Hello Guest

Author Topic: lots of .data files in server path pandora/data_in/  (Read 118 times)

0 Members and 1 Guest are viewing this topic.

Offline gairhald

  • Full Member
  • ***
  • Posts: 46
  • Karma: 0
    • View Profile
lots of .data files in server path pandora/data_in/
« on: December 28, 2016, 02:45:32 AM »
Hi, I'm reinstalling some pandora_agents in few servers, windows and linux, and some linux when reinstall and configure pandora_agent, works ok, but
Code: [Select]
/var/spool/pandora/data_in/ , in the server pandora, i see that is full of more xxxxx.data from the same server. In some cases, i removed all pandora_agent with yum remove pandora.... and remove folder in /etc/pandora and reinstall again and solve this problem, but in some cases not resolve it

any idea? why some servers reports lots of xxx.data and full this folder? and the rest of servers only reports one or two files, that pandora removes immediately, thanks a lots

Code: [Select]
[root@Pandora data_in]#ll
-rw-rw-rw- 1 pandora root 4283 dic 28 11:32 HGSOLR02.1482917560.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:32 HGSOLR02.1482917740.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:34 HGSOLR02.1482918121.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:34 HGSOLR02.1482918307.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:33 HGSOLR02.1482918492.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:32 HGSOLR02.1482919056.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:33 HGSOLR02.1482919426.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:33 HGSOLR02.1482919613.data
-rw-rw-rw- 1 pandora root 4282 dic 28 11:32 HGSOLR02.1482919802.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:33 HGSOLR02.1482920173.data
-rw-rw-rw- 1 pandora root 4283 dic 28 11:32 HGSOLR02.1482920357.data
-rw-rw-rw- 1 pandora root 4733 dic 28 11:37 HGSOLR02.1482921439.data
-rw-rw-rw- 1 pandora root 4733 dic 28 11:42 HGSOLR02.1482921739.data
-rw-rw-rw- 1 pandora root 6330 dic 28 11:43 OXYGEN.4145.data
-rw-rw-rw- 1 pandora root 1162 dic 28 11:43 VIEW05.11227.data
-rw-rw-rw- 1 pandora root 1161 dic 28 11:43 VIEW08.16572.data
[root@Pandora data_in]#


Code: [Select]
# Base config file for Pandora FMS agents
# Version 6.0SP4, GNU/Linux
# Licensed under GPL license v2,
# Copyright (c) 2003-2014 Artica Soluciones Tecnologicas
# http://www.pandorafms.com

# General Parameters
# ==================

server_path /var/spool/pandora/data_in
temporal /tmp
logfile /var/log/pandora/pandora_agent.log

#include /etc/pandora/pandora_agent_alt.conf
#broker_agent name_agent

# Interval in seconds, 300 by default
interval    60

# Debug mode only generate XML, and stop after first execution,
# and does not copy XML to server.
debug 0

# Optional. UDP Server to receive orders from outside
# By default is disabled, set 1 to enable
# Set port (41122 by default)
# Set address to restrict who can order a agent restart ( = anybody)
udp_server 0
udp_server_port 41122

#process_xeyes_start xeyes
#process_xeyes_stop killall xeyes

# By default, agent takes machine name
#agent_name     adama

# To define agent name by specific command, define 'agent_name_cmd'.
# (In the following example, agent name is 'hostname_IP')
#agent_name_cmd  LANG=C; /bin/echo -n `hostname`; /bin/echo -n "_"; /bin/echo `/sbin/ifconfig eth0 | /bin/grep 'inet addr' | /usr/bin/awk '{print $2;}' | /usr/bin/cut -d: -f2`

#Parent agent_name
#parent_agent_name caprica

# Agent description
description Intranet SolR - Virtual

# Group assigned for this agent (descriptive, p.e: Servers)
group Servers

# address: Enforce to server a ip address to this agent
# You can also try to detect the first IP using "auto", for example
address auto
# or setting a fixed IP address, like for example:

# Autotime: Enforce to server to ignore timestamp coming from this
# agent, used when agents has no timer or it's inestable. 1 to enable
# this feature
#autotime 1

# Timezone offset: Difference with the server timezone
#timezone_offset 0

# Agent position paramters
# Those parameters define the geographical position of the agent

# gis_exec: Call a script that returns a string with a fixed
# format of latitude,longitude,altitude
# i.e.: 41.377,-5.105,2.365

#gis_exec /tmp/gis.sh

# This sets the GIS coordinates as fixed values:
# latitude
#latitude 0
# longitude
#longitude 0
# altitude
#altitude 0

#GPS Position description
#position_description Madrid, centro

# By default agent try to take default encoding defined in host.
#encoding UTF-8

# Listening TCP port for remote server. By default is 41121 (for tentacle)
# if you want to use SSH use 22, and FTP uses 21.
server_port 41121

# Transfer mode: tentacle, ftp, ssh or local
transfer_mode tentacle

# timeout in seconds for file transfer programs execution (30 by default)
#transfer_timeout 30

# Server password (Tentacle or FTP). Leave empty for no password (default).
#server_pwd mypassword

# Set to yes/no to enable/disable OpenSSL support for Tentacle (disabled by default).
#server_ssl no

# Extra options for the Tentacle client (for example: server_opts -v -r 5).

# delayed_startup defines number of seconds before start execution
# for first time when startup Pandora FMS Agent
#delayed_startup 10

# Pandora nice defines priority of execution. Less priority means more intensive execution
# A recommended value is 10. 0 priority means no Pandora CPU protection enabled (default)
#pandora_nice 0

# Cron mode replace Pandora FMS own task schedule each XX interval seconds by the use
# of old style cron. You should add to crontab Pandora FMS agent script to use this mode.
# This is disabled by default, and is not recommended.  Use Pandora FMS internal scheduler
# is much more safe

# If set to 1 allows the agent to be configured via the web console (Only Enterprise version)
remote_config 0

# If set to 1 start Drone Agent's Proxy Mode
# proxy_mode 1

# Max number of simmultaneus connection for proxy (by default 10)
# proxy_max_connection 10

# Proxy timeout (by default 1s)
# proxy_timeout 1

# Number of threads to execute modules in parallel
#agent_threads 1

# User the agent will run as
#pandora_user pandora

# Enable or disable XML buffer.
# If you are in a secured environment and want to enable the XML buffer you
# should consider changing the temporal directory, since /tmp is world writable.
xml_buffer 1

# Minimum available bytes in the temporal directory to enable the XML buffer
temporal_min_size 1024

# Secondary server configuration
# ==============================

# If secondary_mode is set to on_error, data files are copied to the secondary
# server only if the primary server fails. If set to always, data files are
# always copied to the secondary server.
#secondary_mode on_error
#secondary_server_ip localhost
#secondary_server_path /var/spool/pandora/data_in
#secondary_server_port 41121
#secondary_transfer_mode tentacle
#secondary_transfer_timeout 30
#secondary_server_pwd mypassword
#secondary_server_ssl no

# Module Definition
# =================

# System information

# vmstat syntax depends on linux distro and vmstat command version, please check before use it
module_name CPU Load
module_type generic_data
module_interval 1
module_exec vmstat 1 2 | tail -1 | awk '{ print $13 }'
module_max 100
module_min 0
module_description User CPU Usage (%)
module_min_warning 70
module_max_warning 90
module_min_critical 91
module_max_critical 100
module_unit %

# vmstat syntax depends on linux distro and vmstat command version, please check before use it
module_name CPU IOWait
module_type generic_data
module_interval 1
module_exec vmstat 1 2 | tail -1 | awk '{ print $16 }'
module_min_warning 10
module_min_critical 16
module_unit %

#Get load average
module_name Load Average
module_type generic_data
module_exec cat /proc/loadavg | cut -d' ' -f1
module_description Average process in CPU (Last minute)

#IO Wait CPU ticks /sec
module_name IOWaitCPU
module_type generic_data_inc
module_exec vmstat -s | grep "IO-wait cpu ticks" | awk '{ print $1 }'
module_unit ticks/sec
module_description Too much IOwait means IO bottleneck and performance problems. Check also LoadAVG.

#Connected users
module_name Connected users
module_type generic_data
module_exec who | wc -l

#Count total number of processes
module_name Number processes
module_type generic_data
module_exec ps aux | wc -l
module_description Total processes
module_unit processes

# Async data example
module_name LastLogin
module_type async_string
module_exec last | head -1
module_description Monitor last user loggin

module_name Solr_Service
module_type generic_proc
module_exec ps -ef | grep start.jar | grep -v grep | wc -l
module_description Shows SOLR SERVICE

# This plugin detects all disk and report free space (%)

module_plugin pandora_df_free
module_plugin pandora_df

# This plugin detects system free memory and free swap (in %)

module_plugin pandora_mem

# This plugin will get the network usage (bytes/sec)

module_plugin pandora_netusage

# This parses /var/log/syslog file, under the module name "Syslog_error"
# And search for "ERROR" string into it, sending only that information.

module_plugin grep_log /var/log/syslog Syslog_error ERROR

# Plugin for inventory on the agent (Only Enterprise)
# module_plugin inventory 1 cpu ram video nic hd cdrom software init_services filesystem users route

# Log collection modules. Only for enterprise version, this will collect log files for forensic analysis.
# This is for LOG monitoring, only on enterprise version
#module_plugin grep_log_module /var/log/messages Syslog \.\*

Offline roberto

  • Administrator
  • Full Member
  • *****
  • Posts: 28
  • Karma: 0
    • View Profile
Re: lots of .data files in server path pandora/data_in/
« Reply #1 on: December 28, 2016, 07:12:03 AM »
Hi gairhald,

I hope all is goint well with you.

Could you please send me /var/log/pandora/pandora_server.log/error and check if /etc/init.d/tentacle_serverd status is running?

Best regards,


Offline gairhald

  • Full Member
  • ***
  • Posts: 46
  • Karma: 0
    • View Profile
Re: lots of .data files in server path pandora/data_in/
« Reply #2 on: January 18, 2017, 01:54:52 AM »
Hi, sorry por late, i think that is happens when its the first time to received alerts from new servers, now, I've configured 200 servers, and works OK, the folder /var/spool/pandora/data_in it's empty or only appear 1 file for server. Its OK, thanks

Offline antonio.s

  • Administrator
  • Smart member
  • *****
  • Posts: 288
  • Karma: 2
    • View Profile
Re: lots of .data files in server path pandora/data_in/
« Reply #3 on: January 18, 2017, 03:06:12 AM »
Hello gairhald,

Happy to read that you don't have this issue now. Just to clarify, this is usually because there have been some communication problems between the agent and the server, in some cases the tentacle_server daemon stopped and caused a lot of XML files to get buffered on the agents, that send them all, making the data_in folder to get full of files.

Kind regards,