topic Re: Monitoring network traffic? in Operating System - OpenVMS

Monitoring network traffic?

roose — Mon, 23 Apr 2007 23:50:26 GMT

Hi folks,

Is it possible to determine what process is contributing to a server's high network utilization from a VMS node? If yes, what commands should I use and how to interpret the output of that command, meaning, which value will lead my to my top-network-using process?

Our servers are on OpenVMS v7.3-2 and TCP/IP v5.4 ECO5.

Re: Monitoring network traffic?

Karl Rohwedder — Tue, 24 Apr 2007 01:19:14 GMT

From VMS you may use a simple 'show DEV BG/Fu' and check for high/changing operations counts.
Inside TCPIP there is a SHO DEV BGxxx /Full or /CONTIN to monitor candidates.

regards Kalle

Re: Monitoring network traffic?

Volker Halle — Tue, 24 Apr 2007 01:48:20 GMT

Roose,

network IOs are typically buffered IOs, so you could start with MONITOR PROCESSES/TOPBIO

Once you have found a process with high BUFIO, you can use SHOW PROC/ID=xxx to see the devices allocated to this process and can use SHOW DEV/FULL BGxxx or NETxxx (or OSxxx) to watch the IO operation rates. Depending on the network protocol, you could then also use more specific TCPIP or DECnet (NCP/NCL) commands to look at read/write IO counters.

Volker.

Re: Monitoring network traffic?

labadie_1 — Tue, 24 Apr 2007 03:33:02 GMT

And you can monitor a bg device with

tcpip sh dev bgxxx: /continuous

Re: Monitoring network traffic?

labadie_1 — Tue, 24 Apr 2007 03:37:20 GMT

For Decnet IV, you will see the potential problems between nodes with a command similar to
$ pipe mc ncp sh k node cou | sea sys$pipe remote,"Response timeouts"

Re: Monitoring network traffic?

roose — Tue, 24 Apr 2007 03:49:22 GMT

Thanks for the quick replies. So, there is no 1-quick way of identifying these processes then? I was thinking of a command that might be similar to: monit proc/topnetwork_user :)

How about VMS freeware tools then?

Re: Monitoring network traffic?

labadie_1 — Tue, 24 Apr 2007 04:38:54 GMT

$ monitor decnet
will show the decnet traffic.

$ @sys$startup:tcpip$define_commands
will setup the netstat symbol and others

So you will be able to do
netstat -an
and other commands, but you are right, there is a need for your new monitor item !

:-)

Re: Monitoring network traffic?

Wim Van den Wyngaert — Tue, 24 Apr 2007 05:31:13 GMT

A prototype I made just now because I also need this info.

@xxx 5

will show the bg devices with more than 5K traffic per minute (output after 1 minute !)
With usefull info such as destination, username, image, etc.

Wim (ucx 5.3 on 7.3)

Re: Monitoring network traffic?

labadie_1 — Tue, 24 Apr 2007 06:48:48 GMT

useful code, Wim !

A Sda extension would be a good idea for this...

Re: Monitoring network traffic?

Wim Van den Wyngaert — Tue, 24 Apr 2007 10:05:51 GMT

Optimized it a bit and sorted the output.
Was amazed with wath I found on my prod system (1 program pumping 10 MB per minute all the time).

Wim

Re: Monitoring network traffic?

labadie_1 — Tue, 24 Apr 2007 14:51:30 GMT

with tcpip 5.4 eco 5 on Alpha Vms 7.3-2 your code breaks, at least because it needs an extra read somewhere.

May be I will try to write something more generic next week, as I will have some spare time :-)

Re: Monitoring network traffic?

Wim Van den Wyngaert — Wed, 25 Apr 2007 01:51:24 GMT

That's not that difficult. The output of ucx show dev/fu with output directed to file just STINKS. Full of garbage.

I now wrote something simular for decnet too (tested with ncl/NSP, no osi here). No NCP either.

I'll just post it here too.

Wim

Re: Monitoring network traffic?

labadie_1 — Wed, 25 Apr 2007 02:06:18 GMT

Wim wrote
The output of ucx show dev/fu with output directed to file just STINKS. Full of garbage.

Should I say that I agree at 102% ?

May be it is better to do, instead of
$ tcpip sh dev bgxxx:/fu
something like
$ ana/sys
tcpip sh dev bgxxx:/fu

The output has more data, but it seems to be correctly formatted.

And we go nearer an Sda extension, as building a command file with sda> tcpip commands, and parsing the output...

:-)

Re: Monitoring network traffic?

labadie_1 — Wed, 25 Apr 2007 02:31:47 GMT

The simple command
$ pipe wr sys$output "tcpip sh dev /fu" | ana/sys | sea sys$pipe "Device_socket",Bytes tr",Service,Host,Port

gives good "data".

Just add some awk ( awk :== $ sys$common:[syshlp.examples.tcpip.snmp]gawk ), Perl or Python formatting, and it should be fine.

Re: Monitoring network traffic?

labadie_1 — Wed, 25 Apr 2007 02:54:16 GMT

As we now have more and more very useful Sda extensions, may be we should ask Vms Engineering some API to get easily data from any Sda extensions ?

Some votes for this on the advocacy site ?

Re: Monitoring network traffic?

Paul Beaudoin — Wed, 25 Apr 2007 03:31:43 GMT

Roose.

Enclosed is a procedure I have been using for some time. It records each IP or DECnet (IV +V) address that connects to the local box and records the traffic count to/from each address and some simple averages. One file collects/ caclulates and stores, the other displays the results. Best results when run over long periods.

Good Luck

Paul

Re: Monitoring network traffic?

Sebastian Bazley — Wed, 25 Apr 2007 11:48:13 GMT

Paul B:

the attachment seems to contain the output of some data collections, rather than the scripts to do the collection ...

Re: Monitoring network traffic?

Sebastian Bazley — Wed, 25 Apr 2007 12:15:52 GMT

Also worth considering combining the output of

TCPIP SHOW DEV

with

SHOW DEV BG /FULL

The BG information includes the PID and process name, which is not in the TCPIP output, and removing the /FULL qualifier makes the TCPIP output much easier to process.

===

BTW, for an example of how peculiar the TCPIP output is, try the following two commands:

$ TCPIP SHOW DEV BGxxx/FULL

$ PIPE TCPIP SHOW DEV BGxxx/FULL | TYPE SYS$PIPE

They should show much the same information; however the TYPE PIPE loses most of the input.

Re: Monitoring network traffic?

Paul Beaudoin — Thu, 26 Apr 2007 08:39:57 GMT

Roose,

My applogies - I picked up the wrong file! This one contains the procedures and one aditional one that will monitor phase V only.

Regards

Paul

Re: Monitoring network traffic?

WWarren — Fri, 27 Apr 2007 15:20:31 GMT

For a telnet, no byte or I/O counts appear to be kept (at least for TCP/IP for OpenVMS v5.5). So does a SH DEV/FULL BGnnn output really capture everything you want?

TCPIP> sh dev/full bg17106
Device_socket: bg17106 Type: STREAM
LOCAL REMOTE
Port: 23 49611
Host: w.x.y.z1 w.x.y.z2
Service: TELNET

RECEIVE SEND
Queued I/O 0 0
Q0LEN 0 Socket buffer bytes 0 2
QLEN 0 Socket buffer quota 4380 4380
QLIMIT 0 Total buffer alloc 0 512
TIMEO 0 Total buffer limit 35040 35040
ERROR 0 Number of XONs 0 0
OOBMARK 0 Number of XOFFs 0 0
I/O completed 0 0
Bytes transferred 0 0

Options: REUSEADR KEEP
State: ISCONNECTED PRIV ASYNC
RCV Buff: ASYNC
SND Buff: ASYNC