.mydomain.org/login.fcc?TYPE=33554433&REALMOID=06-3aeeeff6-5be6-001b-0000-048900000489&GUID > >=&SMAUTHREASON=0&TARGET=http://ers-3/ ><<< COHS EXIT=0 >TCP/IP Service check complete. OK >>>> COHS CHECK 80 on 172.25.20.20 >connected >GET /public/servlet/snoop HTTP/1.1 >Host: localhost >HTTP/1.1 200 ok >Server: Microsoft-IIS/4.0 >Date: Wed, 30 May 2001 02:02:57 GMT >Connection: close >content-type:text/html ><HTML><HEAD><TITLE>Snoop Servlet</TITLE></HEAD><BODY BGCOLOR="#FFFFEE"> <h1>Snoop >Servlet - >Request/Client Information</h1> <h2>Requested URL:</h2> ><TABLE Border="2" WIDTH="65%" BGCOLOR="#DDDDFF"> ><tr><td>http://localhost/public/servlet/snoop</td></tr></table><BR><BR> ><h2>Initialization >Parameters</h2> ><TABLE Border="2" WIDTH="65%" BGCOLOR="#DDDDFF"> ><tr><td>param1</td><td>test-value1</td></tr> ></table><BR><BR> ><h2>Request Information:</h2> ><TABLE Border="2" WIDTH="65%" BGCOLOR="#DDDDFF"> ><tr><td>Request method</td><td>GET</td></tr> ><tr><td>Request URI</td><td>/public/servlet/snoop</td></tr> <tr><td>Request >protocol</td><td>HTTP/1.1</td></tr> <tr><td>Servlet >path</td><td>/public/servlet/snoop</td></tr> ><tr><td>Path info</td><td><none></td></tr> ><tr><td>Path translated</td><td><none></td></tr> <tr><td>Character >encoding</td><td>iso-8859-1</td></tr> <tr><td>Query >string</td><td><none></td></tr> ><tr><td>Content length</td><td>0</td></tr> ><tr><td>Content type</td><td><<<< COHS EXIT=0 >TCP/IP Service check complete. OK >(E:\Program Files\WhatsUp\mymap.wup) map poll complete >(E:\Program Files\WhatsUp\mymap.wup) map poll start ping 172.25.20.20 returned in 0 >ms. 0 >>>> COHS CHECK 80 on 172.25.20.20 >connected >GET / HTTP/1.1 >Host: localhost >HTTP/1.0 302 Object Moved >Location: >https://authform.mydomain.org/login.fcc?TYPE=33554433&REALMOID=06-3aeeeff6-5be6-001b-0000-048900000489&GUID > >=&SMAUTHREASON=0&TARGET=http://ers-3/ ><<< COHS EXIT=0 >TCP/IP Service check complete. OK >>>> COHS CHECK 80 on 172.25.20.20 >connected >GET /public/servlet/snoop HTTP/1.1 >Host: localhost ><<< COHS EXIT=0 >TCP/IP Service check complete. OK >(E:\Program Files\WhatsUp\mymap.wup) map poll complete >"Daniel Donnelly" <[EMAIL PROTECTED]>@list.ipswitch.com on 05/25/2001 02:58:10 PM >Please respond to [EMAIL PROTECTED] >Sent by: [EMAIL PROTECTED] >To: <[EMAIL PROTECTED]> >cc: >Subject: Re: [WhatsUp Forum] Custom TCP/IP -- expected response not > triggered on silent disconnect >Duane, >If WUG completes a protocol handshake, that is enough for it to think the service is >running. In a >Custom Service, if you have nothing for any of the 4 fields, then WUG will still >think the service >is up, because it connected >(at least for some time!). But if you have a 'send command' and an 'expected >response', WUG will try to send the command and when it does not get the expected >response, it should >show the service as down. >If you have text in the 'Expect on connect' only, WUG should only say the service is >up when the >response matches the text. I have had to reduce the amount of text in the Expect, >like when checking >several different hosts and >the hostname is part of the response. Also, when the response gives a varying number >(IMail's >services show two fields at the end of the line, total number of connections since >service start and >current number of connection) within its 220 line. >What do you have in all the Custom Service fields?? >It would also be a good idea if you stopped polling, then open Debug Log and >then select that host and 'Check Now'. This will cause WUG to poll that host >only and the Debug log will show the complete communications with the host. Paste >that into email. >Daniel Donnelly >________________________________________________________ >----- Original Message ----- >From: "Duane Waddle" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Wednesday, May 23, 2001 11:34 PM >Subject: [WhatsUp Forum] Custom TCP/IP -- expected response not triggered on >silent disconnect >> I'm using WUG 6.02 and wondered if anyone else has seen something similar >> to this. I'm defining a custom TCP/IP service with an command on connect >> and an expected command response. When the application I'm connecting to >> is broken, however, the response is to close the connection without >sending >> anything in response to my command. WUG sees this as a service OK >> condition. I would understand a silent disconnect as being SVCUP if >there >> wasn't an expected response. But, in this case, I think that a silent >> disconnect should not match an expected response. Anyone else able to >> confirm this behaviour? Are my expectations as to the 'Right Thing (tm)' >> skewed? >> >> --D >> >> Duane Waddle >> [EMAIL PROTECTED] >> "With sufficient thrust, pigs fly just fine..." -- RFC1925 >> >> >> Please visit http://www.ipswitch.com/support/mailing-lists.html >> to be removed from this list. >> >Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from >this list. >An Archive of this list is available at: >http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ >Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from >this list. >An Archive of this list is available at: >http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
