1 Topic by dally

  • dally
  • dally
  • Member
  • Offline
  • Registered: 2018-08-22
  • Posts: 18

Topic: recovered - 1m ipv4 tcp listen drops - ipv4.tcplistenissues

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.8
- Linux/BSD distribution name and version: Debian 9
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
===
First time to see this netdata email notification. Full error below. Has any one any experience with this alert?  Very little on the net.  Some suggestions of a ICMP bot attack. 

ipv4.tcplistenissues Chart
1m ipv4 tcp listen drops (was critical for 1 minute)
the number of TCP listen socket drops during the last minute Alarm
tcp Family
Recovered from CRITICAL Severity
Fri Sep 14 13:59:44 CDT 2018
(was critical for 1 minute) Time

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,160

Re: recovered - 1m ipv4 tcp listen drops - ipv4.tcplistenissues

It's safe to ignore this. "netdata" monitor is too sensitive.

3 Reply by MuPp3t33r

  • MuPp3t33r
  • Member
  • Offline
  • Registered: 2017-01-17
  • Posts: 149

Re: recovered - 1m ipv4 tcp listen drops - ipv4.tcplistenissues

ZhangHuangbin wrote:

It's safe to ignore this. "netdata" monitor is too sensitive.

Hi Zhang
Do you know if there's some way we can adjust the thresholds or disable them outright? I'm getting in the region of 40 notifications a day for critical/recovered events on a new iRedMail deployment...
Thanks

4 Reply by hws

  • hws
  • Member
  • Offline
  • Registered: 2017-01-19
  • Posts: 43

Re: recovered - 1m ipv4 tcp listen drops - ipv4.tcplistenissues

Each notification shows the exact file and line which triggers this warning. eg:

The source of this alarm is line 31@/usr/lib/netdata/conf.d/health.d/tcp_resets.conf

Just edit the mentioned file as needed.

You can disable an alarm notification by setting the 'to' line in that file to: silent

Also you should report false or annoying alarms to the Netdata developers.

5 Reply by MuPp3t33r

  • MuPp3t33r
  • Member
  • Offline
  • Registered: 2017-01-17
  • Posts: 149

Re: recovered - 1m ipv4 tcp listen drops - ipv4.tcplistenissues

hws wrote:

Each notification shows the exact file and line which triggers this warning. eg:

The source of this alarm is line 31@/usr/lib/netdata/conf.d/health.d/tcp_resets.conf

Just edit the mentioned file as needed.

You can disable an alarm notification by setting the 'to' line in that file to: silent

Also you should report false or annoying alarms to the Netdata developers.

Noted with thanks smile