Improved handling for unidentified output from fping in fping.monitor

I'm a huge fan of Mon, "a tool for monitoring the availability of services, and sending alerts on prescribed events". One thing that's been bugging me is that I'm running a bunch of Citrix XenServers at work and often get an annoying alert about a duplicate packet. Nothing is down. The error is cosmetic, but I'm tired of seeing it and having to explain to coworkers that everything is fine. Finally got around to doing something about it.

One way to solve is to:

1. Grab the latest fping.monitor from Sourceforge (1.4, in this example)

2. Save as fping.monitor.1.4

3. Create a patch named fping.monitor.1.4.patch (thanks to Ed Ravin)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
--- fping.monitor.1.4	2010-10-28 19:44:02.000000000 -0700
+++ fping.monitor.1.4	2010-10-28 19:46:41.000000000 -0700
@@ -61,6 +61,7 @@ open (IN, "$CMD @ARGV 2>&1 |") ||
 	die "could not open pipe to fping: $!\n";
 
 my @unreachable;
+my @unidentified;
 my @alive;
 my @addr_not_found;
 my @slow;
@@ -68,7 +69,7 @@ my @slow;
 while (<IN>)
 {
     chomp;
-    if (/^(\S+) is unreachable/i)
+    if (/^(\S+) is unreachable/)
     {
     	push (@unreachable, $1);
     }
@@ -120,7 +121,7 @@ while (<IN>)
 
     else
     {
-    	print STDERR "unidentified output from fping: [$_]\n";
+    	push @unidentified, $_;
     }
 }
 
@@ -214,6 +215,17 @@ EOF
     }
 }
 
+if (@unidentified != 0)
+{
+    print <<EOF;
+
+------------------------------------------------------------------------------
+unidentified output from fping
+------------------------------------------------------------------------------
+EOF
+       print join("\n", @unidentified), "\n";
+}
+
 #
 # traceroute
 #

4. Apply patch

1
patch < fping.monitor.1.4.patch
patching file fping.monitor.1.4

5. Backup existing fping.monitor and replace with patched 1.4 version

1
2
cp /usr/lib/mon/mon.d/fping.monitor /usr/lib/mon/mon.d/fping.monitor.original
cat fping.monitor.1.4 > /usr/lib/mon/mon.d/fping.monitor

This patch will place any unidentified fping output into the "Detail" section, instead of "Summary" in the web interface and also in the body of the email alert instead of subject and not send an email alert when unidentified output is encountered.

Before:

Description:
 
Summary: unidentified output from fping: [www.example.com : duplicate for [0], 84 bytes, 4.00 ms]
Hosts: www.example.com vm04.example.com vm05.example.com vm06.example.com vm02.example.com vm03.example.com vm07.example.com vm08.example.com dspace.example.com
Detail:
dspace.example.com

start time: Thu Oct 28 19:18:02 2010
end time  : Thu Oct 28 19:18:19 2010
duration  : 17 seconds

------------------------------------------------------------------------------
unreachable hosts
------------------------------------------------------------------------------
dspace.example.com


------------------------------------------------------------------------------
reachable hosts                          rtt
------------------------------------------------------------------------------
www.example.com                     4.00 ms
vm04.example.com                    0.00 ms
vm05.example.com                    0.00 ms
vm06.example.com                    0.00 ms
vm02.example.com                    0.00 ms
vm03.example.com                    0.00 ms
vm07.example.com                    0.00 ms
vm08.example.com                    0.00 ms

	

After:

Description:
 
Summary: dspace.example.com
Hosts: www.example.com vm04.example.com vm05.example.com vm06.example.com vm02.example.com vm03.example.com vm07.example.com vm08.example.com dspace.example.com
Detail:

start time: Thu Oct 28 19:19:02 2010
end time  : Thu Oct 28 19:19:19 2010
duration  : 17 seconds

------------------------------------------------------------------------------
unreachable hosts
------------------------------------------------------------------------------
dspace.example.com


------------------------------------------------------------------------------
reachable hosts                          rtt
------------------------------------------------------------------------------
www.example.com                     0.00 ms
vm04.example.com                    0.00 ms
vm05.example.com                    0.00 ms
vm06.example.com                    0.00 ms
vm02.example.com                    0.00 ms
vm03.example.com                    0.00 ms
vm07.example.com                    0.00 ms
vm08.example.com                    0.00 ms

------------------------------------------------------------------------------
unidentified output from fping
------------------------------------------------------------------------------
www.example.com : duplicate for [0], 84 bytes, 4.00 ms


	

Gotta love quality open source projects like Mon with a great community. :-)

Leave a comment

NOTE: Enclose quotes in <blockquote></blockquote>. Enclose code in <pre lang="LANG"></pre> (where LANG is one of these).