---

Subject:	Any tips? Anything?
Author:	[Not Specified]
Posted:	2014-05-16 03:34

Any tips Anything

---

Subject:	I've seen something similar
Author:	[Not Specified]
Posted:	2014-05-16 08:30

I've seen something similar to this before. What kind of network adapter did you assign to the CentOS Container/VM Is the host doing NAT for the VM

Hydruid

---

Subject:	Its 'Routed mode (venet)'
Author:	[Not Specified]
Posted:	2014-05-16 10:38

Its 'Routed mode (venet)'

Network works, i Can ping everything. All my VPS use these settings and always all works property

---

Subject:	That should be correct. Can
Author:	[Not Specified]
Posted:	2014-05-16 12:35

That should be correct. Can the devices you're monitoring ping the zenoss server If so, it's not the problem I was thinking of.

Hydruid

---

Subject:	Yes, of course. Each device
Author:	[Not Specified]
Posted:	2014-05-16 12:58

Yes, of course. Each device can ping both ways.

---

Subject:	Good. Try modeling from the
Author:	[Not Specified]
Posted:	2014-05-16 13:00

Good. Try modeling from the command line with debugging turned on to see if you can find any errors:

zenmodeler run -v10 --device="5.5.5.5"

Hydruid

---

Subject:	http://file.skyday.eu
Author:	[Not Specified]
Posted:	2014-05-16 13:10

http://file.skyday.eu/zenosslogs/support-log/modeler5555.txt

---

Subject:	Replace the 5.5.5.5 with the
Author:	[Not Specified]
Posted:	2014-05-16 13:42

Replace the 5.5.5.5 with the name of one of the linux servers ;)

Hydruid

---

Subject:	:)
Author:	[Not Specified]
Posted:	2014-05-16 13:54

:)

http://file.skyday.eu/zenosslogs/support-log/modeler181.txt

---

Subject:	That looks good to me. I
Author:	[Not Specified]
Posted:	2014-05-16 14:21

That looks good to me. I suggest you jump into #zenoss on IRC and see if anyone can help, this is a very strange yet intriguing problem! BTW it's usually not that busy on Fridays but Mondays are a great day to get help in there!

I also hang out in there!

Hydruid

---

Subject:	Thanks for try to help!
Author:	[Not Specified]
Posted:	2014-05-16 15:36

Thanks for try to help!

---

Subject:	Thanks for user boman in
Author:	[Not Specified]
Posted:	2014-05-16 16:17

Thanks for user boman in #zenoss irc channel and Daniel Burge

Devices status is now UP - great!

http://community.zenoss.org/message/69970#69970
Daniel Burge says:

I was having this same problem. I found this thread and worked through it, however changing the packet size didn't make any difference for me. After a lot of testing I made a different change to the nmap code which fixed the problem.

Here are my notes on how I fixed it.

Fixing issue with device down alerts, even though ping appears to work correctly.

If you ping a device through the ping command on the device, or thourgh the ping command when logged into ZenOSSit will show that you can ping the device just fine. However, ZenOSS reports that the device is down.

The problem is that ZenOSS uses nmap behind the scenes in the ZenPing daemon to do the pings, whereas

the ZenOSS interface uses something else, maybe regular ping, or maybe they execute nmap differently there.

In my case, on my Virtuosso based CentOS virtual server, nmap was picking the wrong ethernet interface (venet0) to base it's source address off of, which was resulting in the wrong source address in the ICMP packets.

I tested this on a physical CentOS server as well, and nmap behaved correctly and picked the correct interface (eth0), and the icmp packets contained the correct source address.

For some background information from the nmap author: http://nmap.org/nmap_doc.html
"nmap tries to detect your primary interface and uses that address. You can also use -S to specify it directly, but you shouldn't have to"

In my case, nmap is not detecting the correct source address. So I think this issue that I found is limited in scope to situations where nmap has this issue.

nmap has options which allow you to override the source address if needed.

By default ZenOSS doesn't include the source information to NMap, so nmap is called similar to this:

# nmap -sn -PE -n --privileged --send-ip --initial-rtt-timeout 2 --min-rtt-timeout 2 --max-retries 0 -v -d --packet-trace 8.8.8.8

The ICMP packets look like this:

SENT (0.0280s) ICMP 127.0.0.1 > 8.8.8.8 Echo request (type=8/code=0) ttl=55 id=16996 iplen=28

Notice the 127.0.0.1 as the source address.

I found that the destination device never receives this packet by monitoring the icmp traffic on the source and destination using tcpdump.

Watch the icmp traffic like this:

# tcpdump icmp

To fix it nmap must be run like this, to include the source IP using the nmap "spoof" option, even though you aren't really spoofing, you are just specifying your actual source information.

# nmap -S YOURIPADDRESS -sn -PE -n --privileged --send-ip --initial-rtt-timeout 2 --min-rtt-timeout 2 --max-retries 0 -v -d --packet-trace 8.8.8.8

The ICMP packets then look like this:
SENT (0.0400s) ICMP YOURIPADDRESS > 8.8.8.8 Echo request (type=8/code=0) ttl=53 id=40229 iplen=28
RCVD (0.0960s) ICMP 8.8.8.8 > YOURIPADDRESS Echo reply (type=0/code=0) ttl=57 id=36350 iplen=28

I couldn't figure out a way to fix it without having to hard code the source IP or Domain into the ZenOSS nmap code. Maybe someone else can.

To modify the Zenoss nmap code to send the requests with your corrected source address:

# vi /opt/zenoss/Products/ZenStatus/nmap/NmapPingTask.py

search for the python _executeNmapCmd function

add this line to the args:

args.extend(["-S", "YOURIPADDRESSORDOMAIN"])

Then restart the "zenping" daemon.

---

Subject:	Next day and zenoss show
Author:	[Not Specified]
Posted:	2014-05-17 09:04

Next day and zenoss show uptime and start draw graps!

http://imgur.com/jADXik4
http://imgur.com/wTW4kW3

But no graphs on CPU or Interfaces:
http://imgur.com/IXAEqeo
http://imgur.com/X3nvnbN

I guess - need to configure something But its problem to next topic...

---

Subject:	I think by default the SSH
Author:	[Not Specified]
Posted:	2014-05-19 09:54

I think by default the SSH template doesn't have a lot of that setup, you have to do it manually

Hydruid

---

Subject:	Awesome answer Pstopa. Thanks
Author:	[Not Specified]
Posted:	2016-01-21 04:33

Awesome answerPstopa. Thanks

Mathias