[Check_mk (english)] Incorrect Offset Warnings from System Time Service

Dye, Rob rdye at SCIRES.COM
Fri Feb 13 15:06:51 CET 2015


When I run cmk –nv <hostname> I get very random results.  The first time I ran it, the time offset was -25 seconds. I ran it a moment later and it said 0.3 seconds.  A few minutes later, it said -40.3 seconds.  If I run it multiple times very quickly, the first number returned is always high and the second number is correct.  I was monitoring the actual time while performing this test and the two systems were less than a second apart in reality.  What else can I check?


Respectfully,

Rob Dye

From: Andreas Döhler [mailto:andreas.doehler at gmail.com]
Sent: Friday, February 13, 2015 3:03 AM
To: Dye, Rob; checkmk-en at lists.mathias-kettner.de
Subject: Re: [Check_mk (english)] Incorrect Offset Warnings from System Time Service

Ok that means there is no problem on the agent side. Now it is important to pay some attention to the monitoring server. What i mean is, if the processing on your monitoring server takes longer then it should then you will get this huge delays.
You can test as the user your monitoring runs with the following command - cmk -nv <hostname>
Do you get there also wrong timeoffset's?

Best regards
Andreas

Dye, Rob <rdye at scires.com<mailto:rdye at scires.com>> schrieb am Thu Feb 12 2015 at 16:27:11:
Andreas,

  I’m not sure what the check latency is set to.  Where do I look for that setting?  When I do a telnet into the windows servers, the connections seem to close immediately after the data is received.  There is no noticeable delay.

Respectfully,

Rob Dye
From: Andreas Döhler [mailto:andreas.doehler at gmail.com<mailto:andreas.doehler at gmail.com>]
Sent: Wednesday, February 11, 2015 1:59 AM

To: Dye, Rob; checkmk-en at lists.mathias-kettner.de<mailto:checkmk-en at lists.mathias-kettner.de>
Subject: Re: [Check_mk (english)] Incorrect Offset Warnings from System Time Service

It sounds strange. Could it be that the check latency on your monitoring core is very high?
Your assumption is right that you should see 26 seconds offset inside OMD for all Windows servers.

The check function shows that it only compares the agent value with the local time from the monitoring server
systemtime = int(info[0][0])
ourtime = time.time()
offset = systemtime - ourtime

One thing what you can test is if the connection is immediately closed after the systemtime output. Normally i do this with a telnet from
the monitoring server to the clients. If it hangs for some seconds at the end then you have the source of your offset.

Best regards
Andreas

Dye, Rob <rdye at scires.com<mailto:rdye at scires.com>> schrieb am Tue Feb 10 2015 at 19:28:22:
Thanks, Andreas.  I checked the system time stamps.  I ran “nc <clientIP> 6556 ; date +%s” on the server to compare the agent time against the OMD server’s time.  They are all exactly 26 seconds off from the OMD server.  So, I would expect check_mk to report nearly identical offsets. In actuality, check_mk is reporting offsets ranging from 37 to 91 seconds.  I don’t understand why is it not displaying the 26 second offset that the agents are reporting.

Respectfully,

Rob Dye
From: Andreas Döhler [mailto:andreas.doehler at gmail.com<mailto:andreas.doehler at gmail.com>]
Sent: Tuesday, February 10, 2015 12:37 PM
To: Dye, Rob; checkmk-en at lists.mathias-kettner.de<mailto:checkmk-en at lists.mathias-kettner.de>
Subject: Re: [Check_mk (english)] Incorrect Offset Warnings from System Time Service

Hi Rob,
Check_MK compares the time stamp with his own time. Take a look at all your systemtime checks at the same time with the quicksearch function.
If there are all windows times the same amount off then you have a problem with timesync between your Unix and Windows infrastructure :)

Best regards
Andreas

Dye, Rob <rdye at scires.com<mailto:rdye at scires.com>> schrieb am Tue Feb 10 2015 at 17:55:21:
I’m new to Check_MK and I’m trying to troubleshoot an issue with a false warning state.  Check_mk is reporting something similar to:  “WARN – Offset is -64 sec”.  It seems to only happen on windows clients (we have 8 windows systems and 30 linux systems) but it varies from day to day which machine(s) are showing this alert.  In reality, the timestamps only vary by a second or two across the windows machines, but check_mk reports up to 70 seconds offset.  The check_mk/OMD server is about 20 seconds offset from the windows servers.

If I ssh into the server and run a “nc <serverIP> 6556” I can see the <<<systemtime>>> output at the bottom.  The time it reports is correct, so I believe the issue is on the server rather than the client end.

What is check_mk doing with this systemtime information to result in the warning that the time is 60-70 seconds offset and how can I fix it?

Thanks for your help!

Rob D


________________________________

CONFIDENTIALITY NOTICE: This email constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. 2510, and its disclosure is strictly limited to the named recipient(s) intended by the sender of this message. This email, and any attachments, may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, any copying, using, disclosing or distributing to others the information in this email and attachments is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts or hard copies of the email and attachments.

EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.
_______________________________________________
checkmk-en mailing list
checkmk-en at lists.mathias-kettner.de<mailto:checkmk-en at lists.mathias-kettner.de>
http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en


________________________________

CONFIDENTIALITY NOTICE: This email constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. 2510, and its disclosure is strictly limited to the named recipient(s) intended by the sender of this message. This email, and any attachments, may contain confidential and/or proprietary information of Scientific Research Corporation. If you are not a named recipient, any copying, using, disclosing or distributing to others the information in this email and attachments is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately and permanently delete the email, any attachments, and all copies thereof from any drives or storage media and destroy any printouts or hard copies of the email and attachments.

EXPORT COMPLIANCE NOTICE: This email and any attachments may contain technical data subject to U.S export restrictions under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). Export or transfer of this technical data and/or related information to any foreign person(s) or entity(ies), either within the U.S. or outside of the U.S., may require advance export authorization by the appropriate U.S. Government agency prior to export or transfer. In addition, technical data may not be exported or transferred to certain countries or specified designated nationals identified by U.S. embargo controls without prior export authorization. By accepting this email and any attachments, all recipients confirm that they understand and will comply with all applicable ITAR, EAR and embargo compliance requirements.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mathias-kettner.de/pipermail/checkmk-en/attachments/20150213/ff7d5f9a/attachment-0001.html>


More information about the checkmk-en mailing list