118 |
<ul> |
<ul> |
119 |
<LI><A HREF="#coresol">Watch and analyze crashdumps (Solaris)</A></LI> |
<LI><A HREF="#coresol">Watch and analyze crashdumps (Solaris)</A></LI> |
120 |
<LI><A HREF="#corelin">Watch and analyze crashdumps (Linux)</A></LI> |
<LI><A HREF="#corelin">Watch and analyze crashdumps (Linux)</A></LI> |
121 |
<LI><A HREF="#tcpdump">Start and stop tcpdump based on condition</A></LI> |
<LI><A HREF="#tcpdump1">Start and stop tcpdump based on condition</A></LI> |
122 |
|
<LI><A HREF="#tcpdump2">Rotate tcpdump until condition occures</A></LI> |
123 |
</ul> |
</ul> |
124 |
</li> |
</li> |
125 |
</ul> |
</ul> |
1088 |
</pre> |
</pre> |
1089 |
|
|
1090 |
|
|
1091 |
<h3><a name="tcpdump">Start and stop tcpdump based on network outage</a></h3> |
<h3><a name="tcpdump1">Start and stop tcpdump based on condition</a></h3> |
1092 |
As soon as the remote SMTP service of host bar is not available tcpdump is started. |
As soon as the remote SMTP service of host bar is not available tcpdump is started. |
1093 |
When the connection is available again, tcpdump is stopped. Monit is running as |
When the connection is available again, tcpdump is stopped. Only first |
|
non-privileged user so sudo was used to provide tcpdump capability. Only first |
|
1094 |
ocurrence is catched (noexec flag is created to prevent another outage monitoring). |
ocurrence is catched (noexec flag is created to prevent another outage monitoring). |
1095 |
<pre> |
<pre> |
1096 |
check host bar with address 10.1.1.2 |
check host bar with address 10.1.1.2 |
1097 |
if failed port 25 protocol smtp then exec "/bin/bash -c 'if [ ! -f /tmp/noexec ]; then touch /tmp/noexec; sudo tcpdump -w /tmp/foo_bar.dump host bar; fi'" else if recovered then exec "sudo killall tcpdump" |
if failed port 25 protocol smtp then exec "/bin/bash -c 'if [ ! -f /tmp/noexec ]; then touch /tmp/noexec; tcpdump -w /tmp/foo_bar.dump host bar; fi'" else if recovered then exec "killall tcpdump" |
1098 |
|
</pre> |
1099 |
|
|
1100 |
|
|
1101 |
|
<h3><a name="tcpdump2">Rotate tcpdump until condition occures</a></h3> |
1102 |
|
This allows to let tcpdump write the data to file and rotate it to keep the size of |
1103 |
|
the dump small until network problem occures (we don't need to flood the filesystem |
1104 |
|
with data which are ok). As soon as the problem occures, monit sets noexec flag |
1105 |
|
=> the dump contains the data which preceded the problem as well. |
1106 |
|
|
1107 |
|
Script for tcpdump and rotation created (/tmp/dumprotate): |
1108 |
|
<pre> |
1109 |
|
#!/bin/bash |
1110 |
|
killall tcpdump |
1111 |
|
if [ ! -f /tmp/noexec ] |
1112 |
|
then |
1113 |
|
tcpdump -w /tmp/foo_bar.dump host bar |
1114 |
|
fi |
1115 |
|
</pre> |
1116 |
|
|
1117 |
|
The script is started from cron each 30 minutes: |
1118 |
|
<pre> |
1119 |
|
0,30 * * * * /tmp/dumprotate |
1120 |
|
</pre> |
1121 |
|
|
1122 |
|
Monit watches the host availablity and as soon as it failed, sets noexec flag |
1123 |
|
(with 5 minutes extent): |
1124 |
|
<pre> |
1125 |
|
check host bar with address 10.1.1.2 |
1126 |
|
if failed port 25 protocol smtp then exec "/bin/bash -c 'sleep 300; touch /tmp/noexec'" |
1127 |
</pre> |
</pre> |
1128 |
|
|
1129 |
|
|