I agree with you on that last point. Nothing I've seen indicates that the built in time service of WUG will compare the time it gets to what the WUG server has. And who do you believe if they are not the same (Digital watches keep better time than PC's).
I am curious why you were testing the stratum level of the machines, you find them changing that alot on you? ----- Original Message ----- From: Ben Russo <[EMAIL PROTECTED]> Date: Tuesday, December 17, 2002 8:33 am Subject: Re: [WhatsUp Forum] NTP custom monitor > OK, I will set up inetd to do time protocol and try that. > > Do you know if WUG actually checks the time to see if it > is within acceptable parameters? > Or does it just check to see if it gets a response? > > I am assuming the later... > > > On Mon, 2002-12-16 at 23:41, [EMAIL PROTECTED] wrote: > > Ben, > > You might try using the built in time check service that WUG > has, > > providing that the NTP servers you are testing are also > providing time > > via that older protocol. Time protocol CAN be either TCP/UDP > and I > > believe that the WUG service asks via TCP. That's a guess, I > haven't > > put a sniffer on the line to see which protocol it uses. This > won't > > tell you anything about NTP stratum levels, but it might be a > data > > point that might be of some guidance. > > > > You might also fire up NTPQ, do the host command so you are > "logging > > onto" a machine you see giving you grief, do a peers command, go > to the > > machines in that list, and see if they list your trouble machine > as a > > peer and what the reachability number is. That would give you > > an "outside" view of what NTP reliability is viewed from via non- > WUG > > service. > > > > DNS problem may again be a UDP problem. DNS uses both > protocols, my > > understanding is that a packet greater than 512 bytes switches > to TCP > > (and that makes sense since you'd like a DNS zone xfer to be > reliably > > sent). My testing of a my DNS servers does NOT give me > intermittent > > failures, but bear in mind they are one router away from my WUG > machine > > on a network that is rock solid. > > > > I can't give you any significant data points on servers that > > are "remote". I had problems with that custom NTP service (I > wrote it, > > blame me) in that I had probably two failures a day testing a > local > > Lantronix Stratum 1 server. I blamed that on the Lantronix box, > > rightly or wrongly and had to stop using it because my > operations staff > > kept bugging me about those 1-2 SINGLE failures per day. > > > > ----- Original Message ----- > > From: Ben Russo <[EMAIL PROTECTED]> > > Date: Monday, December 16, 2002 3:36 pm > > Subject: Re: [WhatsUp Forum] NTP custom monitor > > > > > Thanks, Joe and David, > > > > > > I would bump up the timeout, *but* the stats for the objects > show > > > that > > > out of 36K polls the MAX delay is only 891 ms. > > > > > > Up since: 12/04/02 17:33:20 Missed 328 > > > Type # Polls % Responded % Missed # Alerts Avg delay Min delay > Max > > > delayICMP 87468 99.63% 0.37% 6 106 > 0 > > > 1516 > > > > > > NTP-Stratum-X-Check > > > 36464 88.62% 11.38% 54 0 > > > > 891 > > > > > > SSH-port-scan > > > 36464 99.98% 0.02% 63 0 > > > > 1328 > > > What I can't figure out is why this one service seems to miss > > > 11.38% of > > > the polls while the pings and SSH port connections only miss > <0.5%?> > I have tried running "ntpq -np remote-server-name" a few > dozen > > > times on > > > the command line, but it works every time as fast as I can hit > the > > > enter key, never fails. > > > > > > I could accept that it was network packet loss, but with a > timeout > > > of > > > only 5 seconds *IF* a TCP packet or ICMP packet were lost it > would > > > takemore than 5 seconds to recover (retransmit) as well, so I > > > would get > > > alerts on those services too, wouldn't I? > > > > > > Why then does only the NTP-Stratum-X-Check fail? > > > I don't expect anyone to have the answer in their pocket, but do > > > you see similar problems? > > > > > > I also have a very similar problem with DNS checking a server > in the > > > UK. The ICMP and SSH-port-scan rarely fail, but the DNS check > fails> > routinely. > > > > > > I could accept that it was a problem with my Custom Service > Script or > > > with my WUG server, but it never happens on the 100 servers > that > > > are > > > on local subnets. > > > > > > -Ben. > > > > > > > > > On Mon, 2002-12-16 at 14:48, [EMAIL PROTECTED] wrote: > > > > Ben, > > > > The problem may lie in the fact that the service is UDP. > > > Although the > > > > common ports documentation say NTP is both TCP and UDP, the > > > > implementatios I've encountered are all UDP. The problem > with > > > UDP is > > > > there is not a guaranteed delivery and this may be reflected > in > > > the > > > > fact your local NTP servers are doing okay, it's the remote > (and > > > who > > > > knows what chewing gum bailing wire links are there) servers > are > > > giving > > > > you headaches. > > > > > > > > Another theory may be that the remote servers may be heavily > > > loaded and > > > > not responding on every query. > > > > > > > > You can try increasing the timeouts and increase the number > of > > > failures > > > > before alarming. That won't help the web page, one miss and > it > > > alarms - > > > > one of my favorite gripes to IPswitch. > > > > > > > > Jay > > > > > > > > ----- Original Message ----- > > > > From: Ben Russo <[EMAIL PROTECTED]> > > > > Date: Monday, December 16, 2002 11:33 am > > > > Subject: [WhatsUp Forum] NTP custom monitor > > > > > > > > > WUG-List, > > > > > > > > > > I have a WUG 7.04 server on Windows 2000 Professional with > all the > > > > > patches. > > > > > > > > > > I read the IP-Custom Services white paper that I found on > the > > > Ipswitch> > web site and hacked a custom service monitor for > NTP > > > that checks > > > > > if > > > > > servers are a Stratum 1,2,3,4,5,6 or 7 NTP server. > > > > > > > > > > However I get false down reports for servers that are > using > > > this > > > > > particular service monitor. But only on servers that are > in > > > remote> > data centers in other Cities. > > > > > > > > > > I am wondering if there is some Expect script option that > I > > > should use > > > > > that would help reduce the number of false negatives? > > > > > > > > > > The basics of the custom service are: > > > > > > > > > > Name: NTP-Stratum-X-Check > > > > > UDP, port 123 Timeout 5 seconds > > > > > > > > > Send=%27%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0% > > 0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0%0 > > > > > Expect=~%28(%1|%2|%3|%4|%5|%6|%7) > > > > > > > > > > > > > > > It works 99.9% of the time for servers that are on the > local > > > subnet,> > I do get valid Service Down alerts when the > services > > > are really down. > > > > > > > > > > -Ben. > > > > > > > > > > > > > > > Please visit http://www.ipswitch.com/support/mailing- > lists.html> > > > to be removed from this list. > > > > > > > > > > An Archive of this list is available at: > > > > > http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ > > > > > > > > > > > > > > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > > > > to be removed from this list. > > > > > > > > An Archive of this list is available at: > > > > http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ > > > > > > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > > > to be removed from this list. > > > > > > An Archive of this list is available at: > > > http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ > > > > > > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > > to be removed from this list. > > > > An Archive of this list is available at: > > http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
