Probe Thread

mueller · Tue Nov 28, 2006 5:09 pm

I would like to start a thread that has custom Probe example on it. My hope is not only to further my Knowledge but hopefully help others with this great software.

Here are a few I have made.

Cisco CPU
Type: Function
Available: if(oid("1.3.6.1.4.1.9.2.1.58.0")>0, 1, -1)
Error: ""
Value: oid("1.3.6.1.4.1.9.2.1.58.0")
Unit: % of cpu load

APC PDU LOAD
Type:Function
Available:if(oid("1.3.6.1.4.1.318.1.1.12.2.3.1.1.2.1")>0, 1, -1)
Error: if(oid("1.3.6.1.4.1.318.1.1.12.2.3.1.1.2.1")>0, "", "No Load")
Value: oid("1.3.6.1.4.1.318.1.1.12.2.3.1.1.2.1")
Unit: Load amps in decimal

winkelman · Mon Dec 04, 2006 3:18 pm

Check if a certain program is running on a Windows system ('OUTLOOK.EXE' in this example):

Type: function
Available: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"),"OUTLOOK.EXE")>0, 1, -1)
Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"),"OUTLOOK.EXE")>0, "", "OUTLOOK.EXE not detected by SNMP probe")
Value: 1 (or anything else, is purely for charting purposes and I return 1 if the service is running)
Unit: running (or whatever you want to call the above values)
Rate: none

This of course requires the SNMP agent is running and configured properly on the Windows system.

winkelman · Tue Dec 05, 2006 5:24 pm

Add this to a device notes (right-click the device, Notes)

[oid("1.3.6.1.2.1.1.1.0")]

Then the device's popup will list a description of the system.

For example, for Windows systems it will show the hardware and software platform, for Cisco devices the hardware and firmware revisions, etc.

winkelman · Tue Dec 05, 2006 5:35 pm

The standard CPU load figure ("34%") is the average of all available CPU's, but if you add this to a devices 'Appearance'

Load on [array_size(oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrDevice.hrProcessorTable.hrProcessorEntry.hrProcessorLoad"))] CPU('s): [oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrDevice.hrProcessorTable.hrProcessorEntry.hrProcessorLoad")]

and the device label will show the number of CPU's in the system and the load on each separate CPU (for example: 'Load on 4 CPU('s): 12, 15, 46, 2').

(Only tested for Windows target systems...)

mueller · Mon Dec 18, 2006 12:58 pm

This is my default label
Thanks for the addin guys

Device [Device.Name] ([Device.Type])
IP: [Device.AddressesCommaList]
Services ([Device.ServicesCount]):
Up: [Device.ServicesUp]
Unstable: [Device.ServicesUnstable]
Down: [Device.ServicesDown]
Acked: [Device.ServicesAcked]
Unknown: [Device.ServicesUnknown]
Dell Tag [oid("iso.3.6.1.4.1.674.10892.1.300.10.1.11.1")]
[oid("1.3.6.1.2.1.1.1.0")]
[snmp_name][snmp_description][snmp_uptime][snmp_contact][snmp_location]
Load on [array_size(oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrDevice.hrProcessorTable.hrProcessorEntry.hrProcessorLoad"))] CPU('s): [oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrDevice.hrProcessorTable.hrProcessorEntry.hrProcessorLoad")]
Notes:
[Device.NotesColumn]

mueller · Mon Dec 18, 2006 1:00 pm

Dell temperature alert if it gets over 95

available
if(oid("iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3")>0, 1, -1)

error
if(oid("iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3")<350, "", "Over Temp 95")

value
iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3
C
none

winkelman · Fri Feb 02, 2007 8:30 pm

Warning when disk usage goes over 89%

Type: function
Available: if(hdd_usage()>0, 1, -1)
Error: if(hdd_usage()<90, "", "Disk usage > 89%")
Value: hdd_usage()
Unit: %
Rate: none

Note: this probe uses the built in hdd_usage function, so for devices with multiple hard disks it looks at the average disk space usage. Of course, the above example is easily adapted for a specific hard drive. Just replace 'hdd_usage' with the appropriate oid("xxxxx") call.

Pablete · Thu May 24, 2007 2:20 pm

First of all, I like very much this tool.

I managed to plot a reachability graph. 100% reachability=no packet loss. "reachability (%)" = 100 - "packet loss (%)"

1st I have created a function:
Name: packet_loss_test
Desc: number of replied pings from 10 ping requests (0-10)
Code:
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 ) +
if( array_element(ping(device_property("FirstAddress")) , 0)<0 , 0 , 1 )

2nd) I have created the probe
Name: reachability
Type: function
Available: ping(device_property("FirstAddress")) >= 0
Error: ""
Value: packet_loss_test()*10
Unit: %

If you want finer values you can make an addition of 20 pings instead of 10 and change Value in the probe for
packet_loss_test()*5
but the probe will be more intrusive.
-------------------Post edit;-------------------------------
I have noticed that the Dude only performed two pings of the ten i wrote in the function. Options are:
1) to change the function to make only two pings
and to change the probe Value: packet_loss_test()*50
2) to execute an external ping. I'm working on this.
3) to enhace the ping function, with a parameter that should be the number of packets to send, and to return the number of answered packets.
-------------------Post edit, even later;-------------------------------
Now testing Dude 4beta3. Dude stores somewhere the answer of the first ping so it only sends one ping, so this probe is almost useless.
The only interesting result is if you understand it as a pulse-code-modulated signal.
-------------------Post edit, even later than the previous one;-------------------------------
Not so useless. I still have my graphs.

Clipboard01.gif

Here you may see three graphs.
First is mostly in yellow the reachability of four of my WiFi computers.
Second, several computers in Internet
Third, a place that has suffered of a communications problem today.
It is not perfect, mostly when it is under the time to change from raw draws information to the 10 min summary as you may see at the right side of the third chart.

Regards

Pablete · Thu May 24, 2007 2:31 pm

This is almost a copy and paste of the http probe.

Probe definition:
Name: Google through proxy
Type: TCP
Port: 8080 (this may change at your company)
Connect Only UNCHECKED
First Receive, Then Send UNCHECKED
Send: GET http://www.google.com/ HTTP/1.0\r\n\r\n
Receive: HTTP/1.1 200 OK

Pablete · Thu May 24, 2007 4:17 pm

Some other probes.
Bluecoat is a http cache proxy. I have probes to measure the CPU of a solaris host and CPU and pages/sec of the Bluecoat

Function definition ---------------------------------
Name: cpu_bluecoat_usage
Desc: cpu usage for blue coat device
Code: oid("1.3.6.1.4.1.3417.2.4.1.1.1.4.1")

Probe definition ------------------------------------
Name: cpu_bluecoat
Type: Function
Available: cpu_bluecoat_usage()
Error: if(cpu_bluecoat_usage(), "", "down")
Value: cpu_bluecoat_usage()
Unit: %

Function definition ---------------------------------
Name: cpu_solaris_idle_ticks
Desc: timeticks in idle mode for solaris host
Code: oid("1.3.6.1.4.1.42.3.13.4.0")

Function definition ---------------------------------
Name: cpu_solaris_usage_ticks
Desc: timeticks not in dle mode for solaris host
Code: oid("1.3.6.1.4.1.42.3.13.1.0") +
oid("1.3.6.1.4.1.42.3.13.2.0") +
oid("1.3.6.1.4.1.42.3.13.3.0")

Function definition ---------------------------------
Name: cpu_solaris_total_ticks
Desc: cpu timeticks for solaris host
Code: oid("1.3.6.1.4.1.42.3.13.1.0") +
oid("1.3.6.1.4.1.42.3.13.2.0") +
oid("1.3.6.1.4.1.42.3.13.3.0") +
oid("1.3.6.1.4.1.42.3.13.4.0")

Function definition ---------------------------------
Name: cpu_solaris_usage
Desc: cpu usage for solaris host
Code: 100 *
rate(cpu_solaris_usage_ticks()) /
rate(cpu_solaris_total_ticks())

Probe definition ------------------------------------
Name: cpu_solaris
Type: Function
Available: cpu_solaris_idle_ticks()
Error: if(cpu_solaris_idle_ticks(), "", "")
Value: cpu_solaris_usage()
Unit: %

Function definition ---------------------------------
Name: http_requests_bluecoat
Desc: http requests for a bluecoat device
Code: oid("1.3.6.1.3.25.17.3.2.1.1.0")

Function definition ---------------------------------
Name: http_rate_bluecoat
Desc: http requests for a bluecoat device
Code: rate( oid("1.3.6.1.3.25.17.3.2.1.1.0") )

Probe definition ------------------------------------
Name: http_pages_bluecoat
Type: Function
Available: http_requests_bluecoat()
Error: if(http_requests_bluecoat(),"", "down")
Value: http_rate_bluecoat()
Unit: pages/sec

Have I said I like this tool?
Regards

Tsiera · Wed Feb 13, 2008 12:49 pm

I have the following probes

Check CPU, warning @ 80% CPU usage
Name: CPU usage < 80%
Type: Funtion
Available: if(cpu_usage()>0, 1, -1)
Error: if(cpu_usage()<80, "", "CPU usage > 79%")
Value: cpu_usage()
Unit: %
Rate: none

Check Memory, warning @ 80 % Memory usage
Name: Memory usage < 80%
Type: Funtion
Available: if(mem_usage()>0, 1, -1)
Error: if(mem_usage()<80, "", "Memory usage > 79%")
Value: mem_usage()
Unit: %
Rate: none

Check Virtual Memory, warning @ 80% Virtual Memory usage
Name: Virtual Memory usage < 80%
Type: Funtion
Available: if(virtual_mem_usage()>0, 1, -1)
Error: if(virtual_mem_usage()<80, "", "Virtual Memory usage > 79%")
Value: virtual_mem_usage()
Unit: %
Rate: none

thanks to winkelman

Are there any probes to check the disk status?

winkelman · Wed Feb 13, 2008 3:23 pm

Are there any probes to check the disk status?

What do you mean? Status like 'up' or 'down' (perhaps for external disks)? Or status like '80% full'?

Tsiera · Wed Feb 13, 2008 5:28 pm

Are there any probes to check the disk status?
What do you mean? Status like 'up' or 'down' (perhaps for external disks)? Or status like '80% full'?

with a raid 5 i want to check if al disk are oke,
So when one of the disks go down i gets a notification

luzik · Thu Feb 14, 2008 9:27 am

it is possible to use parameters in created function like it is in builtin ones?
Now i got error message "too many parameters for functioname"
How to read parameters? $1 $2 ?

winkelman · Thu Feb 14, 2008 12:58 pm

with a raid 5 i want to check if al disk are oke,
So when one of the disks go down i gets a notification

By itself that is not possible. The OS (and thus the standard SNMP agent) just sees a RAID-set as a 'single disk'. It wouldn't know the status of any of its sub-parts. However, I do know that for example IBM ServeRAID adapters allow you to install the IBM ServeRAID Manager program, which optionally includes an additional SNMP agent. That makes RAID-info available through SNMP and thus to the Dude.

Perhaps your brand of RAID adapter also has such management software available.

Tsiera · Thu Feb 14, 2008 2:26 pm

So its not possible to check disk status from any disk?
Because when i do a SNMP walk i see the physical disks oid's.
So then it must be posible te make a probe that checks the disk is ok and when the status is failed there will be a notification?

Tsiera · Tue Mar 25, 2008 10:16 am

Check if a certain program is running on a Windows system ('OUTLOOK.EXE' in this example):

Type: function
Available: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"),"OUTLOOK.EXE")>0, 1, -1)
Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"),"OUTLOOK.EXE")>0, "", "OUTLOOK.EXE not detected by SNMP probe")
Value: 1 (or anything else, is purely for charting purposes and I return 1 if the service is running)
Unit: running (or whatever you want to call the above values)
Rate: none

This of course requires the SNMP agent is running and configured properly on the Windows system.

I have a question about this probe
if you want to check somthing els like sqlservr.exe
You only need to change outlook.exe for sqlservr.exe or you need another oid?

talon63 · Tue Mar 25, 2008 2:40 pm

I would be interested in a probe/function that would allow detection of DHCP servers on the wire. It would prove invaluable in tracking down the odd rogue that pops up from time to time when someone puts a misconfigured router on the network. Can anyone assist in this?

thanks!

[edit] OK I am still trying to work this out and would like to know if I am on the right track. If I create a probe with the following setup, my thought would be that that I would get an alert if another dhcp server is detected.

name: dhcp probe..............................................//just a name
type:snmp......................................//may or may not be the right way to go
oid: 1.3.6.1.4.1.5.1.1.55.1.1.22........................//DhcpSrvDomainServer IpAddress used to match against known dhcp server address
oid type: IP Address
compare method: !=(not equal)...........................//this will provide my comparison
ip address:xxx.xxx.xxx.xxx................................//ip addy of known dhcp server

So, what I am thinking is that something like this should detect a rogue on the wire and if I have notifications setup for this, I should get a near immediate alert when it is detected. Does anyone have any input or suggestions, I'm open to them.

cheers

talon63 · Wed Apr 02, 2008 4:10 am

Bump, and a request to make this thread a sticky. I'll be more than happy to share any probes I get working if the rest of the community is willing.

beerfiend · Fri Apr 04, 2008 5:34 pm

double bump and I'll contribute my only custom probe. =( wish i was better at this stuff.

Name: wirlessID
Type: snmp
OID:iso.anonymous#62.anonymous#63.ieee802dot11.dot11smt.dot11StationConfigTable.dot11StationConfigEntry.dot11DesiredSSID.1
OID type: octet string
compare method: ==
String Value: (your SSID)

i use this to take auto discovered wireless devices and auto ID them into Wirless APs device type.

keith · Fri Apr 04, 2008 7:37 pm

I agree also.

What do you mean by
"i use this to take auto discovered wireless devices and auto ID them into Wirless APs device type."

I really don't understand probes and what all can be done with them. Could i make one that would tell me which port on a switch the workstation is attached to?

talon63 · Sat Apr 05, 2008 2:41 am

I think what he means is that when the devices are discovered, they will placed on the map as AP's not switches or other devices which is what the Dude with my AP's the first time around forcing me to manually change them into AP's on the map. Thanks for the script.

As for what probes are and what you can do with them...probes are the method by which things are discoverd, and by things it can cover a pretty broad area. Hardware, software, protocols, configuration, etc. As to what you can do with them, that is what this thread was created for. Given enough experience and knowledge about things work, connect, and talk to each other, and with some study of the OIDs, you can build custom probes to perform a great many tasks.

As far as it goes, I am still learning about custom probes myself, this is why I suggested making this a sticky and inviting others to participate. I am sure that there are some among the 14000+ membersip here who would be willing to share knowledge with the rest of us.

keith · Mon Apr 07, 2008 7:39 pm

Ok - I think i have the basics of snmp and OID's but how do you implement probes. Can anyone give like some really basic examples to get started with?

beerfiend · Tue Apr 08, 2008 4:55 pm

yeah, just read the backscroll of this thread to get an idea of what people are using these for. i like the cisco processor one myself. i was wondering how to do that. the network is your oister.

Pablete · Fri Apr 11, 2008 3:42 pm

Some more of my own

Is the proxy service up?
Name: proxy08080-google.es
Type: TCP
Port: 8080
Connect only: Unchecked
First receive, then send:Unchecked
Send: GET http://www.google.com/ HTTP/1.1\r\n\r\n
Receive: HTTP/1.1 200 OK
Be careful with this probe because it will fail in the following cases:
1) You have an authenticated proxy
2) You are in other country and you get a redirection (in my case to http://www.google.es, so I don't get a 200 OK).

And the socks service? This is also a good reference for the syntax of the escape secuences in probes
Name: socks01080-ftp.drivehq.com
Type: TCP
Port: 1080
Connect only: Unchecked
First receive, then send:Unchecked
Send: \x05\x01\x02
Receive: \x05
Send: \x05\x01\0\x03\x0fftp.drivehq.com\0\x15
Receive: 220 Welcome to the
Be careful with this probe because it will fail in the following cases:
1) You have an authenticated socks
2) This is for a V5 socks.
3) The \x0f before ftp.drivehq.com must have the length of the string ftp.drivehq.com . If you change the target server then the length of the dns name will change and you should change the length accordingly.

talon63 · Fri Apr 11, 2008 6:22 pm

Thanks for the probes, and thanks for listing reasons why they might fail. That should keep some of us out of trouble.

talon63 · Wed Jun 25, 2008 5:18 pm

Shameless bump of topic.

Pablete · Mon Jul 07, 2008 6:52 pm

Hi, two more. They need snmp.

The TCP retransmissions measures the number of TCP segments that the queried computer has needed to retransmit due to lost frames. This may be due to line congestion or LAN congestion, or non-responding computers. A flat zero line says that no frame is lost. Note that some media like frame relay specifically allows the drop of some frames.
Usually if you do a measure of the retransmissions over a second the result will be zero. You should measure them in a minute basis.

function
tcp_retrans_segs
tcp retransmited segments
oid("1.3.6.1.2.1.6.12.0")

Probe
tcp_retrans
Function
AV: tcp_retrans_segs()
ER: if(tcp_retrans_segs(), "", "down")
VAL: rate( tcp_retrans_segs() *60 )
UN: Packets
Rate: Minute

-------------------------------------------------------------------------------

TCP Connections gives the number of established or closewait connections of the queried device. The number depends on the usage of the device. A cache/proxy/load-balancing-device may have a really high number of tcp connections.

function
tcp_currestab
number of tcp established or closewait connections
oid("1.3.6.1.2.1.6.9.0")

Probe
tcp_estab
Function
AV: tcp_currestab()
ER: if(tcp_currestab(), "", "down")
VAL: tcp_currestab()
UN: connections

Regards
------ Post Edit ----
As mr. Winkelman posted before, the OID for the currently established or closewait tcp connections is 1.3.6.1.2.1.6.9.0 . THX for the correction. Sorry for the typo.

zhall · Fri Aug 15, 2008 8:20 pm

I'm trying to get a problem working that checks the SU RSSI level and then creates a graph off it. I guess I've gotten it working ok once. It graph'd correctly at least. The OID for signal strength seems to change from mikrotik to mikrotik, so I haven't figured out to deal with that. Anyway. Anybody had any luck in this department that might show me an example?

is there any documentation for custom functions and such?

zhall · Fri Aug 15, 2008 9:44 pm

Dis is what I ended up with so far:

Available : rssi_avail() > 0

which is --

array_size(oid_column("iso.3.6.1.4.1.14988.1.1.1.2.1.3"))

and then for value i have

array_element(oid_column("iso.3.6.1.4.1.14988.1.1.1.2.1.3"), 0)

it seems to work ok.

winkelman · Mon Aug 18, 2008 4:33 pm

<snip>

function
tcp_currestab
number of tcp established or closewait connections
oid("1.3.6.1.2.1.6.12.0")

<snip>

Nice, but not entieryly correct (I suspect copy-paste error

): established TCP connections is on oid("1.3.6.1.2.1.6.9.0")

CGirardy · Tue Aug 26, 2008 1:31 pm

Hi,
I would love to have a probe for an AS400 system (CPU / Network / HD)

I don't understand why it works with MRTG and I cannot get it to work using The Dude.

How can I do to translate this from MRTG to a probe in TheDude and why can't TheDude see the network cards ?

Thanks for you help

MRTG File used to query the SNMP on the AS400:

### Interface 2 >> Descr: 'ETHLINE' | Name: '' | Ip: 'xx.xx.xx.xx' | Eth: '00-09-6b-eb-d8-56' ###

Target[s44r1755_2]: 2:xxxxxxxx@s44r1755:
SetEnv[s44r1755_2]: MRTG_INT_IP="xx.xx.xx.xx" MRTG_INT_DESCR="ETHLINE"
MaxBytes[s44r1755_2]: 12500000
Title[s44r1755_2]: Traffic Analysis for 2 -- S44R1755.xxxxxxxxxxxx.xxxxxxxx
PageTop[s44r1755_2]: <h1>Traffic Analysis for 2 -- S44R1755.xxxxxxxxxxxx.xxxxxxxxx</h1>
<div id="sysdetails">
<table>
<tr><td>System:</td> <td>S44R1755.xxxxxxxxx.xxxxxxxx in </td></tr>
<tr><td>Maintainer:</td> <td></td></tr>
<tr><td>Description:</td> <td>ETHLINE </td></tr>
<tr><td>ifType:</td> <td>ethernetCsmacd (6)</td></tr>
<tr><td>ifName:</td> <td></td></tr>
<tr><td>Max Speed:</td> <td>100.0 Mbits/s</td></tr>
<tr><td>Ip:</td> <td>xx.xx.xx.xx (s44r1755.xxxxxxx.xxxxxxxx)</td></tr>
</table>
</div>

### Interface 3 >> Descr: 'ETHLINE2' | Name: '' | Ip: 'xx.xx.xx.xx' | Eth: '00-09-6b-eb-d8-57' ###

Target[s44r1755_3]: 3:xxxxxx@s44r1755:
SetEnv[s44r1755_3]: MRTG_INT_IP="xx.xx.xx.xx" MRTG_INT_DESCR="ETHLINE2"
MaxBytes[s44r1755_3]: 12500000
Title[s44r1755_3]: Traffic Analysis for 3 -- S44R1755.xxxxxx.xxxxxx
PageTop[s44r1755_3]: <h1>Traffic Analysis for 3 -- S44R1755.xxxxx.xxxxx</h1>
<div id="sysdetails">
<table>
<tr><td>System:</td> <td>S44R1755.xxxxxx.xxxxx in </td></tr>
<tr><td>Maintainer:</td> <td></td></tr>
<tr><td>Description:</td> <td>ETHLINE2 </td></tr>
<tr><td>ifType:</td> <td>ethernetCsmacd (6)</td></tr>
<tr><td>ifName:</td> <td></td></tr>
<tr><td>Max Speed:</td> <td>100.0 Mbits/s</td></tr>
<tr><td>Ip:</td> <td>xx.xx.xx.xx (vsiprd.xxxxxxx.xxxxxxx)</td></tr>
</table>
</div>

### Interface 4 >> Descr: 'TRNLINE' | Name: '' | Ip: 'xxx.xxx.xxx.xxx' | Eth: '40-00-00-00-08-20' ###

Target[s44r1755_4]: 4:xxxxx@s44r1755:
SetEnv[s44r1755_4]: MRTG_INT_IP="xxx.xxx.xxx.xxx" MRTG_INT_DESCR="TRNLINE"
MaxBytes[s44r1755_4]: 2000000
Title[s44r1755_4]: Traffic Analysis for 4 -- S44R1755.xxxxxx.xxxxxx
PageTop[s44r1755_4]: <h1>Traffic Analysis for 4 -- S44R1755.xxxxxx.xxxxxx</h1>
<div id="sysdetails">
<table>
<tr><td>System:</td> <td>S44R1755.xxxxxxx.xxxxxx in </td></tr>
<tr><td>Maintainer:</td> <td></td></tr>
<tr><td>Description:</td> <td>TRNLINE </td></tr>
<tr><td>ifType:</td> <td>iso88025TokenRing (9)</td></tr>
<tr><td>ifName:</td> <td></td></tr>
<tr><td>Max Speed:</td> <td>16.0 Mbits/s</td></tr>
<tr><td>Ip:</td> <td>xxx.xxx.xxx.xxx (ASGRASSE.xxxxxx.xxxxxx)</td></tr>
</table>
</div>

### CPU ###

YLegend[s44r1755.processorLoad]: % Utilization
Options[s44r1755.processorLoad]: growright,gauge,nopercent,nobanner
Target[s44r1755.processorLoad]: .1.3.6.1.2.1.25.3.3.1.2.1&.1.3.6.1.2.1.25.3.3.1.2.2:xxxxxxx@s44r1755
MaxBytes[s44r1755.processorLoad]: 100
Title[s44r1755.processorLoad]: S44R1755 : Utilisation du Processeur
ShortLegend[s44r1755.processorLoad]: %
Legend1[s44r1755.processorLoad]: Utilisation Processeur #1
Legend2[s44r1755.processorLoad]: Utilisation Processeur #2
Legend3[s44r1755.processorLoad]: Utilisation Processeur #1 (Maximum)
Legend4[s44r1755.processorLoad]: Utilisation Processeur #2 (Maximum)
LegendI[s44r1755.processorLoad]:  Load:
LegendO[s44r1755.processorLoad]:  Load:
PageTop[s44r1755.processorLoad]: <H1>S44R1755 : Utilisation du Processeur </H1>
<TABLE>
<TR><TD>System:</TD> <TD>S44R1755</TD></TR>
</TABLE>

### HD ###

YLegend[s44r1755.Disk]: Occupation Disque
Options[s44r1755.Disk]: growright,gauge
Target[s44r1755.Disk]: .1.3.6.1.2.1.25.2.3.1.6.1&.1.3.6.1.2.1.25.2.3.1.5.1:xxxxxxxx@s44r1755 * 4096
MaxBytes[s44r1755.Disk]: 281555238912
Title[s44r1755.Disk]: S44R1755 : Occupation Disque
ShortLegend[s44r1755.Disk]: o
Legend1[s44r1755.Disk]: Occupation disque
Legend2[s44r1755.Disk]: Taille du disque
Legend3[s44r1755.Disk]: Occupation disque Maximum
Legend4[s44r1755.Disk]: Taille disque Maximum
LegendI[s44r1755.Disk]:  Occupé :
LegendO[s44r1755.Disk]:  Taille :
PageTop[s44r1755.Disk]: <H1>S44R1755 : Occupation Disque </H1>
<TABLE>
<TR><TD>System:</TD> <TD>S44R1755</TD></TR>
</TABLE>

Thu Sep 04, 2008 9:17 pm

I believe this is a correction to the first post of the cisco cpu function... The 0 where the -1 was keeps this probe from being added to devices that do not have a value in the cisco cpu OID. More specifically I think "if(x>0,1,-1)" returns not false in and "if(x>0,1,0)" returns false. I noticed a lot of other functions in this thread have -1 in the return on false, those can be fixed also by following this example.

Test and correct me if I am wrong.

Cisco CPU
Type: Function
Available: if(oid("1.3.6.1.4.1.9.2.1.58.0")>0, 1, 0)
Error: ""
Value: oid("1.3.6.1.4.1.9.2.1.58.0")
Unit: % of cpu load

Thanks for the great thread! keep it up

Sweet!!!

Fri Sep 05, 2008 12:45 am

Some APC UPS probes I made based on the one from above... They all seem to work I just haven't actually tested them.
Create a new probe with the type of function and paste the lines.
Name is line 1,
Available is line 2,
Error is line 3,
value is line 4,
Unit is line5, but if you want similar values to show up on the same graph give them the same Unit description.

Checks to see if there is voltage on the input.
APC_Vin
if(oid("1.3.6.1.4.1.318.1.1.1.3.2.1.0")>0, 1, 0)
if(oid("1.3.6.1.4.1.318.1.1.1.3.2.1.0")>0, "", "No Power")
oid("1.3.6.1.4.1.318.1.1.1.3.2.1.0")
total

Measure battery temperature , should fix it to complain if too hot...
APC Battery Temperature
if(oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")>0, 1, 0)
if(oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")>0, "", "No Temp reading")
oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")
total

Battery Capacity errors if battery less than half. needs testing.
APC Capacity
if(oid("1.3.6.1.4.1.318.1.1.1.2.2.1.0")>0, 1, 0)
if(oid("1.3.6.1.4.1.318.1.1.1.2.2.1.0")>50, "", "Battery less than half")
oid("1.3.6.1.4.1.318.1.1.1.2.2.1.0")
%

Total load on UPS, complains if load is over 80. Need to test.
APC_Load
if(oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")>0, 1, 0)
if(oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")<80, "", "Over Load")
oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")
%

Wed Oct 15, 2008 3:46 am

An improved battery temperature... complains if it is out of range. Now if I could figure out how make it keep graphing when it is out of range. I am certain I could solve that with another probe but WHY

APC Battery Temperature
if(oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")>0, 1, 0)
if(or(oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")<20,oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")>40),concatenate("temperature out of range = ",oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")),"")
oid("1.3.6.1.4.1.318.1.1.1.2.2.2.0")
total

Fri Oct 17, 2008 12:51 am

A quick way to make a probe... Causes your UPS to show when a battery is needing replaced.

Snmpwalk the device you are wanting to create a probe for, right click on the oid once you find it, select create probe.

You can modify the function but this one worked with no changes...

iso.org.dod.internet.private.enterprises.apc.products.hardware.ups.upsBattery.upsAdvBattery.upsAdvBatteryReplaceIndicator.0

probe.JPG

Lucky or not here they are

failed.JPG

sdrenner · Sat Oct 25, 2008 12:04 am

Are these SNMP oid's via MT or straight to the APC ups?

Mon Nov 03, 2008 4:35 pm

For the APCs I read the device directly, reading the oid ... You might need PowerNet-MIB.mib.

adamd292 · Wed Nov 12, 2008 3:14 am

I have some VMWare ESX Servers and NetApp filers.
and wrote the following functions and probes to instrument CPU and Memory for them in The Dude:
(also there is a windows service probe)

FUNCTIONS

cpu_mem_disk_enhanced
Same as supllied cpu_mem_disk, but with added support for VMWare and NetApp CPU load
concatenate(
if(cpu_usage_available(), concatenate("cpu: ", round(cpu_usage()), "% "), ""),
if(vmcpu_usage_available(), concatenate("cpu: ", round(vmcpu_usage()), "% "), ""),
if(netappcpu_usage_available(), concatenate("cpu: ", round(netappcpu_usage()), "% "), ""),
if(mem_usage() > 0, concatenate("mem: ", round(mem_usage()), "% "), ""),
if(virtual_mem_usage() > 0, concatenate("virt: ", round(virtual_mem_usage()), "% "), ""),
if(hdd_usage() > 0, concatenate("disk: ", round(hdd_usage()), "% "), ""),
if(netapphdd_usage() > 0, concatenate("disk: ", round(netapphdd_usage()), "% "), "")
)

device_performance_enh
Adjusted to call cpu_mem_disk_enhanced
if(
string_size(cpu_mem_disk_enhanced()) > 0,
concatenate(cpu_mem_disk_enhanced(), "
"),

""
)

failed_service_summary
Shows failed services. Used to produce summary information on maps
if (device_property("ServicesCount")<>device_property("ServicesUpCount"), concatenate("Services (", device_property("ServicesUpCount"), "/", device_property("ServicesCount"), ")
", if (device_property("ServicesUnstableCount"), concatenate("Unstable: ", device_property("ServicesUnstableCount"), "
"), ""), if (device_property("ServicesDownCount"), concatenate("Down: ", device_property("ServicesDownCount"), "
"), ""), if (device_property("ServicesAckedCount"), concatenate("Acked: ", device_property("ServicesAckedCount"), "
"), ""), if (device_property("ServicesUnknownCount"), concatenate("Unknown: ", device_property("ServicesUnknownCount"), "
"), "")), "")

netappcpu_usage
Reports the CPU usage in percent of a NetApp
oid("1.3.6.1.4.1.789.1.2.1.3.0")

netappcpu_usage_available
Detects whether NetApp CPU usage is available
if(oid("1.3.6.1.4.1.789.1.2.1.3.0"),1,0)

netapphdd_usage
Reports NetApp Total Storage usage as a percentage.
oid("1.3.6.1.4.1.789.1.5.7.3.0")

vmcpu_usage
Report the CPU usage in percent on a VMWare server
100-oid("1.3.6.1.4.1.2021.11.11.0")

vmcpu_usage_available
Detects whether VMWare CPU usage is available.
if (oid("1.3.6.1.4.1.2021.11.11.0"),1,0)

FUNCTION PROBES

VMWare – cpu
Monitor the host CPU on a VMWare server
Available: vmcpu_usage_available()
Error: if(vmcpu_usage_available(), "", "down")
Value: vmcpu_usage()
Unit: %
Rate: none

NetApp - active disks
Number of active RAID disks
Available: if(oid("1.3.6.1.4.1.789.1.6.4.2.0")>0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.6.4.2.0")>0,"","none")
Value: oid("1.3.6.1.4.1.789.1.6.4.2.0")
Unit:
Rate: none

NetApp - bad disks
Number of failed RAID disks
Available: if(oid("1.3.6.1.4.1.789.1.6.4.7.0")=0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.6.4.7.0")=0,"","bad disks")
Value: oid("1.3.6.1.4.1.789.1.6.4.7.0")
Unit:
Rate: none

NetApp - bad fans
Number of failed cooling fans.
Available: if(oid("1.3.6.1.4.1.789.1.2.4.2.0")=0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.2.4.2.0")=0,"","bad fans")
Value: oid("1.3.6.1.4.1.789.1.2.4.2.0")
Unit:
Rate: none

NetApp - bad power
Number of failed power supply units.
Available: if(oid("1.3.6.1.4.1.789.1.2.4.4.0")=0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.2.4.4.0")=0,"","bad psu")
Value: oid("1.3.6.1.4.1.789.1.2.4.4.0")
Unit:
Rate: none

NetApp – cpu
CPU Busy % time
Available: netappcpu_usage_available()
Error: if(netappcpu_usage_available(), "", "down")
Value: netappcpu_usage()
Unit: %
Rate: none

NetApp - space used
Percentage of disk space used
Available: if(oid("1.3.6.1.4.1.789.1.5.7.1.0")>0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.5.7.1.0")>1,"disk space low","")
Value: oid("1.3.6.1.4.1.789.1.5.7.3.0")
Unit: %
Rate: none

NetApp – spare disks
Number of spare disks in NetApp array
Available: if(oid("1.3.6.1.4.1.789.1.6.4.8.0")>0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.6.4.8.0")>0,"","no spares")
Value: oid("1.3.6.1.4.1.789.1.6.4.8.0")
Unit:
Rate: none

NetApp – total disks
Total number of disks in NetApp array
Available: if(oid("1.3.6.1.4.1.789.1.6.4.1.0")>0,1,0)
Error: if(oid("1.3.6.1.4.1.789.1.6.4.1.0")>0,"","no disks")
Value: oid("1.3.6.1.4.1.789.1.6.4.1.0")
Unit:
Rate: none

Windows Service MyService
Is the Windows Service MyService up
Available: if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"MyService")>0, 1, 0)
Error: if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"MyService")>0, "", "MyService not detected by SNMP probe")
Value: 1
Unit:
Rate: none

*Need to replace MyService with the name of the service that you actually want to monitor

SNMP PROBES

NetApp - over temp
Probe to detect NetApp temperature limit
Oid: iso.org.dod.internet.private.enterprises.netapp.netapp1.sysStat.environment.envOverTemperature.0
Type: integer
Compare: ==
String Value: 1

NetApp - status
Probe to detect when the NetApp is not ok
Oid: iso.org.dod.internet.private.enterprises.netapp.netapp1.sysStat.misc.
miscGlobalStatus.0
Type: integer
Compare: ==
String Value: 3

Also in "Server Configuration" -> "Map" -> "Device Appearance"
I modified the global default for device label to use the enhanced device performance function from the list above

Change Device Appearance Label to:
[Device.CustomField1]
[Device.Name]
[Device.FirstAddress]
[device_performance_enh()][failed_service_summary()]

breazer · Mon Nov 24, 2008 1:52 pm

Hi All,
Do any of you know of a probe that will moniter a port

Regards
Breazer

rebellion · Tue Nov 25, 2008 4:44 am

what exactly you want to monitor?
Use snmpwalk with correct community name to see available monitoring-parameters (i think you need IfTable section of device).

breazer · Tue Nov 25, 2008 1:04 pm

Hi
Thanks for your reply, I am try to moniter if an ethernet port goes down.
I can see the if table entry of the interface but Im not to sure on how to create a prob for it.
Do you know if there is any where I can get this info to create a prob again thanks for your help

Breazer

Toepfe · Mon Dec 01, 2008 4:13 pm

Hi,

Somewhere in this great thread, Tsiera shows how to check the memory usage. I also used this way. Now I noticed that a switched of server, shows this special memory probe is ok?! The build in "memory" probe was down as it should be when the server is not reachable

I guess the reason is that function "mem_usage()" could not work correctly if the function "mem_size()" has no value.

I found two workarounds:

1. I changed function "mem_usage()" to:

if(mem_size() > 0,
oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageUsed.",
array_element(
oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageIndex", 600),
array_find(
oid_column("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageType", 600),
"iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTypes.hrStorageRam"
))))
* 100 / mem_size(), -1)

My probe looks as following:
Name: memory_95
Type: Function
Agent: default
Available: mem_size() > 0
Error: if(and(mem_usage()>=0, mem_usage() < 95), "", "down")
Value: mem_usage()
Unit: %
Rate: none

2. Workaround, instead of the error line above use:
Error: if(ping(device_property("FirstAddress")) >= 0, if(mem_usage() < 95, "", "down"), "down")

In the second workaround no changes in function "mem_usage()" are necessary. But if you use function mem_usage() you will have the behavior that your probe is ok, although the server is not reachable.

Bye

breazer · Thu Dec 04, 2008 7:07 pm

Thanks, its a port on a switch and a router I need to moniter

Regards
Breazer

ittsmith · Thu Dec 11, 2008 12:01 am

I'm having problems trying to monitor a service using the following...

Windows Service MyService
Is the Windows Service MyService up
Available: if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"MyService")>0, 1, 0)
Error: if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"MyService")>0, "", "MyService not detected by SNMP probe")
Value: 1
Unit:
Rate: none

*Need to replace MyService with the name of the service that you actually want to monitor

I know SMTP is fine cuz i can monitor lets say "Windows Audio" and if I stop/start it i get expected responses. I've tried the simple service name of my problem service, and what I THINK is the long name of my service and still nothing. Does it matter what type of windows service you are monitoring? This is a 3rd party service. What is the definitive way to get the service name? If I do SMTP walk, i do see it has a service name and that matches up to the simple name. What am I missing?

Toepfe · Thu Dec 11, 2008 4:53 pm

Could it be that you use the wrong OID. I check Windows services as following:

Available: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, 1, -1)
Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, "", "DB2_db2sec.exe not detected by SNMP probe")
Value: 1
Unit: running
Rate: none

Change "db2sec.exe" with the name of the service you like to monitor. One thing I also noticed is, that the name is case-sensitive! Write the service name the same as you see it in the Windows Task Manager.

Sometimes it also helps to use the if() function for debugging. If you are not shure what you will get with "if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0" and want to see it, put the same command as "to do". For example:

Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe"), array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe"))

With this error line you will see the output of the command in the "Problem" column of the "Services" table. Sometimes it helps me a lot to find bugs in my commands.

ittsmith · Thu Dec 11, 2008 7:20 pm

Thanks, that worked. I was sensitive to capitalization and tried the service with both the .exe and not, and also with its short name. I'm guessing it was the new OID number you gave me that made it work. Now I'm digging in to find out how to find out the disk free space on partitions I have on a single disk. It does me no good to know my disk is 50% free when in reality my c:\ partition is at 99% used. I see OID numbers for the partitions with differing instances so I'm assuming I'll have to do an array function. Right now, whenever i use the OID i think is correct i get a -1 returned (thank you for how to troubleshoot what you get returned) so that's not it. When I do the SNMP walk, there are so many OID... I'm still digging in.

rebellion · Thu Dec 11, 2008 7:24 pm

Thanks, its a port on a switch and a router I need to moniter

Regards
Breazer

for exapmle - what to do to monitor oper state of first port on switch DLink DES 3526:
1. make telnet session to your switch and use comman "show ports", to see admin/oper state for ports
2. snmwalk to this device from dude with correct community name (default - CommunityRead, if i'm not wrong).
3. Go to if_table -> ifOperState (or something like that, i'm don't remember exactly)
4. Check that indexes for oid is correct with waht you see in telnet session (or rtfm).
5. when checked and founded correct oid for oper state of first port, right click on string with oid, and choose "create probe".
6. in probe settings see for data type (must be integer) and =1 (if state is up).
after that you will have probe, that can be added for all of switches this type.

Toepfe · Fri Dec 12, 2008 9:10 am

To check the space in Gb of the first disk, I use the following probe:

Available: if((((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)>0, 1, -1)

Error: if((((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)>4, "", concatenate("Disk 1 (", string_substring(oid("1.3.6.1.2.1.25.2.3.1.3.1"),0,2), ") free space < 4 Gb"))

Value: (((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)

Unit: Gb
Rate: none

If you want to check disk 2, only change the last number of all OIDs from "1" to "2", and the message text from "Disk 1" to "Disk 2". The same for disk 3,4,5... . This probe will warn you after the space is lower than 4 Gb. To change it you may modify in the Error line ">4" to any other value (and of course the message text "free space < 4 Gb").

The part "string_substring(oid("1.3.6.1.2.1.25.2.3.1.3.1"),0,2)" of the error line, will give you the disk name (f.e. C:) in the problem column of the services screen from the device. The whole message text looks like: "Disk 1 (C:) free space < 4 GB"

You should also pay attention to the fact, that if you have a diskette drive, this drive is typically disk 1. If you take a look at the "Snmp" screen of the device and switch to "Storage" you see all the disks and the memory. I use this order to find out the disk number.

I know it is not the best way to have - for example - 5 probes to check 5 disks and if there are changes to edit 5 probes, but unfortunatelly it is not possible to use the probe name in functions. With this feature you would be able to write a function which uses the probe name as parameter for some values. For example probe name: "Disk 1, 2Gb". The function then will use "1" as disk number and "2" for the space value.

But maybe the MikroTik people will implement this feature in future

@breazer: Sorry I have no experience in checking ports of switches, I only use the Dude for checking server hardeware and their services.

ittsmith · Thu Dec 18, 2008 5:13 pm

Toepfe,
Thanks for your help. I just need percentage full, not actual threshold of a specific GB value so I combined a previous thread with some of the more advanced features you showed me regarding displaying the C: or D: in the error message as such:

NAME: Disk1UsedSpace

AVAILABLE: if((oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100>0, 1, -1)

ERROR: if((oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100<80, "", concatenate("Disk 1 (", string_substring(oid("1.3.6.1.2.1.25.2.3.1.3.1"),0,2), ") used space is currently at (", string_substring (oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100 , ") % "))

VALUE: (oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100

UNIT: %

RATE: none

Note that I used your previous concept of displaying the value in the ERROR line which is not only useful for troubleshooting but for determining how critical the percentage full really is. I do have a couple of questions.
Did I need string_substring in there? I cheated and just borrowed your example and morphed it to my own and (after tons of replacing parentheticals and quotes) massaged it so it works.
Is there a manual that shows what all the parameters for AVAILABLE and ERROR are? For example, the second set of quotes in ERROR is acting as a placeholder, but for what? Or in the AVAILABLE what is the 0,1,-1 at the end? I'm assuming these are LOGICAL operators but would love to know where to find a list of all the combinations.
In regards to my disk percentage number, is there a way to get that to display in the interface? Right now when my circle turns orange, it simply tells me that disk1usedspace is the problem, but I would think I could get it to say the % as well.

Finally, and I think you answered this in your previous post but I didn't understand the answer, is there a way to make an NAME:Alldisksusedspace check whereupon we use arrays to look at all disk percentages, and if any of them is over 80% used it alerts? I went and made disk1, disk2, disk3, and disk4 alerts and apply them as appropriate since I needed to get this up and running, but I really don't care WHAT disk flags as an alert for me. Whichever one flags will cause me to have to investigate, so that is why I wonder if i can use some type of array concept.

Thanks for your help, it was very educational and I couldn't have created the above code snippets without your posts. Enjoy.

Toepfe · Sat Dec 20, 2008 12:44 pm

@ittsmith

Thanks for your answer and the nice words, but I also copied and learned a lot from the comments in this forum and of course in this thread. At the moment I'm on vacation and have no Dude installation to check my following answers against the "reality"

NAME: Disk1UsedSpace

AVAILABLE: if((oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100>0, 1, -1)

ERROR: if((oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100<80, "", concatenate("Disk 1 (", string_substring(oid("1.3.6.1.2.1.25.2.3.1.3.1"),0,2), ") used space is currently at (", string_substring (oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100 , ") % "))

VALUE: (oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100

UNIT: %
RATE: none

Did I need string_substring in there?

The function "string_substring" you may use basically with string variables. With "concatenate" you can put them together.

So for the calculation in your probe:
...string_substring (oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1"))*100...
you won't need string_substring
...oid("1.3.6.1.2.1.25.2.3.1.6.1")/oid("1.3.6.1.2.1.25.2.3.1.5.1")*100...
should give you the same outcome.

Is there a manual that shows what all the parameters for AVAILABLE and ERROR are? For example, the second set of quotes in ERROR is acting as a placeholder, but for what? Or in the AVAILABLE what is the 0,1,-1 at the end? I'm assuming these are LOGICAL operators but would love to know where to find a list of all the combinations.

I suppose - not the best documentation - is the price we have to pay for this great piece of software

For my share I misinterpret the AVAILABLE line at the beginning. First I thought only if the AVAILABLE line is true, the ERROR line will be done. But with some tests I saw that this is wrong. Somewhere I read it will be used for the DISCOVER function. But to your questions:
AVAILABLE line: 1 = true, 0 = false (1 = available, 0 = not available)
ERROR line: "" is the same as "ok". Any other value I tried would be interpreted by Dude as a problem and the service/device gets orange. Sometimes it also was a problem that "nothing" is ok for the Dude. In the past I have constallations where Dude thinks everything is ok, only because a check gives back nothing.
"-1" sometimes you will get when using functions (f.e. execute) and there is an error. To find out what is wrong then, is the tricky thing

In regards to my disk percentage number, is there a way to get that to display in the interface? Right now when my circle turns orange, it simply tells me that disk1usedspace is the problem, but I would think I could get it to say the % as well.

That should be possible. Adamd292 showed a similar example a few posts above. I also changed the outfit of devices on the map. They show additional the uptime of the device. I may give you proper information when I'm back in the office after Christmas.

Finally, and I think you answered this in your previous post but I didn't understand the answer, is there a way to make an NAME:Alldisksusedspace check whereupon we use arrays to look at all disk percentages, and if any of them is over 80% used it alerts? I went and made disk1, disk2, disk3, and disk4 alerts and apply them as appropriate since I needed to get this up and running, but I really don't care WHAT disk flags as an alert for me. Whichever one flags will cause me to have to investigate, so that is why I wonder if i can use some type of array concept.

You must be mistaken, I haven't wrote an probe/function which checks the status of all disks together. But it is an interesting idea. Maybe something for 2009

... and here we are: MERRY CHRISTMAS AND A HAPPY NEW YEAR TO ALL OF YOU!!!

uglyoldbob · Wed Jan 07, 2009 8:00 am

I saw a post mentioning a probe for dhcp servers, but was unable to get any meaningful results from it. Does anybody know how to make such a probe?

windfall · Tue Jan 27, 2009 11:10 am

Hello,
did not work. Have any other way for probe disk "c", "d', "e" ...

Tue Jan 27, 2009 11:15 am

"did not work" is a very vague statement. tell us in more detail, what did you put where, an what happened. also post some screenshots of your attempts

pjulian · Tue Jan 27, 2009 12:35 pm

This will return how many wireless stations are registered against an AP
Hopefully somebody can use this, I think I borrowed some code from somewhere else, credit given where credit is due.

if(oid("1.3.6.1.4.1.14988.1.1.4.4.0")>0,concatenate(array_size(oid_column("iso.org.dod.internet.private.enterprises.mikrotik.mikrotikExperimentalModule.mtXRouterOs.mtxrWireless.mtxrWlRtabTable.mtxrWlRtabEntry.mtxrWlRtabStrength"))," Wireless Clients"),"")

Regards
Paul

windfall · Wed Jan 28, 2009 11:25 am

Hello Normis,
Appended some screenshots:
my problem is this:

... Thank you!

windfall · Wed Jan 28, 2009 11:27 am

here used a program to see my OIDs. The configuration is correct?

pjulian · Wed Jan 28, 2009 11:48 am

I'm confused by this, in the example you show a device which has a probe for Disk 2 according to the error, however the example probe you have shown is for a Disk 1 probe ?

The text you have in the brackets after the Disk number is the result of the string_substring from your error field in the probe, make sure you are checking the correct OID at that point, perhaps in the correct probe there is a typo for the OID and it's reading the first 2 characters of some other OID which is giving you the correct drive letter in the brackets on your error line.

Regards
Paul

Wed Jan 28, 2009 11:48 am

"utilization" is not "free space" but "used space"

maybe that's the problem?

windfall · Wed Jan 28, 2009 1:34 pm

Not is this. The disk has more than 4GB free and that "Re"?
Isnt probe "C" or "D"...

windfall · Wed Jan 28, 2009 1:39 pm

So Paul, but the disc 1 is not the floppy? I dont understand.

Toepfe · Wed Jan 28, 2009 3:48 pm

Hi,

@windfall: In my case the disk check for free space in GB works good. I am also a little bit confused about the "Re" what you get.

Try to give back more characters with the following Error line in the probe:

if((((((oid("1.3.6.1.2.1.25.2.3.1.5.2")-oid("1.3.6.1.2.1.25.2.3.1.6.2"))*oid("1.3.6.1.2.1.25.2.3.1.4.2"))/1024)/1024)/1024)>4, "" , concatenate("Disk 2 (", string_substring(oid("1.3.6.1.2.1.25.2.3.1.3.2"), 0, 20), ") free space < 4 Gb"))

With the above line you get up to 20 characters of the "Re"... OID value. Maybe then we see the whole phrase and it is easier to find the error.

As far as I see from your screenshots at least the OID values for the drive letters should be ok.

Bye

pjulian · Wed Jan 28, 2009 10:54 pm

windfall, what I was saying is that in your example you are looking for the drive letter for disk 1 based on the OID you have in the error field of the probe, which is fine, however the actual error you are showing in the screen shot from the device is showing text indicating you are checking for disk 2 with that probe, it says disk 2 in the error message.

Regards
Paul

windfall · Thu Jan 29, 2009 10:16 am

Hello staff
really made a mess, but managed to fix with help from you!!!

Thanks.

Toepfe · Thu Jan 29, 2009 3:04 pm

Hi,

The way how I check with the Dude, if logon to SAP server with SapGui is possible. I have created this check, because sometimes it happens that the SAP server is reachable via ping, and also some typical processes are running, although it is not possible to login via SapGui.

For the check you need an additional command line tool which you may download direct from SAP. It is called sapinfo.exe and is included in the RFC package. At the moment I use the version which is included in the package RFC_14-20001763.SAR. After unpacking the archive you will get a "bin" folder. I copied all the files from the bin folder to an extra folder (C:\Programme\DUDE\sapinfo) of our Dude installation folder.

In the Dude device configuration, the SAP server are called with their application host name. Additional I put the sysnr to custom field 1.

sap_check01.jpg

Function
Name: check_sap_as
Code:
array_element(execute("sapinfo.exe", concatenate("ashost=", device_property("Name"), " sysnr=", device_property("CustomField1")), "C:\Programme\DUDE\sapinfo"), 0)

Probe
Name: SAP
Type: Function
Agent: default
Available: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "disp+work.exe")>0, 1, -1)
Error: if(check_sap_as()=0, "", "SAP logon not possible")
Value: 1
Unit: running
Rate: none

Bye

adamd292 · Fri Jan 30, 2009 1:29 am

Probe: tnsping
Type: function
Monitor database availability using tnsping located on The Dude server, using a database name stored in Custom Field 3.

Available: if(string_size(device_property("CustomField3"))>0, 1, 0)
Error: if(array_element(execute("tnsping.exe", device_property("CustomField3"), "c:\oracle\product\11.1.0\client_1\bin"),0), "down", "")
Value: if(array_element(execute("tnsping.exe", device_property("CustomField3"), "c:\oracle\product\11.1.0\client_1\bin"),0),0,1)
Unit:
Rate: none

You have to install the Oracle client on the Dude server to make this work, and adjust the path in the function to where Oracle is installed. Put the Oracle SID in CustomField3 and the probe will work.

pjulian · Tue Feb 10, 2009 12:44 pm

Thanks to a number of people on this forum I have managed to finish a group of functions and probes to monitor disk free space both in MB and in % free for Windows Servers based on the drive letter rather than the disk number. I needed to do this as we monitor a number of servers with differing drive configurations and did not want to have to be specific as to which drive number was C: etc, rather just reference the drive by the drive letter.

These functions and probes can obviously be modified to look at whatever drive letter you want to just by changing the drive letter in the code.

Thanks again to the people who help put this together, you are awesome ! and I hope that this information can be of value to other users.

Please note that this is based on V3.1 of The Dude.

Functions
Function:
Name: win_diskc_free
Description: Disk C free space in megabytes
Code:
if(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:")<>4294967295,

round(((oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageSize.",
array_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_substring(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),",",
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
-string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"
)
)))+1))*4096)/1024)/1024)

-

round(((oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageUsed.",
array_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_substring(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),",",
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
-string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"
)
)))+1))*4096)/1024)/1024)

,
""
)

Function:
Name: win_diskc_free_percent
Description: Disk C free space in percent
Code:
if(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:")<>4294967295,

string_substring(((
oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageSize.",
array_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_substring(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),",",
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
-string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"
)
)))+1))*4096

-

oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageUsed.",
array_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_substring(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),",",
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
-string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"
)
)))+1))*4096
)

/

(
oid(concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageSize.",
array_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_substring(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
(
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),",",
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
-string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"
)
)))+1))*4096
))

*100
, 0, 4)

,
""
)

Probes

Probe Name: win_diskc_free
Available: if(win_diskc_free() > 500, 1, -1)
Error: if(win_diskc_free() < 500, concatenate("Low Disk Space C: ", win_diskc_free(), " MB Free"), "")
Value: win_diskc_free()
Unit: MB
Rate: None

Probe Name: win_diskc_free_percent
Available: if(win_diskc_free_percent() > 10, 1, -1)
Error: if(win_diskc_free_percent() < 10, concatenate("Low Disk Space C: ", win_diskc_free_percent(), " % Free"), "")
Value: win_diskc_free_percent()
Unit: %
Rate: None

Regards
Paul

Wed Feb 11, 2009 6:31 pm

Awesome work pjulian I knew it was possible just didn't have time to delve into it.

adamd292 · Thu Feb 12, 2009 3:08 am

Thank you Paul.

This has saved me heaps and heaps of time.

I have used your functions and I'm very happy.

I made one improvement to the percent function.

Since (total-used)/total is the same as 1 - (used/total)

The percentage function can be rewritten as:
Name: win_diskc_free_percent
Description: Disk C free space in percent
Code:

if(
  string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:")<>4294967295,
  string_substring(
    (
      1
      - oid(
        concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageUsed.",
          array_find(
            oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
            string_substring(
              oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
              string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
              string_find(
                oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
                ",",
                string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
              - string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:")
              )
            )
          +1)
        )
      / oid(
        concatenate("iso.org.dod.internet.mgmt.mib-2.host.hrStorage.hrStorageTable.hrStorageEntry.hrStorageSize.",
          array_find(
            oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
            string_substring(
              oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
              string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
              string_find(
                oid_column("1.3.6.1.2.1.25.2.3.1.3",600),
                ",",
                string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"))
              - string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:")
            )
          )
        +1)
      )
    )*100, 
    0, 
    4)
  ,
  ""
)

pjulian · Sun Feb 15, 2009 10:29 am

No probs, I too knew there must have been a way to do it, but thanks to help from the forum it wouldn't have been possible

Great rewrite on that function, there is sure to be some improvements to be made, but this function alone makes things so much easier for windows server management. Our biggest issues were our VMWare servers, they don't have floppies, we wanted to be able to just add probes onto a device without worrying which drives it had or didn't have, then just remove the ones with errors, plus obviously these functions can be used raw to display in labels of devices.

Now just to migrate all of my current V2.2 setup to 3.1, what a pain in the butt, only about 60% of things export/import, I have to manually redo the rest....

Regards
Paul

windfall · Mon Feb 16, 2009 12:45 pm

Morning Guys,
I have a challenge. I need a check to verify within a folder that a file has been created between any given time, eg, between 05:00:00 and 05:01:00.

I accept suggestions

my mail: gelsonalves@gmail.com

Tue Feb 17, 2009 11:40 pm

When 0 is not true... I have been looking closely at my CiscoCPU function and wondering why I can't make it report correctly. I believe the dude is seeing a 0 returned for CPU utilization and converting that to a false reading instead of graphing it. The function can't get any simpler...

error: if(oid("1.3.6.1.4.1.9.2.1.57.0"), "", "CPU down")

With this setting if the utilization is 0 the function complains that the CPU is down... Any other thing I have tried has resulted it the probe thinking that the OID returned a value. For example if I make the error in the examples below they report the cpu is up even for 0 utilization but then the cpu is up when the device is not even on the network... I think I must be doing something wrong but the function is so simple at this point...

error: if(oid("1.3.6.1.4.1.9.2.1.57.0")<>"", "", "CPU down")
error: if(oid("1.3.6.1.4.1.9.2.1.57.0")>=0, "", "CPU down")

Can anyone explain how to fix this or what I am doing wrong?

Thanks
Joe

windfall · Thu Feb 26, 2009 11:33 am

Good morning.
Is there a way to probe web pages?
There is a probe for http, but only the door, I want to probe a URL. For example:

http://www.mywebsite.com/files/index.asp

stmx38 · Tue Mar 10, 2009 2:45 pm

pjulian thanks a lot. it is very nice probe.
but i needed one moment
when probe is error dude sent mail with space avaliable:
Error - if(win_disk_C_free() < 500, concatenate("Low Disk Space C: ", win_disk_C_free(), " MB Free"), "") ||

How to change
Available - if(win_disk_C_free() > 500, 1, -1) - to view disk space avaliable when probe in now up.

Available - if(win_disk_C_free() > 500, concatenate("Disk Space C: ", win_disk_C_free(), " MB Free"), "") - this not work for me.

omega-00 · Mon Mar 16, 2009 1:29 am

Hello all,

Was working on a simple hotspot user count function to be part of a graph similar to the one shown in (http://www.tiktube.com/?video=206) but obviously monitoring hotspot rather than pppoe.

The function is simple, just

ros_function("/ip hotspot active print count-only")

but in practice the polling of it only works for a couple of hours then stops probing and gives no results.

If I modify the query (for example using the line above as a script on the router and calling the script in the function instead) I can get it displaying results again but sure enough after a couple of hours it just stops again.

The other graphs I have on my chart (snmp ones) continue to function with no problem.

any ideas? Am running Dude 3.1 and polling an RB1000 running 3.20

breazer · Wed Mar 18, 2009 7:03 pm

Hi
Does any one know how to monitor the status of a route.
For example route discovered via eigrp changes.

Regards
Breazer

Wed Mar 18, 2009 10:24 pm

Hey Breazer

I think monitoring EIGRP would be neat to do with The Dude. I have not thought of trying it. I have not seen how to fire an event on a syslog update. Does the dude accpet syslog from other devices? I don't know if there is an SNMP entry you can track to see if EIGRP changes but...

What we do where I work is run a program called SEC - simple event correlator http://kodu.neti.ee/~risto/sec/. The thing is there are lots of really good log messages and SEC is designed to handle these type of events.. If you have a linux syslog server working your half way there. If not well it will take a day or so to get the whole thing working.

We created a bunch of regular expressions that identify specific syslog messages... Things like a failed power supply, when a configuration file changes, when an EIGRP route changes, when a reload was requested or when a reload is at a later time and when a device reloaded etc. We have been adding to this file over time to fix holes when we wern't notified of an important syslog message like our 6509 environment freaked out so we added the environment messages for those events.

Here is the SEC Regular expression entry for EIGRP.
# EIGRP Neighbor
type=Single
continue=takenext
ptype=regexp
pattern=^\w+\s+\d+ \d+:\d+:\d+ (\S+) (?:\d+: )+\w+\s+\d+ (\d+:\d+:\d+\.\d+): %DUAL-5-NBRCHANGE: IP-EIGRP$0$ (\d+): Neighbor (\S+) \S+ is (\w+): (.+)
desc=EIGRP Neighbor Change - $1: at $2 AS($3) Neighbor: $4 State: $5 : $6
context= ! Neighbor_Changed
action=create Neighbor_Changed 120 report Neighbor-Change \
/bin/su - -c '/bin/mail -s "Neighbor Change Report" mailuser' sec ; \
delete Neighbor-Change

type=Single
continue=dontcont
ptype=regexp
pattern=^\w+\s+\d+ \d+:\d+:\d+ (\S+) (?:\d+: )+\w+\s+\d+ (\d+:\d+:\d+\.\d+): %DUAL-5-NBRCHANGE: IP-EIGRP$0$ (\d+): Neighbor (\S+) \S+ is (\w+): (.+)
desc=EIGRP Neighbor Change - $1: at $2 AS($3) Neighbor: $4 State: $5 : $6
action=add Neighbor-Change %s

# Representative log file entries:
# Oct 11 14:48:30 router1 614651: Oct 9 06:32:44.352: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 192.168.255.209 (Serial0/0) is down: peer restarted
# Oct 11 14:48:30 router1 614651: Oct 9 06:32:48.951: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 192.168.255.209 (Serial0/0) is up: new adjacency
# Oct 11 14:48:30 router1 000019: Oct 2 21:21:07.450: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 192.168.5.22 (GigabitEthernet9/1) is resync: peer graceful-restart
# Oct 11 14:48:30 router1 000020: Oct 2 21:22:55.370: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 192.168.5.22 (GigabitEthernet9/1) is down: Peer goodbye received
# Oct 11 14:48:30 router1 000024: Oct 4 13:53:44.085: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 192.168.5.22 (GigabitEthernet9/1) is down: holding time expired

So any time a syslog message arrives on our syslog server with the match to the regular expression SEC fires the ACTION line an email with those log file entries is mailed to mailuser from sec. I can say it has been a really great tool.

It would take me a while to scrub our cisco.sec file so if you want the entire file let me know...

Good Luck with what ever you decide to try...
SD

Fri May 01, 2009 1:05 am

EDIT UPDATE!!! - AFTER much trial and error I have to report that the bottom probe was incorrect. Gsandul gave me the fix. I am putting both here for reference... The new Function is Returns False if it can't read the cpu which is very helpful for the error line of the Probe.

Function
name Cisco_cpu_func
if(array_size(oid_column("1.3.6.1.4.1.9.2.1.57", 10 ,29)), oid("1.3.6.1.4.1.9.2.1.57.0", 10, 29)+1 ,"False")

Probe
name: cisco_cpu
type: function
available: Cisco_CPU_a() <> "False"
error: if(Cisco_CPU_a()<>"False",if(Cisco_CPU_a() < 60, "", concatenate("Warning: high CPU =", Cisco_CPU_a(), "%")), "Failed read")
Value: oid("1.3.6.1.4.1.9.2.1.57.0", 10, 29)
Unit: %
Rate: none

------------------------------------------------------
The old broken probe is still here for your amusement...
Ok so the very first post in this thread is about Cisco CPUs and that is the only probe I use on all my cisco devices. Since I am pinging from another system and I am recording bandwidth graphs I am certainly testing them to see if they are up. The trouble was I built it like the original post. Eventually I was getting false positives because some CPUs were reading 0% utilization, Then I changed my error so the if cpu was >=0 and that worked but there was a new problem. If I put Cisco CPU on a non cisco device or if the device was actually down my cpu probe would still show as up. I had wondered what I could do to fix it. You might have seen the question eariler when 0 is not zero. Anyhow I finally fixed it by examining the built in CPU function and copying that. This works perfectly, It will show CPU as down and wont get installed automatically on boxes that do not have a cisco cpu. I also made one for checkpoint. You have to build both a function and a probe...

ciscocpu.JPG

checkpointcpu.JPG

I will be watching to see if changing my probe into both a function and a probe solves the problem where graphing becomes sporadic.

pjulian · Tue May 26, 2009 5:31 pm

Good idea checking for the array size, that is probably a must have for a number of functions really.

Slech, sorry for my delay replying, have been busy and not back here for a little while, I will check that out for you and see what I can sort out.

regards
Paul

pjulian · Tue May 26, 2009 5:43 pm

Hello all,

Was working on a simple hotspot user count function to be part of a graph similar to the one shown in (http://www.tiktube.com/?video=206) but obviously monitoring hotspot rather than pppoe.

The function is simple, just
Code: Select all
ros_function("/ip hotspot active print count-only")
but in practice the polling of it only works for a couple of hours then stops probing and gives no results.

If I modify the query (for example using the line above as a script on the router and calling the script in the function instead) I can get it displaying results again but sure enough after a couple of hours it just stops again.

The other graphs I have on my chart (snmp ones) continue to function with no problem.

any ideas? Am running Dude 3.1 and polling an RB1000 running 3.20

Omega, I had this problem also and decided to just monitor the qty of wireless clients connected which seems to be a pretty indicative figure for the hotspot users. Obviously if you need to do non-wireless hotspot connections this will not help.

I just used this code for the connected clients

[if(oid("1.3.6.1.4.1.14988.1.1.4.4.0")>0,concatenate(array_size(oid_column("iso.org.dod.internet.private.enterprises.mikrotik.mikrotikExperimentalModule.mtXRouterOs.mtxrWireless.mtxrWlRtabTable.mtxrWlRtabEntry.mtxrWlRtabStrength"))," Wireless Clients"),"")]

Regards
Paul

Wed Jun 17, 2009 7:06 am

I have been trying to resolve the issue where I want to graph while something is out of range. Like if CPU gets too high I still want to graph it. Hopefully they change how graphing works but for now you can do this... I have slightly improved the probe that complains. It reports as down if CPU is not available. So I have two functions to track the CPU on my Cisco devices.

Make a function to do the work...

func.PNG

To graph the CPU as long as it is up...

cpu1.PNG

To complain if the CPU is high...

cpu2.PNG

So to read the error line in plain english...
Iif the CPU is not equal to 0 or if the CPU is greater than 60 report a CPU Problem.

The problem I had was it would not complain that the CPUHigh probe was down if the device was down. So things that were completely down still had high CPU saying it was working fine. That is now fixed in the new CPUHigh probe.

I have fixed that. Note I don't graph with the CPUHigh probe, I only graph with the regular CPU probe that way as long as you can read the CPU it will graph. Hopefully they will change this soon so it just tries to graph even in an "error" state.

jjmil03 · Wed Jun 17, 2009 3:04 pm

Dell temperature alert if it gets over 95

available
if(oid("iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3")>0, 1, -1)

error
if(oid("iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3")<350, "", "Over Temp 95")

value
iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.3
C
none

I don't quite know if this is right or not. When I type this in, it works, but when I try to trip it by setting the 350 in the error line to 100 or 50 or even 1000, it still says ok when it should fail. My question is with the syntax. If I am reading this correctly, then for the error line is says " if "OID" < (is less than) 350, ""(don't know what this part means), "Over Temp 95". If that is true then, shouldn't it use the other sign (>), so it reads "greater than?" Also, I have found that on my system, the OID is a little different than what you have, i.e. iso.3.6.1.4.1.674.10892.1.700.20.1.6.1.1. Has anyone else tried this? Thanks!

jjmil03 · Wed Jun 17, 2009 5:04 pm

Sweetdude,

on your last post you said, "Note I don't graph with the CPUHigh probe, I only graph with the regular CPU probe that way as long as you can read the CPU it will graph." Don't understand how you are telling The Dude not to graph something as opposed to if you do graph. Also, my graphs give me between 0 and 1. Is there a way to change this so I can see 0 -100. My switches flux depending on time of day and the graph isn't showing that at all. thanks!

Jon

Wed Jun 17, 2009 9:00 pm

Hi Jon,

You will want to remove "graph poll times" on each device service combo that you don't want to graph for. AFAIK there is not a global do not graph this service setting. SO to configure it on each device, Select device, settings, click on services tab, Double click on the service you do not wish to graph, click on the history tab, remove the check for graph poll times.

I didn't think of this at the time but you could remove notification for the graphing probe since it is just for graphing and the problem reporting probe will notify you. Right now I have both probes complain when a device is completely down, twice as many emails!!! bleh!!!

To graph percentage, On the probe change "unit" from ms to %.
Actually the graph will graph everything with the same unit name on the same graph. For example on my temperature and humidity graphs I put "total" in the unit name.

SD

Wed Jun 17, 2009 10:42 pm

Testing a web page... I have not done this until yesterday and it works great. I noticed someone ask how to build an HTML probe. It was easy.

Here is a Probe that requests data from a server, the server has a SQL backend.
This is a public web page but the names have been changed to protect the guilty

html.PNG

The neat thing about this is the receive text string. It is just some text on the web page that is actually text from the result from the query. If I put some arbitrary string in the receive field the probe fails (connection closed). I don't know if it will report as down if the sql backend is down but that is what I am hoping for. Our server looks to take about 400-500ms to return this page. I reduced the polling to 1 minute instead of the default 30 seconds.

When I deliberately put some incorrect string in the result the probe notified me that "propertysearch" was down. So far so good

SD

nhcxl · Thu Jun 18, 2009 1:00 pm

Help!I hope get counter of all running programm that name is match condition.How?
array_find only find out the first match running programm,but not all.such as:
I hope can get counter of svchost.exe in a running computer system.
How??

jjmil03 · Thu Jun 18, 2009 6:20 pm

I have a few questions for all the veteran "Dudes" out there concerning the creation of custom probes. Here below is a pic of a simple probe that comes with The Dude:

probe2.jpg

Here are my questions:

In the "Available" line, what does the closed parenthesis "()" do exactly?
The "Error" line is where I have the most trouble. The way it is written in the picture above, it states the following:

if(virtual_mem_size() > 0, "", "down")

So in my mind, I read it as such:

If "Function" is greater than 0, """"(?), "Down"

So:

I understand that we are looking at the "virtual_mem_size" function. Still don't know what the parenthesis mean. Have no clue what the closed quotes do """", and the last is the display message if the error argument is found to be true. The other misunderstanding I am having is with the argument itself. The virtual memory should be greater than 0, so why aren't we using the < (less than) sign? I think it may be somthing to do with the code or how I am perceiving it. I have no knowledge of code or arguements...I remember some of this briefly in a math class here and there, but I have no clue really. If anyone has any info on it that I can ask Googles for (I pluralize "Google" for my amusement...

) I would appreciate it.

In some of the posts above I have copied and pasted into my probes. The problem comes with when I test them to see if they work. (not that I don't trust you guys, but I always have been taught to "trust but verify

", and it helps me learn...) For example, in an earlier post someone created a Dell Temp Probe that is supposed to go off when it gets too hot. EXACTLY one of the things I wanted to do! I edited the number after doing an SNMPwalk to see what the temp was, and set the error arguement to go off at a number that was below the current reading. It didn't trigger the alarm though...which it should have if my argument is set for anything above 200, and the server is reporting its temp at 250.

If there is a post anywhere that answers these questions than I am sorry. I've looked at most of the posts pretty hard lately. I would also like to thank all of you who do answer these things. I know you all have much better things to do, but you guys are what makes using this program so much easier and fun, and I thank you all for the help. I'm about 4 days deep in using The Dude, starting with "What is SNMP?" and NO clue what a MIB is, and now have everything in my network mapped, configured for SNMP, and drawn out already, so I am just trying to get that last 10 percent that will make it a truely great tool. For me, its the little minute things like having it tell me when things get too hot, or CPU rate too high, and stuff like that. I have seen a lot of examples in the posts so I am just trying to get those to work for me, then use the knoweldge to create some custom probes to then share in here! Thanks in advance for your help!!!!

Thu Jun 18, 2009 10:41 pm

Hey Jon, how's your dude installation coming along?

I should have rewrote the wiki

To find out how any statment works open Functions tab and look for the indvidual statements.

When you look at the "if" function the description is:
"first parameter - condition, second - returned if condition yields logical true, third - returned otherwise"

So... if (xy, true, false) And when you look at a probe the error line says "if the return string is empty the service is assumed up"
Therefore if(a=b ,retun "nothing" , else return "error a<>b").

Now lets plug some oid information in. Lets say a snmp get for your OID is "25" and you want to complain if the OID is above 20....

if 25 is less than 20 = not true = value too high.
if( OID < 20, "" , "too high")

Then your oid drops below 20...
if 19 is less than 20 = true = "".

You will notice if you have read the entire probe thread that some time ago people were putting
if(x,"",-1) on the available line but the -1 is not handled correctly so it doesn't work. Changing it to if(x,"",0) fixes this problem.

[edit had logic backwards

added more detail]
HTH
SD

Thu Jun 18, 2009 11:48 pm

Help!I hope get counter of all running programm that name is match condition.How?
array_find only find out the first match running programm,but not all.such as:
I hope can get counter of svchost.exe in a running computer system.
How??

I can't think of any way to do it. The method below doesn't seem any good, I have never seen "regular expressions" or variables used in functions...

Stick this on the device label to see if cvd.exe is running.
[array_element(oid_column("1.3.6.1.2.1.25.4.2.1.2"), array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"),"cvd.exe"))]

jjmil03 · Fri Jun 19, 2009 12:07 pm

Success!!

At least so far. I have a Cisco High Temp Probe and a Cisco High CPU Probe working. I also added the OID to my appearances so I can monitor them as well. The only thing now is the chart. The chart on the Y-Axis is from 0 - 1. For the CPU, it should be 0-100, or at least high enough to show how it is running. Currently, my switches are running between 10 - 40 percent depending on the time of day. I would like to see that graphically, over time, so I know if things are spiking and what not, as well as to plan for the future. Is there any way to tell it to do that? Does it have something to do with the probe? Thanks for all the help, its looking REALLY good!

Jon

Fri Jun 19, 2009 6:50 pm

Hey Jon,

I think your probes are not set to unit %. Open your Cisco Cpu probe and look near the bottom, find the "unit" box and put % in it. I just added a few CPUs to the chart and they are showing the correct values up to 40 right now not between 0 and 1.

Once your done building your chart you will want to use a panel to view it. Open "panels" on the left. Add a new named panel Cisco CPUs and save it, open the new panel by double clicking on the name in the list under panels. On the top right of the new panel you will see a drop down box that is "unknown" open that and pick your cisco cpu panel from the charts list. Now you have a panel based on your chart. There is a good reason for this. You can add the legend and every time you open it from the panel view you will see the legend. To show the legend Right click on the open Cisco CPUs panel, select legend, select left. Now every time you use this panel view the legend will be there on the left. Very handy

Good to hear you are getting things working. Truly an amazing piece of software.
SD

jjmil03 · Sat Jun 20, 2009 3:29 pm

probe3.jpg

Here is my probe setup for my Cisco CPU. When I hover over the switch, I see a chart that pops up, and on the Y-Axis it is between 0 and 1. That is the chart I am speaking of. I haven't created any type of custom chart. Any ideas? I have set my function up correct as well, I added the same OID to my appearances so I can see the CPU load, I would like to see the chart work though...thanks!

Jon

PS What do the parenthesis do that are beside the Function?

jjmil03 · Sat Jun 20, 2009 5:06 pm

Sweetdude,

After re-reading your post and messing with a few things, I think I might need to clarify what exactly I am looking for. I have all of my switches on my map. When I hover over them, I would like to see a chart with its associated graph, displaying the cpu and thermal reading properly. I went and messed around with the panels b/c you mentioned them in your last post. I was able to create a new data source , an snmp oid type, and using the OID for the Cisco CPU, it produced a chart that was correct. That is nice, but I would like it to show up on the map when I hover over it, which leads me to believe that there might be something messed up with the way my function is set up, although I am not sure. Here is the code that I used:

array_size(oid_column("1.3.6.1.4.1.9.2.1.57.0"))

Is that correct? I am pretty sure my probe is correct, in the pic above I forgot to put the parenthesis in the Error argument next to the function. That was corrected and shouldn't be an issue. I don't wish to create a custom chart or anything, I just want the chart that dispays when hovering over an object to work correctly. If it has something to do with the panels than great! I just thought that was for something else. Thanks again!

pjulian · Sat Jun 20, 2009 5:17 pm

To get the graph to show when you hover over it you need to add it to the device as a probe not just as a graph.
It has to actually be a service for that device.

Regards
Paul

jjmil03 · Sat Jun 20, 2009 5:35 pm

OK, more playing, lol!!!

***Paul, I have the probe added as a service, so when I hover over the switch it does show me a chart...it is just that the Y-Axis is 0-1 instead of showing what it should, between 10-40 which is the range that my switches run. Thanks for the help though!!

On a whim, I changed the code in my function to just oid("X.X.X.X..."). I waited a minute or so for everything to reprobe and the charts all came back correct. So I guess I have a few questions...

What does the array_size and oid_column actually do? They messed up something, or I messed something up when I wrote them or with the oid....do you have those commands in your functions and they still work (I did read the descriptions, just a little vague to me is all...)?

I think I am going to try a few more things here...after reading the descriptions of the 2 commands above I think it may be that I am drilling down to deep with my oid...I am putting in the exact oid for the number I want to return...maybe that is why it isn't working. Still T/S ing, so any ideas please throw them my way!

Jon

pjulian · Sat Jun 20, 2009 5:41 pm

Jon, from memory array_size returns the number of characters in the array, the "size" of it, and oid_column returns an array of the items in that column.

For example, normally you would do a search in an oid_column for a particular item and then read the value of that item.

For example:
string_find(oid_column("1.3.6.1.2.1.25.2.3.1.3",600),"C:"),
Will return whether or not the string "C:" is in the oid_column specified.

Regards
Paul

jjmil03 · Mon Jun 22, 2009 3:05 pm

Have an updated probe for a Dell 1950 Server. This will monitor the Temp. From doing a SNMPWalk, I found that the ambient alert for these servers is 420, which is when the server LED screen turns orange. 470 is upper critical, which is where I assume the server turns itself off. That is why I have it set for 420 on the probe. The pound sign seems to allow the graph to do its thing as well. Below is the Function and the Probe.

dell1.jpg

dell2.jpg

Any questions let me know...

Jon

Mon Jun 22, 2009 5:47 pm

Hey Jon,

Sorry you confused me with chart which I probably further confused you with

It looks like you have CPU displaying correctly in the popup? So just for clarity lets call hovering on a device a popup where as charts are used to view several graphs at once. A panel is used to control the display of a chart. Both are on the left hand contents list. A popup shows the probe and graphs associated to a device.

The parentheses are used by the program to contain the oid value that is being retrieved. If you made a function called getoid to use it you have to supply the place holder for the value being returned, getstuff(). Like in the Dell Temp you have Dell_Temp(). It is the syntax...

Just to be clear if you were using "array_size(oid_column("1.3.6.1.4.1.9.2.1.57.0"))" as your CPU reader that was incorrect and you just needed "oid("1.3.6.1.4.1.9.2.1.57.0")" to grab the value stored in that specific OID. You only need array_size and other functions when your trying to do more complex stuff than reading a single OID.

When you get everything working put a picture of your map into the map thread!

HTH
Joe

jjmil03 · Thu Jun 25, 2009 4:17 pm

In my previous post I had created a fucntion for the Dell Temp reading. Come to find out that it wasn't working properly. I revised the probe function error line to the following:

Error: if(AND(Dell_Temp()<>"", Dell_Temp()<420), "", "Temp Problem")

This fixed it because before, with OR in the syntax instead of AND, no matter if it failed the argument for the temp reading at 420 or higher, it would still report up because it still returned a value. I will let you know how it works out.

Jon

flares2 · Mon Jul 27, 2009 9:51 pm

I've been using the Dude for about a month now and am very impressed, the Probe Thread has been very useful. One probe I am having trouble creating is for current bandwidth utilization, giving a notification at a ceratin percentage. Here's what I've done so far:

Using the idea that (InOctets + OutOctets)*8*100/ifSpeed gives the percentage of utilization I created the function:

Function
Name: Bandwidth
Code: (oid("1.3.6.1.2.1.2.2.1.16.21")+oid("1.3.6.1.2.1.2.2.1.10.21")*8*100/oid("1.3.6.1.2.1.2.2.1.5.21")

From there I applied this function to a probe

Probe
Available: Bandwidth()
Error: if(Bandwidth()<50, "", concatenate("Bandwidth Utilization is at ", array(Bandwidth()),"%")
Value: Bandwidth()
Unit:
Rate: none

The does work in the fact that it does return a percentage, and when that percentage is passed I receive an email stating that percentage has passed and it gives me what the current percentage is.

The two problems are that this percentage does not match up with the link status given by The Dude in the network map, nor does it line up with the percentage shown on the port in the switch's web based console. Second, because these OIDs are counters if I watch this in real time in The Dude, I can see the percentage start low and then get higher and higher for 90 seconds until the next poll interval when it drops and starts again. Is there a way for it to give an average of the poll interval to show more accurate data?

Tue Jul 28, 2009 12:59 am

Maybe they are using the other "HC" counters? 1.3.6.1.2.1.31.1.1.1.X But I don't think they do... but you may want to anyhow for 10gb

AND/Or Give this a shot since it looks more accurate!!
http://www.flukenetworks.com/fnet/en-us ... EtherScope

HTH
SD

Edit; I still don't know how you determine your "TIME", you need to calculate how many packets over a given peroid to determine % of utilization. You may be able to divide by 30 to get the average utilization over the 30 seconds between each probe interval? But if the octet counter just counts up you need to know what the values were 30 seconds ago as well.

jredmond · Fri Jul 31, 2009 4:48 pm

I am new to The Dude. The software seems to monitor most of what I want but I have come across a few situations I can not monitor. One of them is the Barracuda Spam Firewall 300 I inherited. No SNMP on this low end version but the information is available from http://cuda.ip/cgi-bin/stats.cgi

This returns the following:
0 0 43 1 140 34 75 3957 26 7177 31 7445743 3230 5287 9481 235651 7989954 4851 0 4 9 83 4999 438 0 1 1 14 454 58 0 677 0 0 2 52 31 0 578 0 0 1 37 0 0 507 0 0 1 29 0 0 454 0 0 1 36 0 0 480 0 0 0 32 0 0 340 0 0 8 25 0 0 380 0 1 0 18 34 0 468 0 0 2 6 42 0 480 0 1 2 6 0 0 353 0 0 0 7 0 1 433 0 0 0 10 0 0 443 0 0 0 6 0 0 399 0 0 2 6 0 0 362 0 0 0 2 0 0 350 0 0 0 0 0 0 437 0 0 0 1 0 0 386 0 1 1 2 0 0 433 0 0 0 5 0 0 467 0 0 0 0 0 0 415 0 0 1 4 0 0 474 0 0 2 6 0 0 473 0 1 2 19 52 0 611 0 1 2 30 0 0 438 0 1 1 14 359 1 9146 0 0 1 59 35 3 9073 0 0 4 66 300 0 9973 0 0 30 398 110 0 8544 0 4 42 531 169 0 9578 0 2 41 442 445 4 10113 0 5 66 570 165 1 9656 0 5 24 397 137 2 9868 0 6 4 26 203 20 9207 0 5 5 54 142 17 10050 0 7 26 325 100 0 9308 0 2 30 491 205 6 10208 0 12 43 411 166 1 10539 0 3 64 391 141 1 10368 0 7 34 306 261 14 9303 0 3 9 63 180 1 8264 0 3 12 106 240 2 10569 0 4 42 422 0 3 9331 0 3 32 425 201 12 9735 0 4 44 429 124 2 9709 0 6 35 467 135 1 10502 0 9 21 355 125 0 9344 0 7 8 71 73 3 8467 1 2 6 63 347 0 10509 0 6 21 346 193 3 9061 0 4 31 390 43 1 10810 0 1 23 366 405 1 11300 0 5 27 413 52 0 4846 0 4 9 83

A bit of comparing this data with the stats screen in the unit and the fields are able to be guessed. eg: field 11 is the temp in Celsius (31).

Is there a way to parse the individual fields out to create probes for this information?

Thanks for any help.

JR

flares2 · Mon Aug 03, 2009 9:43 pm

Thanks for the tip Sweetdude. The algorithm from Fluke gave more stable numbers, yet they still didn't line up with the bandwidth usage reflected by the Dude or the Optiview.

To get the bandwidth displayed in the links between devices the Dude uses the delta of sent/received octets multiplied by 8 averaging over each second of collected data.

Is there no way use that same formula in a function or probe?

Tue Aug 04, 2009 12:02 am

To get the bandwidth displayed in the links between devices the Dude uses the delta of sent/received octets multiplied by 8 averaging over each second of collected data.

Nice to know and I have often wanted to alert on high and or zero utilization but it is not obvious how to do it, like you are finding out.

I looked into data sources but they look like this "serial0/0 (2) @ router1 tx" and I don't know how you would use one in a function or a probe...
Maybe you can figure out how to use a data source in a probe?

All data sources can be seen by selecting chart, make a chart if you don't have one, click on + to add a new chart line then click on the edit all data sources (the "..." button). In there you can see a list of "interface @ devicename tx or rx" which is where I assume that you discovered how exactly the builtin source works.

flares2 · Tue Aug 04, 2009 5:30 pm

I think we're on the same page Sweetdude. The source code for the Data Source is below. What's racking my brain is that the source code for Probes is almost exactly the same, including the type, id, name, dataID, etc. The only real field that the Data Source has that a probe is missing is the data type.
Though the common consensus around the web is to measure bandwidth by using ((InOctets+OutOctets)*8/Port Speed*100*Polling interval), this fails because the counter does not roll over at each polling interval. To get an accurate reading you need the difference between the counts at the beginning and the end of that interval, ie you need the Delta!
I'm thinking theres two routes of getting this to work. First would be to modify the exported config in a fashion that the probe includes the Data Source and then map that back to the Data IDs in the Round Robin Data. Or, try to find a way to export the counter and then export it again after the polling interval and create a function to get the delta that way.
If I'm out in left field someone let me know, but I can't accept the idea that if the Dude can, in real time, display on the Map or on a Chart the bandwidth usage that it can't be reported/alerted on. I'm striving so hard on this because once I get a formula together for bandwidth usage, this same formula can be applied to any oid using counters.

- <DataSource>
<sys-type>41</sys-type>
<sys-id>105901</sys-id>
<sys-name>A1 (1) @ sw-data-center tx</sys-name>
<dataIDs>105896, 105897, 105898, 105899, 105900</dataIDs>
<type>builtin</type>
<dataType>delta (difference per period)</dataType>
<scale>8.000</scale>
<unit>bit</unit>
<average>second</average>
</DataSource>

Wed Aug 05, 2009 7:10 pm

Yeah that would be a heavy mod of the dude XML and who knows how it would later affect upgrades and such. We really just need the devs to just add support for notification on bandwidth and/or let us work directly with the bandwidth graphing functions in probes. I have considered doing things like modifying the rrd settings for interface graphs directly in the XML then reimporting it so it will keep the intervals longer but I don't want to break my setup

Time to ask for another feature and wait some more. The real solution and I hope they eventually do is to make the product GPL License and let the community fix and add all the things that are missing. They have an army of people that want many things added and it could all be done for free.

flares2 · Fri Aug 07, 2009 4:55 pm

Thought I was onto something. If you do an SNMP Walk and right click on an OID, the option to create Data Source is there and when opening that you see the default is Gauge (Absolute Value) which implies to me that's the value of the counter. You can change that option to Delta to get the difference in polling, but I can't seem to apply this Data Source to the probe. I even went into the source code and found the service with the ProbeID and DataSourceID, changing the DataSourceID to the newly created Data Source, but after importing that back in, it still is looking at the Absolute Value.

Tue Aug 11, 2009 1:20 am

Yeah that is how you make charts which are very nice to look at but you can't generate a notification from a chart counter ;(
These are all the functions I tried today.
This seemed promissing... I figure I will have to add packets later to make it more accurate.
rate(((oid("1.3.6.1.2.1.2.2.1.10.1")+oid("1.3.6.1.2.1.2.2.1.16.1"))*8*10000/oid("1.3.6.1.2.1.2.2.1.5.1")),30)
I multiplied by 10k so the very tiny utilization would at least show up.

This gives a high spike... every once in a while doesn't correlate with utilization.
rate((oid("1.3.6.1.2.1.2.2.1.10.5007")+oid("1.3.6.1.2.1.2.2.1.16.5007")),30)

trying this for a little while. will see how it goes.
rate((bitrate(oid("1.3.6.1.2.1.2.2.1.10.5007"))+ bitrate(oid("1.3.6.1.2.1.2.2.1.16.5007"))),30)

You know you can place something like this directly on a device label to see the actual value...
[rate((bitrate(oid("1.3.6.1.2.1.2.2.1.10.5007"))+ bitrate(oid("1.3.6.1.2.1.2.2.1.16.5007"))),30)]
The above one gives the exact same number as rate with out the bitrate number conversion.

flares2 · Tue Aug 11, 2009 5:41 pm

Yeah, I looked into the Rate function and figured it would be a big help, maybe I'm doing something wrong because any time I use that function the result is 0. I tried the same formulas you listed and each one with the Rate function just shows zero in the device label.

Fri Sep 11, 2009 12:33 am

Finally after hours of jacking around with the formula I have what seems like an accurate utilization indicator.
Function:
utilizationG0 - Return total utilization on g0/0
string_substring((((rate(oid("1.3.6.1.2.1.2.2.1.10.1")+oid("1.3.6.1.2.1.2.2.1.16.1"))/oid("1.3.6.1.2.1.2.2.1.5.1"))*100)*8),0,4)

This will return the utilization on interface g0/0 of a cisco 2800 router.
You will need to place the correct oid in the function to get utilization on other interfaces.

I also verified it against the actual mbps and the individual rx and tx load percentage... Now you can easily use it to send a notification if utilization is over a certain value with a probe. The only trouble is you have to hand make each function for the interface you are interested in.

Here are the individual tx and rx probes for comparison...
string_substring((((rate(oid("1.3.6.1.2.1.2.2.1.16.1"))/oid("1.3.6.1.2.1.2.2.1.5.1"))*100)*8),0,4)
string_substring((((rate(oid("1.3.6.1.2.1.2.2.1.10.1"))/oid("1.3.6.1.2.1.2.2.1.5.1"))*100)*8),0,4)

utilization.jpg

the value of 1.06 for rx is ~ = 10.4 mbps which would be 1.04% utilization
the value of .13 for tx is ~ = 1.3 mbps which would be .13% utilization
the value of 1.19 is tx and rx added together but calculated seperately and came up with the correct total...
The reason the link speed and the utilization label are slightly off is they are being collected a few seconds apart.

Keep in mind that a full duplex interface is actually capable of twice the speed if you use "total utilization" to create notifications. Total utilization should be able to go to 200 max or you migth want to devide the entire formula by 2. I think I would use rx and tx seperately then generate seperate notifications.

pjulian · Fri Sep 11, 2009 2:18 pm

Very nice, quite a useful piece of information there, thanks.

Regards
Paul

tristan.bolton · Tue Sep 15, 2009 7:12 pm

Hey,

I'm trying to create a probe that monitors a function and considers it "down" if the value changes from the last probe.

So if I'm monitoring Function "X" and it is replying with the number 2 then the next time the probe checks Function "X" and the number is 3 or 1 then it considers it down and pages the technician.

Also if I use the same probe on another device and the first time it runs Function "X" it get the number 5, so I now want it to page me if that number ever changes.

I have the function working, just can't see how to make a probe compare current results with the last result.

Thanks for the help!

Wed Sep 16, 2009 1:21 am

Can you post your current probe? What is the device the probe is working on? A cisco switch or a UPS? Maybe someone with the same type of device can help or even wants the same probe

edit: OTOH you can create a probe to expect one value and if it changes it will notifiy, snmpwalk the device you are wanting the probe for, select the oid, right click and select create probe - the problem here is this creates a probe to verify that the result is equal to X only and doesn't compare the previous result with the current.

Otherwise you might be able to use rate and generate an error based on some formula... You could create two probes one that notifies if the rate changes up and one for changes down.

This goes back to we need to learn how to use variables in probes if they exist or they need to add a variable so you can just assign your oid to a variable and test instead of dreaming up new ways to do things...

tristan.bolton · Wed Sep 16, 2009 3:13 am

Hey,

I'll show what I'm doing right now.

I have a function that monitors my OSPF Neighbor's

Function
Name: NC
Code: ros_command("/routing ospf neighbor print count")

Probe

I know the probe isn't really doing anything right now. I'm just not 100% sure how to write the check.

Thanks for your help

Mon Sep 21, 2009 5:48 pm

Yeah, I see what your trying to do now. Sorry for the delay on the reply took some time off.

The trouble I see is that you may have 3 ospf paths on one router and 2 on another so you will need to make a few probes instead of one that does everything.

You will be able to use one function for the probes though.

So create as many probes as you need and manually add them based on the number of OSPF routes that the command returns.
For example you have a router with 2 OSPF routes and a router with 3 OSPF routes. So on the 2 OSPF router you would put the probe named ospf_two for the router with 3 OSFP routes place the probe named ospf_three on it.

For the probe named ospf_two on the error line put;
if (NC() < 2, "", "route missing")
For the probe named ospf_three on the error line put;
if (NC() < 3, "", "route missing")
and so on...

Sure I have not tested this so the formula/systax may be incorrect but I think you get the idea.

HTH
SD

tristan.bolton · Mon Sep 21, 2009 7:50 pm

Hey,

Yea, I thought about doing it that way. Not the most pretty way of doing it but it works.

It would be nice if there was a way to create a probe and for it to check the value based on the previous check.

Oh well, I'll do it that way for now.

Thanks

oakie · Thu Oct 01, 2009 2:38 pm

Hi, may be stupid question, but how to create probe to test running ntp server? I mean network time protocol, not nntp - Network News Transfer Protocol (this probe is already prepared in dude). Of course, i know that UDP, port 123, but what should be in send/receive columns? Thanks for help ...

sutjipto · Fri Oct 02, 2009 12:28 pm

Yes, same question here, how can we add a new probe for checking running NTP (Network Time Protocol) service in Dude ?
Is it correct, just by using a Connect Only service check on TCP Port 123 ?
(If using UDP, there is no option for Connect Only check)
Please advise, thank you.

Mon Oct 05, 2009 5:53 pm

Here try this... [edit] This worked on a Cisco 2800 router and not a 6509. it doesn't seem to work on a windows server. Probably need more of the actual protocol in the send message to get it to work with other devices. I'll work on it some more later.

ntp.png

HTH,
SD

oakie · Mon Oct 05, 2009 6:03 pm

2 sweetdude - thanks, seems functional

ArielGonz · Sat Oct 17, 2009 12:56 am

We use a Cisco 2821 router to terminate our T1 PRI on Serial0/3/0. I was interested in graphing the usage of this line, to determine how many of the 23 channels were in use during the day. Some of the webpages that helped me were:
PRI usage SNMP
Equivalent MIB Objects for VoIP show Commands
Voice Call Tuning

--- Function---
Name: calls_active
Code: array_size(oid_column("1.3.6.1.4.1.9.9.63.1.3.1.1.1"))

--- Probe ---
Available: calls_active() > -1
Error: if(calls_active() > -1, "", "down")
Value: calls_active()
Unit: calls
Rate: none

I know some of these are a hack, such as the Available slot, but I don't know how to determine if the router has a voice connection available or not.

gsandul · Mon Oct 19, 2009 1:51 pm

Hi, ArielGonz
You should use different oid
Check this
http://tools.cisco.com/Support/SNMP/do/ ... icked=true
if you wish to count for every DS1 (PRI line)
or this
http://tools.cisco.com/Support/SNMP/do/ ... 0.19.1.1.4
if you wish to count for total active DS0 on all DS1's

ArielGonz · Mon Oct 19, 2009 6:06 pm

Gsandul,

For some reason, both those OIDs always return 0 for me. Maybe my PRI is configured differently? Here are some of the relevant lines from the running config:

network-clock-participate wic 3
network-clock-select 1 T1 0/3/0
!
controller T1 0/3/0
 framing esf
 linecode b8zs
 pri-group timeslots 1-24 service mgcp
!
interface Serial0/3/0:23
 no ip address
 isdn switch-type primary-ni
 isdn incoming-voice voice
 isdn map address 011* plan unknown type unknown
 isdn bind-l3 ccm-manager
 no cdp enable
!
voice-port 0/3/0:23
!

Thanks for the information though!

Mon Oct 19, 2009 7:07 pm

@ArielGonz

Cisco has a bug, in the 2800 code, on a 3945 it works just fine but on the 2800 the OID returns 0.

They didn't say they were going to fix it. The only oid returned is for the first t1 card in the box.
If you can move the card in the router then you can get it.

I have done what you are trying to do and you can put the total calls on the label of the router (in the appearance for the device).
Active Calls: [oid("1.3.6.1.4.1.9.10.19.1.1.4.0")]

There is probably a way to programatically count the calls but I have not tried it.
I didn't have time to do a full writeup but here is the oids from my 3945.
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.1.0")]
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.1.1")]
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.2.0")]
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.2.1")]

And the two oids from the 2800
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.0.0")] - ds1
Calls:[oid("1.3.6.1.4.1.9.10.19.1.1.9.1.3.0.1")] - ds1
There are 2 more cards in the 2800 but doing an snmp walk starting from 1.3.6.1.4.1.9.10.19.1.1.9.1 only has the first card where the 3945 shows all of them...

HTH,
SD

gsandul · Tue Oct 20, 2009 9:21 am

ArielGonz
I have 5 Access Servers 5350 and 5400 with many E1 PRIs, and it works fine for all of it.
I do not have 28xx at the moment, so, can not help

All I can say, my AS function like PSTN gateways, not as a Call Manager Express

Prewest · Sun Oct 25, 2009 6:53 pm

probes/functions for HP laserjet printers which warns when the specified toner reaches 15% or less:

function:
name: toner1
code: string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.1")/oid("1.3.6.1.2.1.43.11.1.1.8.1.1"),0,4)*100

probe:

name: HP Printer toner 1
available: toner1()
error: if(toner1() > 15, "", "Toner Zwart @ 15%")
value: toner1()
unit: %

same goes for toner 2 / 3 / 4 where the last number of the OID specifies the toner number.
toner 3 OID will be: 1.3.6.1.2.1.43.11.1.1.9.1.3 & 1.3.6.1.2.1.43.11.1.1.8.1.3 which you will have to change in the function.

toner 1 = black
toner 2 = cyaan
toner 3 = magenta
toner 4 = yellow

code for displaying it on the map in %:

Toner Zwart: [string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.1")/oid("1.3.6.1.2.1.43.11.1.1.8.1.1"),1,4)*100]%
Toner Cyaan: [string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.2")/oid("1.3.6.1.2.1.43.11.1.1.8.1.2"),1,4)*100]%
Toner Magenta: [string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.3")/oid("1.3.6.1.2.1.43.11.1.1.8.1.3"),1,4)*100]%
Toner Geel: [string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.4")/oid("1.3.6.1.2.1.43.11.1.1.8.1.4"),1,4)*100]%

COELPL · Wed Dec 16, 2009 11:51 pm

Hello guys. I have a little problem with Dude and ping probe. My network is big and little strange, but in most cases we are using static routing (forwarding) and AP and STATION modes. Pings between devices are good, but almost every first ping is much bigger than the rest. For example:

It's not so important, but we are using Dude and it show insane pings. Example:

Pings of that connection are above - stable 2ms.

Any ideas? I don't want to change anything in my network. First-ping-issue doesn't bother me at all, but I want to change ping probe in Dude. Any ideas? Maybe somebody can help me?

Best regards from Poland,

Kuba

PS. We have about 2000 devices in our network. About 120 MT devices, the rest are in most cases linux Wisp routers. There are at most 50-60 devices in each subnet, no PC's, only routers nad switches.

Thu Dec 17, 2009 1:35 am

Thanks to gsandul for posting how to get the description of the interface in the notification when an interface goes down... I am just copying it from another post.

<?xml version="1.0" ?>
<dude version="3.4">
<Function>
<sys-type>57</sys-type>
<sys-id>1345886</sys-id>
<sys-name>If_1_Status</sys-name>
<code>oid_raw("1.3.6.1.2.1.2.2.1.8.1")</code>
<descr>**** Check the status of interface number 1</descr>
</Function>
</dude>

<?xml version="1.0" ?>
<dude version="3.4">
<Function>
<sys-type>57</sys-type>
<sys-id>1345962</sys-id>
<sys-name>If_1_Descr</sys-name>
<code>oid("1.3.6.1.2.1.2.2.1.2.1")</code>
<descr>**** Description of an interface</descr>
</Function>
</dude>

<?xml version="1.0" ?>
<dude version="3.4">
<Probe>
<sys-type>13</sys-type>
<sys-id>1345894</sys-id>
<sys-name>If_1_Status</sys-name>
<typeID>8</typeID>
<functionAvailable>If_1_Status()</functionAvailable>
<functionError>if (If_1_Status() = 1, "", concatenate(" Warning Interface ", If_1_Descr(), " is down"))</functionError>
<functionValue>If_1_Status()</functionValue>
</Probe>
</dude>

Note: You should create 2 functions and 1 probe for each monitored interface index.
it looks annoying if you have to monitor many oids, but you can change oids and funtions names directly in XML and then copy-paste it in functions or probes.

You also may avoid second function, then the probe will look like
<?xml version="1.0" ?>
<dude version="3.4">
<Probe>
<sys-type>13</sys-type>
<sys-id>1345894</sys-id>
<sys-name>If_1_Status</sys-name>
<typeID>8</typeID>
<functionAvailable>If_1_Status()</functionAvailable>
<functionError>if (If_1_Status() = 1, "", concatenate(" Warning Interface ", oid("1.3.6.1.2.1.2.2.1.2.1") , " is down"))</functionError>
<functionValue>If_1_Status()</functionValue>
</Probe>
</dude>

If a function probe doesn't work you can try OID_RAW !!!
oid("1.3.6.1.2.1.2.2.1.8.1") it returns string "up (1)"
oid_raw("1.3.6.1.2.1.2.2.1.8.1") returns 1

Thanks again gsandul excellent work.

gmsmstr · Mon Dec 28, 2009 9:09 pm

What about connecdtions on a specific port ?

Mon Jan 04, 2010 11:37 pm

And more detail on making good probes...

First when creating a new probe if you are using auto discovery of services you should always use a function in the availability line to determine if the OID exists on the device you are discovering. Otherwise the probe will get added to devices that don't even have that specific OID.

Next you might need to and/or some other values to correctly detect issues. For example;
My previous APC UPS load probe would never be detected as down.

Many hand made probes probably have this issue.
If the OID is being tested as less than some value it will never be detected as down since nothing is less than 95.
The following error line will not be detected as down when the device is down.
if(oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")<95,"",error)

This is not the case when an OID is being tested as greater than since nothing is not greater than 95.
if(oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")>95,"",error)

So when trying to make sure something is less than and is not blank or down use the following style in your error line.
if(and(oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")<>"", oid("1.3.6.1.4.1.318.1.1.1.4.2.3.0")<95), "","UPS Load trouble")
in english - if oid is not blank and not less than 95 report trouble...

Here are screen shots of the fixed function and probe.

funcload.png

load.png

HTH
SD

Networkolator · Fri Jan 15, 2010 5:24 pm

Hi everyone,

I'm new to the Dude too and I'm trying to set up the win_diskc_free_percent probe as defined by pjulian Feb.10.2009 in this thread. I have the SNMP community defined correctly and I can do an SNMP walk from The Dude to my servers. I created the function exactly as pjulian describes and same for the probes. Doesn't work for the MB or % probe. It applies the probe but always shows as 'down' for all servers meaning the disk space is low even though it is not. I'm using The Dude v3.5 and have all Dell poweredge servers.

Can anyone shed some light on why this isn't working for me? I would be very appreciative.

Thank you!

BTW - very cool tool this Dude, if only I can get this working...

marcopolo · Thu Feb 04, 2010 2:53 pm

Hi everyone,

I'm new to the Dude too and I'm trying to set up the win_diskc_free_percent probe as defined by pjulian Feb.10.2009 in this thread. I have the SNMP community defined correctly and I can do an SNMP walk from The Dude to my servers. I created the function exactly as pjulian describes and same for the probes. Doesn't work for the MB or % probe. It applies the probe but always shows as 'down' for all servers meaning the disk space is low even though it is not. I'm using The Dude v3.5 and have all Dell poweredge servers.

Can anyone shed some light on why this isn't working for me? I would be very appreciative.

Thank you!

BTW - very cool tool this Dude, if only I can get this working...

Me too, cool probe by Julian, though I guess you would need to identify the oid for your servers, right?. Since it didn't matter what device used the probe, everything failed when they indeed had 40GB free

I'm in the same boat as you, but also trying to fathom which oid to pickup from the snmpwalk

Thanks,

Mark

Biggz · Fri Feb 26, 2010 12:50 pm

The previous win_discc_free function works fine for me.

The server that I am connecting to is Windows Server 2003 R2. I'll try it with a Windows 2008 server and report back.

blackpaw · Tue May 04, 2010 11:06 am

Because I was tired of running after printers that run out of toner and/or paper (and people calling me for not fixing this) I created the following probes/functions to help me with that :)
Monitoring toner and paper levels for me and warning me if one drops below 10% (the paper level has only 5 sensors, it seems, 100,75,50,25 and empty but even that helps (see attachment for appearance)

It even polls the name of the Toner/Paper tray by SNMP and puts it in the Error Description so you can use it in automatic alarms (email, etc...)

first create some functions to poll the toner levels, paper levels and the maintenance kit's (drum) condition:

<?xml version="1.0" ?>
<dude version="3.6">
<Function>
<sys-type>57</sys-type>
<sys-name>toner1</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.1")/oid("1.3.6.1.2.1.43.11.1.1.8.1.1"),0,4)*100</code>
<descr>the first toner index for HP Laserjet and XEROX Workcentre (usually black)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner2</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.2")/oid("1.3.6.1.2.1.43.11.1.1.8.1.2"),0,4)*100</code>
<descr>the second toner index for HP Laserjet and XEROX Workcentre (usually yellow, for XEROX Phaser4510 it's the Maintenance Kit status</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner3</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.3")/oid("1.3.6.1.2.1.43.11.1.1.8.1.3"),0,4)*100</code>
<descr>the third toner index for HP Laserjet and XEROX Workcentre (usually magenta)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner4</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.4")/oid("1.3.6.1.2.1.43.11.1.1.8.1.4"),0,4)*100</code>
<descr>the fourth toner index for HP Laserjet and XEROX Workcentre (usually cyan)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>xerox_drum</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.24")/oid("1.3.6.1.2.1.43.11.1.1.8.1.24"),0,4)*100</code>
<descr>calculates the remaining life for the drum cartridge for XEROX Workcentre printers</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper1</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.1")/oid("1.3.6.1.2.1.43.8.2.1.9.1.1"),0,4)*100</code>
<descr>the first paper tray for XEROX workcentre (usually A3)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper2</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.2")/oid("1.3.6.1.2.1.43.8.2.1.9.1.2"),0,4)*100</code>
<descr>the second paper tray for XEROX workcentre (usually A4)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper3</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.3")/oid("1.3.6.1.2.1.43.8.2.1.9.1.3"),0,4)*100</code>
<descr>the third paper tray for XEROX workcentre (usually A4)</descr>
</Function>
</dude>

Now make the probes:

<?xml version="1.0" ?>
<dude version="3.6">
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_1</sys-name>
<typeID>8</typeID>
<functionAvailable>paper1()</functionAvailable>
<functionError>if (paper1() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.1") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.1") , ") is empty" ))</functionError>
<functionValue>paper1()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_2</sys-name>
<typeID>8</typeID>
<functionAvailable>paper2()</functionAvailable>
<functionError>if (paper2() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.2") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.2") , ") is empty" ))</functionError>
<functionValue>paper2()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_3</sys-name>
<typeID>8</typeID>
<functionAvailable>paper3()</functionAvailable>
<functionError>if (paper3() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.3") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.3") , ") is empty" ))</functionError>
<functionValue>paper3()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_1</sys-name>
<typeID>8</typeID>
<functionAvailable>toner1()</functionAvailable>
<functionError>if (toner1() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.1") , " has less than 10% remaining" ))</functionError>
<functionValue>toner1()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_2</sys-name>
<typeID>8</typeID>
<functionAvailable>toner2()</functionAvailable>
<functionError>if (toner2() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.2") , " has less than 10% remaining" ))</functionError>
<functionValue>toner2()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_3</sys-name>
<typeID>8</typeID>
<functionAvailable>toner3()</functionAvailable>
<functionError>if (toner3() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.3") , " has less than 10% remaining" ))</functionError>
<functionValue>toner3()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_4</sys-name>
<typeID>8</typeID>
<functionAvailable>toner4()</functionAvailable>
<functionError>if (toner4() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.4") , " has less than 10% remaining" ))</functionError>
<functionValue>toner4()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Xerox_Drum</sys-name>
<typeID>8</typeID>
<functionAvailable>xerox_drum()</functionAvailable>
<functionError>if (xerox_drum() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.24") , " has less than 10% remaining" ))</functionError>
<functionValue>xerox_drum()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
</dude>

To get it to show nicely on the map I put this into "appearance" instead of link levels:

[Device.Name]

Toner levels:
Black: [toner1()]%
Yellow: [toner2()]%
Magenta: [toner3()]%
Cyan: [toner4()]%

Drum Cartridge
Condition: [xerox_drum()]%

Paper Levels:
A3 white: [paper1()]%
A4 white: [paper3()]%
Corp Paper: [paper2()]%

The more I do with the Dude the more I love it!

Thanks to all the contributors! :)

gsandul · Thu May 13, 2010 1:46 pm

The function to display on device label UserName of user logged on a Windows Host.

You must know that:
1. There is no SNMP oid to check user logged on Windows host.
2. You can retreive UserName of logged user using WMI.
3. The Dude has not WMI support.
4. The Dude can run any executable file and retreive it's result using build in function execute.
5. It is easy to access any of WMI functions using simple VBScript.

Let put it all together and create sample function to retreive UserName of user logged on a Windows Host using WMI and put it on device label.

a) Crate script to access WMI and retreive Logged in User name.

'loggeduser.vbs
' Sample VBScript to discover which user is logged on
' Author Guy Thomas and John Eck
' Version 2.5 - December 2005
' -------------------------------------------------------'
'Modified by gsandul to logon to remote host using  
'username and password specified from command line 
'

Set objPassword = CreateObject("ScriptPW.Password")

'strComputer = "192.168.0.60"

'You can uncomment the following 3 lines and 
'specify hardcoded domain, username and password

'strDomain = "WORKGROUP" 
'strUser = "gsandul"
'strPassword = "SuperPass"


strComputer = wscript.arguments(0)

'If you hardcoded domain, username and password
'comment the following 3 lines

strDomain = wscript.arguments(1)
strUser = wscript.arguments(2)
strPassword = wscript.arguments(3)

Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator") 
Set objWMIService = objSWbemLocator.ConnectServer(strComputer, _ 
    "root\CIMV2", _ 
    strUser, _ 
    strPassword, _ 
    "MS_409", _ 
    "NTLMDomain:" + strDomain) 

' You suppose to be authentificated 
' Now you can write any WMI function 

Set colComputer = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")

For Each objComputer in colComputer
If not objComputer.UserName = "" Then
strLogonUser = Split(objComputer.UserName,"\")
strLogonUser(1) = UCase(Left(strLogonUser(1),1))& Trim(Mid(strLogonUser(1),2,20))
Wscript.Echo strLogonUser(1) 
Else
Wscript.Echo "No_one_is_logged"
End If
Next

' End of Sample Logged on VBScript

b) On The Dude server create dir C:\dudescr\ and save the code in file loggeduser.vbs
c) Try to run the script with command line args from cmd

cscript //NoLogo C:\dudescr\loggeduser.vbs IPAddress DomainName UserName Password

it should print username of logged user
d) Now edit device properties, to specify user with rights to access WMI on monitored host

deviceprop.JPG

e) Create the function User_Pass

concatenate(device_property("FirstAddress")," ",device_property("CustomField3")," ",device_property("UserName")," ",device_property("Password"))

userpass.JPG

f) Create the function Logged_User

array_element(execute("cscript.exe",concatenate("//NoLogo C:\dudescr\loggeduser.vbs ",User_Pass()),"C:\WINDOWS\system32\"),1)

Logged_User.JPG

g) Put it on device label
[Device.Name]
Logged user: [Logged_User()]
[device_performance()][Device.ServicesDown]

All done!!!!!

Note: you can use the same method to extend The Dude for WMI usage.

stmx38 · Fri May 14, 2010 3:38 pm

To see this in your devices:
Select device --> Right click --> Appearance --> Label --> Insert what you need from the following examples:

Cisco ASA 5510 - Performance

Cisco CPU Load

CPU Load 5sec /1min/ 5min: [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.3.1")] / [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.4.1")] / [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.5.1")]
Memory Free/Used:  [round((oid("1.3.6.1.4.1.9.9.48.1.1.1.6.1")/1024)/1024)]MB / [round((oid("1.3.6.1.4.1.9.9.48.1.1.1.5.1")/1024)/1024)]MB
Total Connections: [oid("1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6")]

Windows Performance and Services Status : CPU, Mem, Virt Mem, HDD | Up, Down
Windows Disk Space: Free/Total

Windows Performance and Services Status

[Device.Name] | [device_performance()]Up - [Device.ServicesUp] | Down - [Device.ServicesDown]

Windows Disk Space

Disk Space: C:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.1")*oid("1.3.6.1.2.1.25.2.3.1.4.1")/1024)/1024)/1024)] GB D:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.3")-oid("1.3.6.1.2.1.25.2.3.1.6.3"))*oid("1.3.6.1.2.1.25.2.3.1.4.3"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.3")*oid("1.3.6.1.2.1.25.2.3.1.4.3")/1024)/1024)/1024)] GB

gelsonalves · Thu May 27, 2010 7:49 pm

Like I do, using the "execute" function to test the connection to oracle using the command "sqlplus monitor / monitor @ p22" where "monitor" is the username and password. p22 proceedings of the database

When connected it gives me the following message:

----------------------------------
SQL * Plus: Release 8.1.7.0.0 - Production on Wed May 26 10:36:03 2010

(C) Copyright 2000 Oracle Corporation. All rights reserved.

Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

-------------------------------------------------- ---

BeOCeKa · Wed Jun 16, 2010 4:05 pm

TME Ethernet Thermometer by papouch.com
-----------------------------------------------------------------
Available: if(oid("1.3.6.1.4.1.18248.1.1.1.0")>0, 1, -1)
Error: if(oid("1.3.6.1.4.1.18248.1.1.1.0")<310, "", "Temperatur über 31°C")
Value: oid("1.3.6.1.4.1.18248.1.1.1.0")/10
Unit: C°
Rate: None

Shows the temperature and - in this example - get's red over 31 Degrees.
I am sad, that the graph will stop as long the value is above the error.

Fri Jun 18, 2010 12:50 am

BeOCeKa here is an improvement... hope you like.

Function
Name: ethtemp
Description: Returns false or the value in 1.3.6.1.4.1.318.1.1.1.2.2.4.0
Code: if(array_size(oid_column("1.3.6.1.4.1.18248.1.1.1" ,10 ,29)), oid("1.3.6.1.4.1.18248.1.1.1.0", 10, 29) ,"False")

Probe
Name: EthTemp
Type: Function
Available: ethtemp()<> "False"
Error: if(ethtemp()<>"False",if(ethtemp() < 31, "", concatenate("Warning: High Temp = ", ethtemp())), "Ethernet Temperature probe offline")
...

Notice the available line the function "ethtemp()<> "False"" to see if there is a value or if it can't read the value.
The great thing about this function/probe combo is the notification error message. The notification has both "High Temp" and and "Cant read Temp" if the OID is out of range or is not available, otherwise the probe is up and the device up. Another bonus is it tells you the temperature in the notification...

Lebowski

heybers · Wed Jul 14, 2010 3:43 pm

Hi Guys,

Hope someone can assist. Im looking for a probe to monitor ppp-oe connections on a router using SNMP.

I currently have SNMP working and can see the interfaces however I know need measure to monitor should one of these links go down?

Wed Jul 14, 2010 3:54 pm

Lebowski, it would be great if you could write a wiki article with screenshots on how to use advanced Functions and use them in Probes. It would be a nice addition to the beginner manual we have made. Some advanced examples would greatly help, and I see you understand them perfectly.

Wed Jul 14, 2010 6:08 pm

I have 3 articles in the wiki, getting started with functions and probes, a quick guide to a good probe and the before doing anything guide.

I need to add screen shots but can you modify the first post in this thread and give it a link to "a quick guide to a good probe"
It would be nice if people got started on the right food.

Thanks,
Lebowski

gelsonalves · Wed Aug 04, 2010 10:12 pm

Normis, can u help me? How to make a function that connects via FTP, passing username and password, then copy a file folder location to the destination user (PUT)?

Thu Aug 05, 2010 8:17 am

Normis, can u help me? How to make a function that connects via FTP, passing username and password, then copy a file folder location to the destination user (PUT)?

I do not know how to do that, maybe Lebowski or Gsandul can help

gsandul · Thu Aug 05, 2010 9:57 am

I do not know how to do that, maybe Lebowski or Gsandul can help

For sure, I can help, but I need to know what do you mean

function that connects via FTP

Just explain how do you plan to use it.

gelsonalves · Thu Aug 05, 2010 12:44 pm

Thanks Normis.
Good morning gsandul.
I own an FTP server and would like monitor no only the FTP server (port 21), but also user access and if there is permission of copy, because as it is a government agency, constantly users from other departments changed the password or permissions of the folders of certain FTP users and when the routine runs at the scheduled time we have problems. We would like using this function for recognize this problems in the ftp users.

Regards.

Thu Aug 05, 2010 4:56 pm

One way would be to write a script that controls some other FTP program.

Search the dude board for "Execute" and you will find examples on how to use it.
Recently there was a decent example of an SQL external and another external that did an SNMP Write.

I don't know if you can script the built in windows FTP server but you should be able to find one on the net...
If you need more help just ask.

gelsonalves · Thu Aug 05, 2010 5:07 pm

I already created an external agent to connect to Oracle database that returns a string, but in this case, involves users and passwords from other agencies and the security policy does not allow to be done this way. The ideal would be a function inside on the dude.

Thu Aug 05, 2010 6:35 pm

Sorry I don't know how to do that, I didn't get very far when I tried to build a FTP probe that actually just logged in.
Maybe Gsandul?

The problem for me is I don't know how to format the strings you can send and receive.
Is it just regular expressions or what? There are a few HTTP examples in the wiki and on the board.

gelsonalves · Fri Aug 06, 2010 2:52 pm

Are two functions.
First: To check if user can to connect to FTP server.
Second: The other to check if user can copy test file to the ftp server. Gsandul, can you help?

gsandul · Mon Aug 09, 2010 12:40 pm

There is no way to do it with The Dude TCP probe.
You can do it only with external script (you can run the script from dude, query SNMP OID on server to start the script, etc....).

in this case, involves users and passwords from other agencies and the security policy does not allow to be done this way. The ideal would be a function inside on the dude.

You should involve user and password in any case, so I do not see the difference in specifying password in a script and in The Dude. Specifying password in The Dude is not more secure, than specifying password in the script.

gelsonalves · Mon Aug 09, 2010 2:55 pm

How do I monitor a network link or server network traffic? Input and output?
like mrtg:

gelsonalves · Mon Aug 09, 2010 3:02 pm

I managed to make a probe that tests the connection ftp user, but it is also necessary to copy a file to test the write permission. In this case, there could be a function?

The use of external software like I said it is prohibited in the security policy information.

martix · Tue Oct 12, 2010 2:08 pm

With Dude 4 beta2 the "Logged User" Script/Function doesn't work anymore. Any ideas ?

gsandul · Wed Oct 13, 2010 2:01 pm

With Dude 4 beta2 the "Logged User" Script/Function doesn't work anymore. Any ideas ?

The code for Logged_User in 3.6 was:

array_element(execute("cscript.exe",concatenate("//NoLogo C:\dudescr\loggeduser.vbs ",User_Pass()),"C:\WINDOWS\system32\"),1)

In 4.0 Beta2 it should be:

array_element(execute("cscript.exe",concatenate("//NoLogo C:\\dudescr\\loggeduser.vbs ",User_Pass()),"C:\\WINDOWS\\system32\\"),1)

As you can see you should use \\ instead of \

EMOziko · Thu Oct 14, 2010 3:52 pm

When we will see next version of the Dude?

gr8boy · Wed Nov 10, 2010 5:25 pm

Cisco ASA 5510 - Performance

CPU Load 5sec /1min/ 5min: [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.3.1")] / [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.4.1")] / [oid("1.3.6.1.4.1.9.9.109.1.1.1.1.5.1")]
Memory Free/Used:  [round((oid("1.3.6.1.4.1.9.9.48.1.1.1.6.1")/1024)/1024)]MB / [round((oid("1.3.6.1.4.1.9.9.48.1.1.1.5.1")/1024)/1024)]MB
Total Connections: [oid("1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6")]

Windows Disk Space: Free/Total


Disk Space: C:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.1")*oid("1.3.6.1.2.1.25.2.3.1.4.1")/1024)/1024)/1024)] GB D:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.3")-oid("1.3.6.1.2.1.25.2.3.1.6.3"))*oid("1.3.6.1.2.1.25.2.3.1.4.3"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.3")*oid("1.3.6.1.2.1.25.2.3.1.4.3")/1024)/1024)/1024)] GB

I cant get Disk Space to work on my Dell server? I just copied the code and put it in device appearance, label... but it says Disk Space C:\=0/0 GB
Do I have to do any more configuration for this to work? SNMP is configured and OK.

Wed Nov 10, 2010 5:57 pm

See how I changed the last # in each of the OIDs from 1 to 2? That is the next drive in the system... Since this is hard coded the drive it is pointing to is incorrect for your server. The best way to see what OID your drive "C" is on is to start an SNMPwalk using the sub tree of 1.3.6.1.2.1.25.2.3.1.

C:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.2")-oid("1.3.6.1.2.1.25.2.3.1.6.2"))*oid("1.3.6.1.2.1.25.2.3.1.4.2"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.2")*oid("1.3.6.1.2.1.25.2.3.1.4.2")/1024)/1024)/1024)] GB

HTH
Lebowski

gr8boy · Thu Nov 11, 2010 1:34 pm

See how I changed the last # in each of the OIDs from 1 to 2? That is the next drive in the system... Since this is hard coded the drive it is pointing to is incorrect for your server. The best way to see what OID your drive "C" is on is to start an SNMPwalk using the sub tree of 1.3.6.1.2.1.25.2.3.1.

C:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.2")-oid("1.3.6.1.2.1.25.2.3.1.6.2"))*oid("1.3.6.1.2.1.25.2.3.1.4.2"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.2")*oid("1.3.6.1.2.1.25.2.3.1.4.2")/1024)/1024)/1024)] GB

HTH
Lebowski

Yes it worked! THANX!

drvcrash · Fri Feb 04, 2011 1:48 am

stupid question, how do you import those xml files in?

Because I was tired of running after printers that run out of toner and/or paper (and people calling me for not fixing this) I created the following probes/functions to help me with that
Monitoring toner and paper levels for me and warning me if one drops below 10% (the paper level has only 5 sensors, it seems, 100,75,50,25 and empty but even that helps (see attachment for appearance)

It even polls the name of the Toner/Paper tray by SNMP and puts it in the Error Description so you can use it in automatic alarms (email, etc...)

first create some functions to poll the toner levels, paper levels and the maintenance kit's (drum) condition:

<?xml version="1.0" ?>
<dude version="3.6">
<Function>
<sys-type>57</sys-type>
<sys-name>toner1</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.1")/oid("1.3.6.1.2.1.43.11.1.1.8.1.1"),0,4)*100</code>
<descr>the first toner index for HP Laserjet and XEROX Workcentre (usually black)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner2</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.2")/oid("1.3.6.1.2.1.43.11.1.1.8.1.2"),0,4)*100</code>
<descr>the second toner index for HP Laserjet and XEROX Workcentre (usually yellow, for XEROX Phaser4510 it's the Maintenance Kit status</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner3</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.3")/oid("1.3.6.1.2.1.43.11.1.1.8.1.3"),0,4)*100</code>
<descr>the third toner index for HP Laserjet and XEROX Workcentre (usually magenta)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>toner4</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.4")/oid("1.3.6.1.2.1.43.11.1.1.8.1.4"),0,4)*100</code>
<descr>the fourth toner index for HP Laserjet and XEROX Workcentre (usually cyan)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>xerox_drum</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.11.1.1.9.1.24")/oid("1.3.6.1.2.1.43.11.1.1.8.1.24"),0,4)*100</code>
<descr>calculates the remaining life for the drum cartridge for XEROX Workcentre printers</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper1</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.1")/oid("1.3.6.1.2.1.43.8.2.1.9.1.1"),0,4)*100</code>
<descr>the first paper tray for XEROX workcentre (usually A3)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper2</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.2")/oid("1.3.6.1.2.1.43.8.2.1.9.1.2"),0,4)*100</code>
<descr>the second paper tray for XEROX workcentre (usually A4)</descr>
</Function>
<Function>
<sys-type>57</sys-type>
<sys-name>paper3</sys-name>
<code>string_substring(oid("1.3.6.1.2.1.43.8.2.1.10.1.3")/oid("1.3.6.1.2.1.43.8.2.1.9.1.3"),0,4)*100</code>
<descr>the third paper tray for XEROX workcentre (usually A4)</descr>
</Function>
</dude>
Now make the probes:
<?xml version="1.0" ?>
<dude version="3.6">
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_1</sys-name>
<typeID>8</typeID>
<functionAvailable>paper1()</functionAvailable>
<functionError>if (paper1() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.1") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.1") , ") is empty" ))</functionError>
<functionValue>paper1()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_2</sys-name>
<typeID>8</typeID>
<functionAvailable>paper2()</functionAvailable>
<functionError>if (paper2() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.2") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.2") , ") is empty" ))</functionError>
<functionValue>paper2()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>paper_3</sys-name>
<typeID>8</typeID>
<functionAvailable>paper3()</functionAvailable>
<functionError>if (paper3() > 0, "" , concatenate("PAPER " ,oid("1.3.6.1.2.1.43.8.2.1.13.1.3") , " (", oid("1.3.6.1.2.1.43.8.2.1.12.1.3") , ") is empty" ))</functionError>
<functionValue>paper3()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_1</sys-name>
<typeID>8</typeID>
<functionAvailable>toner1()</functionAvailable>
<functionError>if (toner1() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.1") , " has less than 10% remaining" ))</functionError>
<functionValue>toner1()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_2</sys-name>
<typeID>8</typeID>
<functionAvailable>toner2()</functionAvailable>
<functionError>if (toner2() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.2") , " has less than 10% remaining" ))</functionError>
<functionValue>toner2()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_3</sys-name>
<typeID>8</typeID>
<functionAvailable>toner3()</functionAvailable>
<functionError>if (toner3() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.3") , " has less than 10% remaining" ))</functionError>
<functionValue>toner3()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Toner_4</sys-name>
<typeID>8</typeID>
<functionAvailable>toner4()</functionAvailable>
<functionError>if (toner4() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.4") , " has less than 10% remaining" ))</functionError>
<functionValue>toner4()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
<Probe>
<sys-type>13</sys-type>
<sys-name>Xerox_Drum</sys-name>
<typeID>8</typeID>
<functionAvailable>xerox_drum()</functionAvailable>
<functionError>if (xerox_drum() > 10, "" , concatenate(oid("1.3.6.1.2.1.43.11.1.1.6.1.24") , " has less than 10% remaining" ))</functionError>
<functionValue>xerox_drum()</functionValue>
<functionUnit>%</functionUnit>
</Probe>
</dude>

To get it to show nicely on the map I put this into "appearance" instead of link levels:
[Device.Name]

Toner levels:
Black: [toner1()]%
Yellow: [toner2()]%
Magenta: [toner3()]%
Cyan: [toner4()]%

Drum Cartridge
Condition: [xerox_drum()]%

Paper Levels:
A3 white: [paper1()]%
A4 white: [paper3()]%
Corp Paper: [paper2()]%

The more I do with the Dude the more I love it!

Thanks to all the contributors!

drvcrash · Sat Feb 05, 2011 6:35 am

never mind i figured it out, just not before i wiped out my whole map

EMOziko · Wed Feb 09, 2011 8:44 am

When we will see next version of the Dude?

???

Aikidokajeff · Mon Feb 21, 2011 3:53 pm

I've partially created a probe for displaying how many associated devices are on a Cisco Wireless access point.
It works but when the numbers gets to 0 it errors.

I've had a long weekend setting these devices (14) over a large area so I might be missing something very obvious.

I need it to return the number so I can graph it and not go orange/red whtn number of associations reaches 0.

any help?

Thanks.

Current setup:
Name: Num_Associations
Type: Function
Available: oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")=>0
Error: if (oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")<> "", "", "No Connections")
Value: oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")
Unit: *BLANK*
Rate: None

Aikidokajeff · Tue Feb 22, 2011 11:23 am

Again, solved it myself:

Name: Num_Associations
Type: Function
Available: oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")=>0
Error: if (oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")< "100", "", "No Connections")
Value: oid("1.3.6.1.4.1.9.9.273.1.1.2.1.1.1")
Unit: *BLANK*
Rate: None

So only if there are over 100 associations will there be an error.

EMOziko · Sun Mar 13, 2011 7:27 pm

I exported configuration from dude 3.6 and imported it to dude 4 beta 3.
Seems like everything works but there is one problem. On the map, my mikrotiks cpu and disk services is down and mikrotiks are yellow, but on snmp tab of settings there is correct information.

How can i fix this?

See screenshots:

screenshot6.png

gmichel · Tue Apr 12, 2011 3:19 pm

I'm trying to create a function that monitors file system manages the graphics and me them. "/","/ var"

Could someone help me posting here an example of how these functions do not know anything about mib, I'm kinda lost.

Thanks

steen · Sun Aug 28, 2011 2:38 pm

Hello Folks!

I try to make "ERRPT" on AIX environments trigger alarms.

I have been struggling to get "execute" to work, so far it did not work.

Situation is as follows, IBM VIOS and AIX servers need to be monitored on hardware level.
SNMP works great for other purposes, but not for this.

Inside all AIX system is the error reporter, to see hardware errors command errpt on AIX and ioscli errlog on VIOS need to be executed.

I did the following)
Function:
Name: errlog
Code: array_element(execute("C:\errpt.cmd"),1)

Probe:
Type: Function
Agent: default
Available: if(errlog()<1, "up", "down")
Error: if(errlog()>0, "", "down")
Value: 1

The script errpt.cmd:
@echo off
rem checking errorlog at VIOS
c:
cd "c:\Program Files (x86)\PuTTY\"
plink -load ivm -ssh "ioscli errlog | wc -l | sed 's/ //g'" >>%dir%
cd \
rem end errlorlog script

The script counts the number of lines in errorlog, if it is more than 0 lines we got a hardware problem and alarm should go off. (disk, ram, firmware, motherboard, fan, fibre channel etc.)

Running the script from command line in windows 2008 server works:
c:\>errpt.cmd
0

c:\>

And with errors:
c:\>errpt.cmd
3

c:\>

The 3 errors was generated by unplugging one SAN fibre cable.

Adding the probe to service of one VIOS server it immediate becomes red flagged, no matter what I do, if there is errors or not.

How do I make this work, I did try do redirect the output to a file, but the dude never executes the script.

How do I continue ?

Mon Aug 29, 2011 5:47 pm

@steen Do you want the first element?
Code: array_element(execute("C:\errpt.cmd"),0)

steen · Mon Aug 29, 2011 8:36 pm

@steen Do you want the first element?
Code: array_element(execute("C:\errpt.cmd"),0)

Yes! errpt.cmd delivers only one attribute, a number from 0-65535
I tries to change with ,0 for first element, it did not help.
It seems like the command is not executed, flag becomes red in services. :-/

Tue Aug 30, 2011 2:53 am

I put [execute("c:\test.bat")] on a device label and saw " -1,, " it seems like execute is broke! test.bat contained @echo 3

steen · Tue Aug 30, 2011 9:39 pm

I put [execute("c:\test.bat")] on a device label and saw " -1,, " it seems like execute is broke! test.bat contained @echo 3

Broke, bad. I am using Dude 3.6. How do I workaround it ?
I did also put my errpt.cmd on a label, same result -1,,

Tue Aug 30, 2011 11:03 pm

This worked on a device label!
[execute("test.bat",1,"c:\\")]

You can't put the path in the command and as above you need to escape the backslash for version 4.x I suppose...

steen · Wed Aug 31, 2011 9:49 pm

This worked on a device label!
[execute("test.bat",1,"c:\\")]

You can't put the path in the command and as above you need to escape the backslash for version 4.x I suppose...

Thanks, strange things start to happen, I run 3.6, I got the counter value out, but also error message about host does not exist.
When the script is executed from command line all works and no output about host does not exist arrives so that must come from dude. Any more suggestions ?

Wed Aug 31, 2011 10:49 pm

Not sure about the host thing but you did recognize you want the 2nd result? at least in 4.x it is the 2nd result.
array_element(execute("test.bat",1,"c:\\"),1)

steen · Thu Sep 01, 2011 9:42 pm

Not sure about the host thing but you did recognize you want the 2nd result? at least in 4.x it is the 2nd result.
array_element(execute("test.bat",1,"c:\\"),1)

I want the 1st result. Also I did try with 0 same result, flag is red.

Edddie · Tue Sep 06, 2011 10:54 am

This worked on a device label!
[execute("test.bat",1,"c:\\")]

You can't put the path in the command and as above you need to escape the backslash for version 4.x I suppose...
Thanks, strange things start to happen, I run 3.6, I got the counter value out, but also error message about host does not exist.
When the script is executed from command line all works and no output about host does not exist arrives so that must come from dude. Any more suggestions ?

strangely enough, since i too still continue cell phone spy software to experience that very problem. i tried to reinstall 3.6. but nothing made any difference..

michalf · Wed Oct 05, 2011 1:19 pm

Thnx for this great topic and all the info inside it.

I found problem with monitoring Windows services. Once upon a time, Netlogon service become Paused from Running service status and Dude in unable to discover this "failure".
Does anyone know how to solve/discover paused services ?

This works fine with stopped service, but not paused.
if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"Netlogon")>0, 1, 0)
if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"Netlogon")>0, "", "Netlogon not detected by SNMP probe")

gsandul · Thu Oct 06, 2011 3:00 pm

Hello.

This works fine with stopped service, but not paused.
if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"Netlogon")>0, 1, 0)
if(array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"Netlogon")>0, "", "Netlogon not detected by SNMP probe")

This will return service state

array_element(oid_column_raw("1.3.6.1.4.1.77.1.2.3.1.3"),array_find(oid_column("1.3.6.1.4.1.77.1.2.3.1.1"),"Netlogon"))

If it equals to 4 - service is in paused state.

hush · Fri Oct 07, 2011 12:34 pm

ARPing probe for windows using free hardping command line tool (placed in C:\WINDOWS folder on your Dude server) that no (local) device can hide from:

Name: ARPing
Type: Function
Agent: default
Available: if(string_find(array_element(execute("hardping.exe", device_property("FirstAddress"),"C:\WINDOWS"),1),"[")<80,1,-1)
Error: if(string_find(array_element(execute("hardping.exe", device_property("FirstAddress"),"C:\WINDOWS"),1),"[")<80,"","ARP timeout")
Value: device_property("ServicesUpCount")
Unit: ServicesUpCount
Rate: none

Thu Oct 13, 2011 1:16 am

If you have Cisco stack-able switches here is a function that checks the values returned by the monitoring oid (When a switch in a stack is "normal" it has 4 in the oid). I plan to expand on this next week.

Create a new function name it swinstk...

if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=9, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=36,"Good","9 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=32,"Good","8 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=7, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=28,"Good","7 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=6, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=24,"Good","6 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=5, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=20,"Good","5 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=16,"Good","4 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=3, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=12,"Good","3 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=2, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8 ,"Good","2 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=1, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4 ,"Good","1 Switch needs attention"),
"Problem reading Any stack"
)))))))))

Then in the probe
available
swinstk()="Good"
error line...
if(swinstk()="Good", "", concatenate("Stack trouble = ", swinstk()))

EDIT: I have found this probe is faulty, as usual with my first run stuff

the available line doesn't work and this probe will be "up" on any device. Although it does show an error when a switch stack is not working. To fix this I made a new function just for the available line.

Function isstack
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5)),"1","False")
Change the available line in the probe with the same error line from above.
available
isstack()<>"False"
Interestingly enough I tried multiple things in the available line and using not equals false works where equal good does not.

Enjoy,
Lebowski.

Wed Oct 26, 2011 8:42 pm

Here is the expand stack probe this probe first checks to see if every switch that is provisioned is online then it checks to make sure that every stack port is admin status up and operation status is up. This probe only works Cisco 3750 stack switches.

First create a function called swinstk add the following to it.
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=9, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=36,stk9prts(),"9 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=32,stk8prts(),"8 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=7, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=28,stk7prts(),"7 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=6, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=24,stk6prts(),"6 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=5, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=20,stk5prts(),"5 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=16,stk4prts(),"4 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=3, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=12,stk3prts(),"3 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=2, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8 ,stk2prts(),"2 Stack needs attention"),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=1, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4 ,1,"1 Switch needs attention"),
"Problem reading Any stack"
)))))))))

Then create 8 more functions named stk9prts to stk2prts.
The 9 port version of the function has 18 checks where the 2 port version has 4 checks. Paste the 9 port text below into the stk9prts function then create a stk8ports function with 2 less if statements. Make sure to put the 1 back on the last if. If all the pairs of OIDs are equal this returns 1 on the last if.

if(oid_raw("1.3.6.1.2.1.2.2.1.7.5180",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5180",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5181",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5181",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5183",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5183",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5184",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5184",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5186",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5186",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5187",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5187",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5189",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5189",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5190",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5190",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5192",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5192",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5193",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5193",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5195",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5195",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5196",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5196",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5198",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5198",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5199",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5199",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5201",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5201",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5203",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5190",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5189",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5189",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5190",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5190",10,5),1
,"Stack port 1 error")
,"Stack port 1 error")
,"Stack port 2 error")
,"Stack port 2 error")
,"Stack port 3 error")
,"Stack port 3 error")
,"Stack port 4 error")
,"Stack port 4 error")
,"Stack port 5 error")
,"Stack port 5 error")
,"Stack port 6 error")
,"Stack port 6 error")
,"Stack port 7 error")
,"Stack port 7 error")
,"Stack port 8 error")
,"Stack port 8 error")
,"Stack port 9 error")
,"Stack port 9 error")

Here is what stk5prts will look like.
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5180",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5180",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5181",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5181",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5183",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5183",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5184",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5184",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5186",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5186",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5187",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5187",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5189",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5189",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5190",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5190",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5192",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5192",10,5),
if(oid_raw("1.3.6.1.2.1.2.2.1.7.5193",10,5)=oid_raw("1.3.6.1.2.1.2.2.1.8.5193",10,5),1
,"Stack port 1 error")
,"Stack port 1 error")
,"Stack port 2 error")
,"Stack port 2 error")
,"Stack port 3 error")
,"Stack port 3 error")
,"Stack port 4 error")
,"Stack port 4 error")
,"Stack port 5 error")
,"Stack port 5 error")

Create a probe of type function name it stackcount or whatever...
on the available line put
swinstk()=1
on the error line put
if(swinstk()=1, "", concatenate("Stack trouble = ", swinstk()))
This probe was not designed to be graphed so when you add it to a stack disable the history. You could modify the result from the stkXprts to be numbers 1 through 9 and modify the probe logic.

If you are paying attention you will see the available line is once again set to use swinstk instead of a separate function and it is just a number. I could not get an available line that contained text to work with an equal sign. For example on the available line when I put swinstk()="good" this probe would install on every device and only show trouble on stacks. It would just be "up" and working fine on a device that didn't even have those OIDs. No amount of messing with the available line would work with text as the true condition. Text works just fine as a false condition and numbers work fine as true conditions. So going forward use text for false or numbers for true condition checking in the available line of a probe.

TLDR; Use numbers and not text if testing for a true condition in the available line of a probe.

[EDIT] Don't build the probe like this suggests, move the stk9prts and stk8prts etc to the fail side because this probe takes up too much processing time.

First create a function called swinstk add the following to it.
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=9, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=36,,stk9prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=32,,stk8prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=7, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=28,,stk7prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=6, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=24,,stk6prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=5, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=20,,stk5prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=16,,stk4prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=3, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=12,,stk3prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=2, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=8 ,,stk2prts()),
if(array_size(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=1, if(sum(oid_column("1.3.6.1.4.1.9.9.500.1.2.1.1.6",10,5))=4 ,,"1 Switch needs attention"),
"Problem reading Any stack"
)))))))))

The switch stack will be tested much faster but the individual interfaces will not be tested unless there is a switch failure. this probe is basically defunct since you don't need any of the stack port testing functions i.e. stk9prts, stk8prts, but at least you will know if a switch has failed.

[end edit]

Wed Nov 02, 2011 7:28 pm

I have a bunch of APC UPS probes I have built but here is the mother of all APC probes! One of the OIDs in an APC ups is a 64bit binary string. 32 of those values are used to indicate various issues. This probe determines if the string is "normal" and if not it finds the first error and returns the result.

Note: The probe line changed, the "False" test in the probe did not work. The graphic I attached still has the old version if you want to compare.

Probe - error line
if(string_size(oid("1.3.6.1.4.1.318.1.1.1.1.1.1.0",10,5)<>0),if(ups_basic_state() = 1, "" ,concatenate( "UPS State Error; ", ups_basic_state())),"Cant read UPS State")

Function
if(string_size(oid("1.3.6.1.4.1.318.1.1.1.1.1.1.0",10,5)<>0),
if(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5)="0001010000000000001000000000000000000000000000000000000000000000",1,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),0,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),1,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),2,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),3,1)=1,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),4,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),5,1)=1,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),6,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),7,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),8,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),9,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),10,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),11,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),12,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),13,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),14,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),15,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),16,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),17,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),18,1)=1,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),19,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),20,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),21,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),22,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),23,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),24,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),25,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),26,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),27,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),28,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),29,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),30,1)=0,
if(string_substring(oid("1.3.6.1.4.1.318.1.1.1.11.1.1.0",10,5),31,1)=0,
"Couldn't determine UPS trouble"
,"Synchronized command is in progress")
,"No Batteries Attached")
,"Graceful Shutdown Issued by Downstream Device")
,"Graceful Shutdown Issued by Upstream Device")
,"Low Battery or On Battery")
,"Self Test In Progress")
,"High Battery Temperature")
,"Battery Charger Failure")
,"Bad Output Voltage")
,"Smart Boost or Smart Trim Fault")
,"Graceful Shutdown Initiated")
,"Battery Communication Lost")
,"Rebooting")
,"On")
,"Sleeping until Utility Power Returns")
,"Sleeping on a Timer")
,"In Bypass due to Fan Failure")
,"In Bypass due to Supply Failure")
,"In Bypass due to Internal Fault")
,"Software Bypass")
,"Manual Bypass")
,"Batteries Discharged")
,"Runtime Calibration")
,"Overload")
,"AVR Trim Active")
,"AVR Boost Active")
,"Serial Communication Established")
,"Replace Battery")
,"On Line")
,"Low Battery")
,"On Battery")
,"Abnormal Condition Present")
)
,"False")

ups_state_test-Probe.png

ups_basic_state-func.png

Lwra93 · Wed Nov 23, 2011 3:01 pm

Could it be that you use the wrong OID. I check Windows services as following:

Available: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, 1, -1)
Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, "", "DB2_db2sec.exe not detected by SNMP probe")
Value: 1
Unit: running
Rate: none

Change "db2sec.exe" with the name of the service you like to monitor. One thing I also noticed is, that the name is case-sensitive! Write the service name the same as you see it in the Windows Task Manager.

Sometimes it also helps to use the if() function for debugging. If you are not shure what you will get with "if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0" and want to see it, put the same command as "to do". For example:

Error: if(array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe")>0, array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe"), array_find(oid_column("1.3.6.1.2.1.25.4.2.1.2"), "db2sec.exe"))

With this error line you will see the output of the command in the "Problem" column of the "Services" table. Sometimes it helps me a lot to find bugs in my commands.

Thanks! It really worked!

Tue Nov 29, 2011 4:41 pm

Cisco has two types of software for wireless access, lightweight and IOS. In IOS every once in a while a radio interface will stop working and the status will be reset. The admin status will be up but the operational status will be down. In the log file there is a message about interface reset but no up message after that. I just made a probe to determine if the operational status is down on the 2.4ghz radio so that I will know if the radio is unusable.

Function
if(string_size(oid("1.3.6.1.2.1.2.2.1.8.1", 10 ,5)), oid_raw("1.3.6.1.2.1.2.2.1.8.1",10,5),"False")

intd0test - Function000049.png

Probe
if(intd0test()<>"False",if(intd0test()=1,"","Wireless interface down"),"Can't Read Int DO!")

intd0problem - Probe000050.png

Morphology · Tue Dec 20, 2011 10:36 am

A Function and a Probe to monitor the status of an array of disks in an HP Storageworks server.

The problem is that a single oid will return an array of values (one for each disk), which are simply a text string. So you have to check each returned string for each element of the array looking to see whether that disk is OK, and returning an error if not.

It's a bit crude, in that it is hard-coded to cope with a set number of disks in the array (wouldn't it be nice to be able to code some sort of {FOR....NEXT} loop!!?

My SWS shelves have 12 disks, so this checks array elements 0 to 11 - you may need to adjust accordingly.

FUNCTION
=======

name: disk_array_status
Description: Pull out the disk array status for an SWS shelf
Code:

if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),0),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),1),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),2),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),3),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),4),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),5),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),6),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),7),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),8),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),9),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),10),"ok (2)"),-1,if(string_find(array_element(oid_column("1.3.6.1.4.1.232.3.2.5.1.1.6.2"),11),"ok (2)"),-1,1))))))))))))

Next comes a Probe, which utilises this function:

PROBE
=====

Name: SWS Array Status
Type: Function
Agent: default
Available: disk_array_status()
Error: if(disk_array_status()<>-1,"","Disk Array Status Error")
value: disk_array_status()
Unit:
Rate: none

Apply the probe to the SWS devices on your map, set the alerts, and you're done.

Morph

fbsdmon · Thu Jan 12, 2012 5:06 pm

I thought I share my cpu and disk probe changes. They work exactly like the original probes + they inform you if cpu or diks is over threshold. This way, you don't need to pool them twice if you want threshold notifications as well.

cpu
Error: if(and(cpu_usage_available(), cpu_usage()<89), "", if(cpu_usage_available(), concatenate("CPU usage is above 90% with ", cpu_usage(), "%"), "down"))
disk
Error: if(and(hdd_size()>0, round(hdd_usage()<79)), "", if(hdd_size()>0, concatenate("Disk usage is above 80% with ", round(hdd_usage()), "%"), "down"))

geoffsmith31 · Fri Jan 27, 2012 11:02 pm

I have a network with many switches that have redundant links. Some use Spanning Tree to control the redundant configuration and some use LACP. I have had situations where a redundant link will fail and I do not discover it for some time (and only by chance). I am trying to write a probe that will go "down" if one of the redundant links on the switch is down - thereby giving me immediate notice of the loss of redundancy.

I have a probe based on the interface, operator state (link state) OID=1.3.6.1.2.1.2.2.1.8.x which does what I want for a particular switchport. However, not all my switches can have the same redundant ports so I will need to create a lot of different probes (one for each different x value) and apply multiple probes to each switch. A more elegant method, I think, would be to have a series of x values in one of the devices custom fields then have the probe iterate through that list to make sure all values of x have their link up.

I don't see any loop control (for, while, repeat, etc) methods in the functions. Does anyone know if there is a way of doing this - maybe a recursive function?

Sat Jan 28, 2012 12:32 am

The only way I have found to go through many iterations is to put an if inside an if. You can put functions inside of functions but that is about the closest you can get to a loop.

I have not tried to have functionA call functionB and have functionB call functionA or functionA call FunctionA since that should put the dude in a tight loop.

Although you could do something like this where functionB tests the next interface and it is something like the UPS 32bit binary test above.
functionA
if(x=1,functionB,false)
FunctionB
if(y=1,functionC,false)

I have roughly the same issue where I want to determine when an etherchannel does not have both the interfaces up and I have not found an elegant way to do that either. I think you are going to have a lot of manually coding to track all those interfaces, Check out gsandul's posts about tracking interface status...

GL
Lebowski

fbsdmon · Mon Feb 13, 2012 1:38 am

Asterisk active calls monitoring (probe) & a Asterisk information tooltip (version, uptime, relaod time, current active calls):

The Functions:

Name: ast_version
Description: Text version string of the version of Asterisk that the SNMP Agent was compiled to run against.
Code: oid("1.3.6.1.4.1.22736.1.1.1.0")
--------------------------------------------------------------------------------
Name: ast_version
Description: Time ticks since Asterisk was started.
Code: oid("1.3.6.1.4.1.22736.1.2.1.0")
--------------------------------------------------------------------------------
Name: ast_reload_time
Description: Time ticks since Asterisk was last reloaded.
Code: oid("1.3.6.1.4.1.22736.1.2.2.0")
--------------------------------------------------------------------------------
Name: ast_active_calls
Description: The number of calls currently active on the Asterisk PBX.
Code: oid("1.3.6.1.4.1.22736.1.2.5.0")
--------------------------------------------------------------------------------
Name: ast_info
Description: Asterisk ToolTip Information (version, uptime, reload time, active calls, etc.). NOTE: Monitored device must be assigned the device type"Asterisk PBX" in order to show this info in the tooltip.
Code: if(not(string_find(device_property("Type"), "Asterisk PBX")), 
concatenate(
concatenate(
"Asterisk v", ast_version(), "
", " Uptime: ", ast_uptime(), "
", " ReloadTime: ", ast_reload_time(), "
"),
" Active Calls: ", ast_active_calls(), "
"),
"")

NOTE: Multiple concatenations were needed because there is a limit on how many elements you can concatenate.
NOTE: To use the ast_info as ToolTip, add it to: Global Settings -> Map -> Device Appearance -> Tooltip, just after ros_info() and before the notes. Also note that you need to add a device type named "Asterisk PBX" and assigned to any asterisk device you wish to show the ast_info() for!

The Active Calls probe:

Name: astActiveCalls
Type: Function
Available: string_size(ast_active_calls())
Error: if(string_size(ast_active_calls()), "", "down")
Value: ast_active_calls()
Unit: calls

Off course, you will need res_snmp.so module for Asterisk + some snmp configuration in order to pool this info from Asterisk. Information can be found on Google, but feel free to contact me for help if needed.

Enjoy!

dnjulie · Fri Mar 16, 2012 7:31 pm

Hye All,

I'm trying to monitor the battery status of an APC UPS .But it's not working. The service is down and talks about a parsed failed
Here is my config:

Type: Function
Available; if( oid("1.3.6.1.4.1.318.1.1.1.2.1.1.0") == 2,1,-1 )
Error:if(oid("1.3.6.1.4.1.318.1.1.1.2.1.1.0")>2,"","Battery Low")
Value:oid("1.3.6.1.4.1.318.1.1.1.2.1.1.0")
Unit:Interger
Rate:none

http://support.ipmonitor.com/mibs/POWER ... teryStatus

EMOziko · Wed Mar 21, 2012 9:25 pm

Is there any way to make HTTP GET request from Dude?
I mean that when device goes down instead of sending mail or other notification, Dude must make Get request.

The Dude installed on routeros

fbsdmon · Thu Mar 22, 2012 1:25 am

If your dude is installed on a windows box, the you could configure a 'execute on server' type of notification which can call a windows tool that does the job. You can pass a bunch of variables to that tool/program.

Also, please post such questions in a different topic. The probe tread is meant for sharing ready to use probes. I think

EMOziko · Thu Mar 22, 2012 10:42 am

If your dude is installed on a windows box, the you could configure a 'execute on server' type of notification which can call a windows tool that does the job. You can pass a bunch of variables to that tool/program.

Also, please post such questions in a different topic. The probe tread is meant for sharing ready to use probes. I think

Yes I know its possible on windows installation but my is on RouterOS.

thank you and sorry for mistake

fbsdmon · Thu Mar 22, 2012 4:22 pm

check the fetch tool, i think it can be used to upload a file to a webpage:

/tool fetch user=<> password=<> upload=yes mode=http address=<> src-path="/something/something/page.php"

EMOziko · Sat Mar 24, 2012 3:13 pm

check the fetch tool, i think it can be used to upload a file to a webpage:

/tool fetch user=<> password=<> upload=yes mode=http address=<> src-path="/something/something/page.php"

Thank you.
The Dude does not have "execute on server" type of notification, so I cant execute commands on routerOS

transdata · Wed Apr 11, 2012 4:14 pm

Is there any way to make HTTP GET request from Dude?
I mean that when device goes down instead of sending mail or other notification, Dude must make Get request.

The Dude installed on routeros

Hi An Probe picture is attached, hopefully

http_get_probe.png

This will do a get of the path. Pls. keep in Mind, the request will be made on the device you attach the probe to.

The line below you would write some text you expect on the page. This text can be only a part of much more other text.

Cheers,
Transdata

Sharade · Thu Apr 19, 2012 12:20 pm

Windows Disk Space: Free/Total


Disk Space: C:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.1")-oid("1.3.6.1.2.1.25.2.3.1.6.1"))*oid("1.3.6.1.2.1.25.2.3.1.4.1"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.1")*oid("1.3.6.1.2.1.25.2.3.1.4.1")/1024)/1024)/1024)] GB D:\=[round(((((oid("1.3.6.1.2.1.25.2.3.1.5.3")-oid("1.3.6.1.2.1.25.2.3.1.6.3"))*oid("1.3.6.1.2.1.25.2.3.1.4.3"))/1024)/1024)/1024)]/[round(((oid("1.3.6.1.2.1.25.2.3.1.5.3")*oid("1.3.6.1.2.1.25.2.3.1.4.3")/1024)/1024)/1024)] GB

[/quote]

Maybe it's a stupid question, but i'm totally new with the dude

So how i can display cpu / memory like in the picture of slech? Disk Space worked fine for me.

leon84 · Thu Apr 19, 2012 4:28 pm

Hi to all,
in which way I can have snmp information about all wlan interfaces?
In particular, I would to change device color in the dude if a wlan interface (not in administrativly down) go down ...
I think that I have to compare oid "iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifOperStatus" but I don't want to create a snmp test for each router... I would a function that automatically check all wlan interface and give me an error if some one is down...

Is it possible?

Sharade · Fri Apr 20, 2012 3:05 pm

May some1 can give me the Code from the Function "[device_performance()]"?

vlazari · Sat Apr 21, 2012 7:36 pm

Hello! Can anyone help me with a probe for monitoring S.M.A.R.T. status of HDD? I need this for Windows Server 2008 R2.