Poll_file with icmp

Elastic Stack Beats
1

Hi,

Just wondering if anyone have successfully used the watch.poll_file option for icmp monitoring?
I tried following the sample from here, but got the error: Exiting: error loading config file: yaml: line 30: mapping values are not allowed in this context
Line 30 was the "interval: 5s" line, so I removed it, which removed the error, but nothing seem to happen.

I tried using HTTP instead of ICMP, that worked no problems. Even in the logs, I can see:
scheduler.go:294: INFO Scheduled job 'http@http://google.com' already active.

I'm using the Dockerized Heartbeat (docker.elastic.co/beats/heartbeat) version 6.3.0 and 5.6.4, with the same result.

My heartbeat.yml has:

- type: http
  schedule: '@every 15s'
  urls: ["http://google.com"]
  watch.poll_file:
    path: /etc/heartbeat/monitors/http_urls.json

- type: icmp
  schedule: '@every 10s'
  hosts: ["localhost"]
  ipv6: false
  mode: any
  watch.poll_file:
    path:/etc/heartbeat/monitors/icmp_hosts.json

http_urls.json:
{"urls": ["http://google.com"]} {"urls": ["http://youtube.com"]}

icmp_hosts.json:
{"hosts": ["host01"]} {"hosts": ["host02"]}

Where HTTP worked, and ICMP doesn't.

Any help is appreciated. Thanks.

2

I didn't have any issues using watch.poll_file on my end with Heartbeat v6.3.0.

$ cat heartbeat.dev.yml 
heartbeat.monitors:
- type: icmp
  schedule: '*/5 * * * * * *'
  watch.poll_file:
    path: icmp_hosts.json

output.console.pretty: true

$ cat icmp_hosts.json 
{"hosts": ["www.google.com"]} {"hosts": ["www.yahoo.com"]}

$ sudo ./heartbeat -c heartbeat.dev.yml --strict.perms=false
{
  "@timestamp": "2018-06-28T20:16:35.001Z",
  "@metadata": {
    "beat": "heartbeat",
    "type": "doc",
    "version": "6.3.0"
  },
  "host": {
    "name": "mybox.com"
  },
  "icmp": {
    "requests": 1,
    "rtt": {
      "us": 37718
    }
  },
  "resolve": {
    "host": "www.yahoo.com",
    "ip": "98.138.219.231",
    "rtt": {
      "us": 32087
    }
  },
  "monitor": {
    "host": "www.yahoo.com",
    "ip": "98.138.219.231",
    "status": "up",
    "duration": {
      "us": 69933
    },
    "id": "icmp-icmp-host-ip@www.yahoo.com",
    "type": "icmp",
    "name": "icmp"
  },
  "type": "monitor",
  "beat": {
    "name": "mybox.com",
    "hostname": "mybox.com",
    "version": "6.3.0"
  }
}
{
  "@timestamp": "2018-06-28T20:16:35.001Z",
  "@metadata": {
    "beat": "heartbeat",
    "type": "doc",
    "version": "6.3.0"
  },
  "icmp": {
    "requests": 1,
    "rtt": {
      "us": 84283
    }
  },
  "monitor": {
    "type": "icmp",
    "host": "www.google.com",
    "ip": "172.217.17.132",
    "duration": {
      "us": 123020
    },
    "status": "up",
    "id": "icmp-icmp-host-ip@www.google.com",
    "name": "icmp"
  },
  "resolve": {
    "rtt": {
      "us": 38618
    },
    "host": "www.google.com",
    "ip": "172.217.17.132"
  },
  "type": "monitor",
  "host": {
    "name": "mybox.com"
  },
  "beat": {
    "hostname": "mybox.com",
    "version": "6.3.0",
    "name": "mybox.com"
  }
}
3

Thanks Andrew.

I've basically matched what you did 100%...

image
image.png937×224 8.99 KB

Still no good. I get something like:

2018-06-29T15:34:27.950+0800    WARN    beater/heartbeat.go:24  Beta: Heartbeat is beta software
2018-06-29T15:34:27.950+0800    INFO    beater/manager.go:110   Select (active) monitor icmp
2018-06-29T15:34:27.950+0800    ERROR   beater/manager.go:140   failed to load monitor tasks: missing required field accessing 'hosts' when initializing monitor icmp(0)
2018-06-29T15:34:27.950+0800    INFO    beater/manager.go:252   load watch object: map[hosts:[www.google.com]]
2018-06-29T15:34:27.951+0800    INFO    beater/manager.go:252   load watch object: map[hosts:[www.yahoo.com]]
2018-06-29T15:34:27.951+0800    DEBUG   [icmp]  icmp/icmp.go:52 initialize icmp handler
2018-06-29T15:34:27.953+0800    INFO    icmp/loop.go:330        IPv6 ICMP not supported: listen ip6:ipv6-icmp : socket: address family not supported by protocol
2018-06-29T15:34:27.953+0800    ERROR   beater/manager.go:265   Failed applying configuration: failed to initiate IPv6 support when initializing monitor icmp(0)
2018-06-29T15:34:27.953+0800    INFO    instance/beat.go:315    heartbeat start running.
2018-06-29T15:34:27.953+0800    INFO    beater/heartbeat.go:56  heartbeat is running! Hit CTRL-C to stop it.
2018-06-29T15:34:27.953+0800    INFO    [monitoring]    log/log.go:97   Starting metrics logging every 30s
2018-06-29T15:34:27.953+0800    DEBUG   [scheduler]     scheduler/scheduler.go:151      Start scheduler.
2018-06-29T15:34:57.955+0800    INFO    [monitoring]    log/log.go:124  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":20,"time":{"ms":21}},"total":{"ticks":30,"time":{"ms":32},"value":30},"user":{"ticks":10,"time":{"ms":11}}},"info":{"ephemeral_id":"7221008c-39ad-4222-879e-e4799fed6772","uptime":{"ms":30016}},"memstats":{"gc_next":4194304,"memory_alloc":2207632,"memory_total":4163464,"rss":14635008}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"console"},"pipeline":{"clients":0,"events":{"active":0}}},"system":{"cpu":{"cores":8},"load":{"1":0.26,"15":0.4,"5":0.27,"norm":{"1":0.0325,"15":0.05,"5":0.0338}}}}}}

Good thing is at least it's loading the .json file properly, but doesn't seem to do anything with it.

Any other idea on how I can troubleshoot further?
Thanks.

4

Hi Andrew,

I just found the problem... I think it's to do with ipv6.
I updated the following into my config and it works now:

  ipv4: true
  ipv6: false

Silly me...
Thanks again for your help!

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.