Exclusions are firing an alert

The forum for help and support with FreeNATS as well as any useful hints and tips
Post Reply
paullanders
Posts: 92
Joined: Thu Sep 04, 2008 9:48 pm

Exclusions are firing an alert

Post by paullanders » Thu Sep 11, 2008 2:58 pm

Hi Dave. Due to some of my servers generating false positives I set an exclusion in my test schedule from 2:00 am until 6:00 am. At 2:00 am my 0.04x installation fired a blank alert for every server and then another for every server at 6:00 a.m.! I assumed these were "I have stopped monitoring" and "I have started monitoring" alerts, but I see no provision to disable these. Can you help?

Thanks!

dave
Site Admin
Posts: 260
Joined: Fri May 30, 2008 9:09 pm
Location: UK
Contact:

Re: Exclusions are firing an alert

Post by dave » Thu Sep 11, 2008 4:13 pm

no it's totally unintended functionality. Probably some horrific logic error. I'll have a look at the code and let you know what I find out.

Cheers,

Dave
f

dave
Site Admin
Posts: 260
Joined: Fri May 30, 2008 9:09 pm
Location: UK
Contact:

Re: Exclusions are firing an alert

Post by dave » Thu Sep 11, 2008 5:50 pm

Hi,

Ok... I think I've traced the cause. Fixing the bug on warnings had the unintended consequence of allowing this (always present) but to appear. Unfortunately I don't have time to properly test this right now but it does seem to work fine.

http://www.purplepixie.org/freenats/dow ... 29a.tar.gz

Is the new test version. If it works ok in v0 then I'll apply the fix into the v1 code as well.

Cheers,

Dave.

paullanders
Posts: 92
Joined: Thu Sep 04, 2008 9:48 pm

Re: Exclusions are firing an alert

Post by paullanders » Thu Sep 11, 2008 9:36 pm

Hi Dave.

OK, 0.04.29a fixed the message firing issue during exclusions. However, now the tests are no longer re-enabled at the end of an exclusion. For example, I set an exclusion for 15:00 until 15:15. Tests stopped running at 15:00 but did not begin again at 15:15. Also, If I do a "test" of the exclusion for 15:30 the result is "Testing... No - TESTS WOULD NOT RUN"

Thanks, Dave.

paullanders
Posts: 92
Joined: Thu Sep 04, 2008 9:48 pm

Re: Exclusions are firing an alert

Post by paullanders » Thu Sep 11, 2008 9:52 pm

Oops, spoke too soon. When I deleted my test exclusion (15:00 - 15:15) a blank alert fired for every server.

dave
Site Admin
Posts: 260
Joined: Fri May 30, 2008 9:09 pm
Location: UK
Contact:

Re: Exclusions are firing an alert

Post by dave » Thu Sep 11, 2008 10:08 pm

Hmm..... How very very weird. I will carry on trying to reproduce it here.

In the meantime is there any way a remote session might be arranged? I can do... MSN Remote Assist, PPTP VPN, SSH/Web port forwarding or any combination of the above (or logmein etc if you have that). You can PM me via the forum if that is possible. No worries if not.

As I mentioned - I'll get running some tests and see if I can reproduce it. It's soooo weird though as scheduling doesn't work as an on/off system - every time a test is due it's checked to see if it "should" be run so stuff should start to work once an exclusions passed regardless. Weird. No doubt a really obvious error once I find it!

Cheers,

Dave.

paullanders
Posts: 92
Joined: Thu Sep 04, 2008 9:48 pm

Re: Exclusions are firing an alert

Post by paullanders » Fri Sep 12, 2008 4:27 pm

Update - I have an exclusion for 2:00 a.m. to 6:00 a.m. All tests stopped running at 2:00 a.m. and no alerts fired. At 6:00 all tests resumed and one blank alert fired for each server.

Paul

dave
Site Admin
Posts: 260
Joined: Fri May 30, 2008 9:09 pm
Location: UK
Contact:

Re: Exclusions are firing an alert

Post by dave » Sat Sep 13, 2008 6:23 pm

To update anyone else reading this/experiencing the same issues... Paul through some extreme reverse-SSH witchcraft kindly allowed me remote access to his site to diagnose the fault. Although I couldn't directly reproduce it I was able to see the raw logs from test sessions etc which fired which basically proved where the bug was not. To this end I have identified and fixed what I believe to be the problem and we've done a few multi-node schedules and all seems well.

To fix upgrade to the latest v0 release - I'm now packing up the latest v0 beta (0.04.31b) which rolls up all the recent bugfixes in a single release.

This release will also address a bug in scheduling which was affecting the minutes thanks to a late night coding error (the minutes value of a time was actually the month number causing!).

Post Reply