Cheshire Cat Computing

Hi,

sometimes (2-3x per day) I get the following entries in eventlog:

------------------
Source: NagiosEventLog
Description:
ID: 0
Die Beschreibung der Ereigniskennung ( 0 ) in ( NagiosEventLog ) wurde nicht gefunden. Der lokale Computer verfügt nicht über die zum Anzeigen der Meldungen von einem Remotecomputer erforderlichen Registrierungsinformationen oder DLL-Meldungsdateien. Möglicherweise müssen Sie das Flag /AUXSOURCE= zum Ermitteln der Beschreibung verwenden. Weitere Informationen stehen in Hilfe und Support. Ereignisinformationen: Invalid host name 'xxx.dyndns.org'
---------------
Source: NagiosEventLog
Description:
ID: 0
Die Beschreibung der Ereigniskennung ( 0 ) in ( NagiosEventLog ) wurde nicht gefunden. Der lokale Computer verfügt nicht über die zum Anzeigen der Meldungen von einem Remotecomputer erforderlichen Registrierungsinformationen oder DLL-Meldungsdateien. Möglicherweise müssen Sie das Flag /AUXSOURCE= zum Ermitteln der Beschreibung verwenden. Weitere Informationen stehen in Hilfe und Support. Ereignisinformationen: Error: Could not connect to host xxx.dyndns.org on port 5667
--------------------
Source: NagiosEventLog
Description:
ID: 0
Die Beschreibung der Ereigniskennung ( 0 ) in ( NagiosEventLog ) wurde nicht gefunden. Der lokale Computer verfügt nicht über die zum Anzeigen der Meldungen von einem Remotecomputer erforderlichen Registrierungsinformationen oder DLL-Meldungsdateien. Möglicherweise müssen Sie das Flag /AUXSOURCE= zum Ermitteln der Beschreibung verwenden. Weitere Informationen stehen in Hilfe und Support. Ereignisinformationen: Winsock error: 997.
-----------------

That is with version 1.6.2 on Small Business Server 2003. Problem is, that the event entries are not getting passed to the Nagios Host when this error occurs.

Thanks for this great program, btw.!
Jens

Every time that nageventlog needs to send a NSCA alert, it will do a lookup of the nsca server hostnames - although the windows library will cache lookups. This is deliberate as IP sometimes addresses change and a single initial lookup will not catch this.

However, it appears you use dyndns.org, and their DNS servers are heavily loaded and set very short caching times on the entries. Sometimes a DNS lookup to dyndns.org will time out or fail, and in this case nageventlog no longer knows where to send the alert.

This weak link is, unfortunately, dyndns.org, which is not reliably responding to DNS lookups. They provide a free service, I think, and sometimes you get what you pay for. If this is a business critical monitoring function, I would suggest that you use a different DNS provider which although it may cost more will be able to guarantee a more reliable service?

One possibility for you is to set the same hostname as your secondary NSCA server. In this case, it will try the lookup twice. If the alert is sent twice, then this is probably not as bad as the alert being never sent at all.

Steve

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

The way that the code is currently written, it does not include any queue for outgoing alerts. They are sent immediately as and when required.

Adding some sort of queue might be a good idea for the future (it would probably have to go into the registry since otherwise it could not be guaranteed to be preserved) but it could end up making the registry overflow if not careful. I'd need a big rewrite of the system, though, and it won't be soon.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11