Cacti: Ping Result not reported properly

[dsclassen]

icmp ping works from command line and devices are reported as "up", but device view (host.php) indicates otherwise. Ping Result shows "ICMP ping Timed out".

[cigamit]

Please instrument the lib/ping.php and confirm that the command line options are correct. For Linux, it's something to the effect:

ping -W timeoutinseconds -c retries -p pattern hostname

Maybe you need to increase the retries. The way this reads is it will send 'retries' packets to get a number. The other PHP_OS' include: sun, hpux, mac, freebsd, darwin, bsd, aix, winnt.

Which is yours?

[dsclassen]

The main cacti polling machine is Linux (CentOS 6.8)
The Ping Timeout Value is set to 500ms and the Ping Retry Count is set to 3 or 4.
I'm seeing the same "ICMP ping Timed out" error message for all hosts (Windows or Linux).
I'm not sure how to test the lib/ping.php file on the command line.

[cigamit]

That's not it. Open lib/ping.php and goto line 172, and you will find "$result = shell_exec('ping -W...". Maybe we need to give it the full path on your system. Mine are CentOS 6.x too, and I don't have the issue. I guessing change 'ping' to '/bin/ping' and the problem will be solved. Let us know.

[dsclassen]

[cacti@www cacti]$ ping -W 0.4 -c 3 -p Linux my.host.com
ping: patterns must be specified as hex digits.

[cigamit]

You will see on line 144, that we do create a hex pattern. In hex 'cacti-monitoring-system' is:

63616374692d6d6f6e9745f72696e672d73797374656d

So, the ping would be:

/bin/ping -W 1 -C 3 -p 63616374692d6d6f6e9745f72696e672d73797374656d my.host.com

Also, make that change from 'ping' to '/bin/ping' before you go too far down a rat-hole. If that does not work, use the syntax above.

[dsclassen]

ping -W 0.4 -c 3 -p 63616374692d6d6f6e9745f72696e672d73797374656d my.host.com
PATTERN: 0x63616374692d6d6f6e9745f72696e672
PING my.host.com (192.168.1.1) 56(84) bytes of data.
64 bytes from my.host.com (192.168.1.1): icmp_seq=1 ttl=64 time=0.222 ms
64 bytes from my.host.com (192.168.1.1): icmp_seq=2 ttl=64 time=0.182 ms
64 bytes from my.host.com (192.168.1.1): icmp_seq=3 ttl=64 time=0.166 ms

--- my.host.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2000ms
rtt min/avg/max/mdev = 0.166/0.190/0.222/0.023 ms

I did change line 172 to /bin/ping and it did not fix the problem.

so ping on the command line is working, but not when called from ping.php....

[cigamit]

Edit /etc/php.ini and set 'error_log = /tmp/php_errors.log', and restart apache. Also, if you have SELinux in anything other than disabled, disable it and reboot. You may have to setup permissive and capture the event in your auth log and setup the correct policy for it. If it's something internet facing, you should go with the later.

[dsclassen]

yep ... selinux was the culprit. Sorry for the wild goose chase.

[cigamit]

We gotta squash bugs. No problem. We are trying to release this week.

[dsclassen]

for posterity (and Google bots) this is how I fixed selinux to allow httpd to perform icmp ping commands:
as root:

create a file called http_ping.tt

module http_ping 1.0;

require {
type httpd_t;
class capability net_raw;
class rawip_socket { getopt create setopt write read };
}

#============= httpd_t ==============
allow httpd_t self:capability net_raw;
allow httpd_t self:rawip_socket { getopt create setopt write read };

checkmodule -M -m -o http_ping.mod http_ping.tt
semodule_package -o http_ping.pp -m http_ping.mod
semodule -i http_ping.pp

[interduo]

Ping result is not reported properly.
There is "ICMP Timeout" instead of "ping: socket: Operation not permitted".
The results are not the same. This causes some problems.

There should be a code update for that.