NOCOL : Frequently Asked Questions (FAQ)

Last updated Mar 2000

General
Installation
Miscellaneous

GENERAL

What is NOCOL ?: nocol (Network Operation Center On-Line) is a collection of system and network monitoring agents which have a common viewing interface and logging mechanism. It can be used to monitor your LAN or WAN network devices as well as your Unix systems and services.

How does NOCOL differ from MRTG ?: MRTG is primarily a graphing tool. Nocol is a monitoring package which detects outages or errors on your devices. All data is quantized in nocol and you lose granularity (which might or might not be preferable).
The two packages are complements of each other.

Where do I get NOCOL: The distribution site is at www.netplex-tech.com. It can also be downloaded via ftp from ftp.navya.com

What about support ?: NOCOL is freeware, and hence no official support is available. However, it is a popular product and you can send messages to the nocol-users@navya.com mailing list or search the Web using any popular Internet search engine (Altavista, Excite) for your queries.
You can also email queries to nocol-support@navya.com which might grow larger in some distant future.

What is SNIPS ?: NOCOL was originally developed in 1991 and released as freeware. Since then, the software has almost completely been rewritten and except for the old curses based 'netmon' interface, not much else remains the same.
SNIPS (System and Network Integrated Polling Software) is the next version of nocol (after v4.3) with many new features such as distributed monitoring for scalability, data graphing, parallel SNMP queries, SNMPv2, MRTG interface for data collection and much more.
SNIPS will be announced on the nocol-users mailing list when it is available.
Is nocol Y2K compliant ?: Yes. All events are logged to noclogd in the Unix timestamp format, so the timestamps are not effected by the Y2K problem.

INSTALLATION

What are the hardware requirements ?

Nocol can run very comfortably on any Pentium-100 class Unix machine with 64MB of RAM and monitor several hundred devices. It is very lightweight in design and implementation.

Should I run nocol as root ?

NO! You should create a separate user such as 'nocol' or 'snips' and all monitors should be run by this user. The few monitors which require root priveleges (such as pingmon or trapmon) are installed as suid root in the nocol bin/ directory.

I am getting lots of messages from keepalive_monitors about restarting

Either your system's ps command is not listing the complete program name and keepalive_monitors is trying to restart the program since it thinks its down or else the monitor being restarted cannot write the pid or data file and is dying (incorrect owner and permissions on the nocol/run directory).

If the monitor is not running, then try running it in debug mode (most monitors will take the -d option for running in debug mode).

multiping gives error socket: Operation not permitted

multiping requires a raw socket, and needs to be installed suid root. You probably did not run make root while installing nocol. Check the ownership and permission of this program- it must show mode -rwsr-x--x with owner root. If not, do the following:

		chown root multiping

		chmod 4751 multiping

Nothing is being logged to noclogd

Events are logged ONLY when their state changes. Thus, an event will be logged to noclogd if a site goes from info level to warning level, etc.

Why do all the events clear when I send kill -HUP to a monitor?

Currently the monitors restart when getting a HUP signal and do not preserve the existing state information. The feature of just re-reading the config file on getting a HUP signal is yet to be added.

MISC

Can nocol handle SNMPv2 ?: NOCOL currently uses the CMU SNMP software which does not implement SNMPv2. This will be implemented in the next version (snips).

How can I page myself when a site goes down?: Assuming that you have an alphanumeric pager and can page yourself using email or any other perl script, you can page yourself on a particular event by using noclogd and piping the events to a simple script such as utility/beep_oncall.
In addition to noclogd, you can also run utility/notifier.pl to page you.
Paging software such as qpage can be used to do the actual paging.

How do I get notified when a site comes back up ?: All monitors in nocol log events to noclogd based on the worst of new severity or previous severity of an event.
Hence, when a site goes down first, it will be logged at 'warning' level. If it comes back up, it will be marked as up but will be logged at a loglevel of 'warning' since that was the old severity. This mechanism allows you to not only detect when a device goes critical, but also detect when the device comes back up.
How do I get paged as soon as a site goes down ?: In order to avoid false alarms (and prevent operators from getting into the habit of wait-and-it-will-go-away), NOCOL will escalate any events severity gradually. If you want to get paged or notified as soon as a site or variable changes, you can watch it at the Warning level instead of the Critical level.

Can I setup host or variable dependencies in NOCOL?: The various displays do not handle dependencies at this time and will require code enhancements. It is possible to write a dependency based monitor and tie it into noclogd easily, but this has not been developed yet.

Where can I find an SSL web monitor?: This monitor is simple to write but requires linking against an SSL library which might be subject to US export regulations and hence is not available.

Does nocol run on windows NT ?: Nope. No plans to port it at this time either.

Who maintains NOCOL ?: This software is currently maintained by Vikas Aggarwal. Numerous authors have made contributions which have been added to the package.