February 2005 - Xymon - Xymon mailman web

[hobbit] Escalated alerts - necessary ?
by brent.mccrackin＠bell.ca 14 Feb '05

14 Feb '05

It's a requirement as far as my setup is concerned. We have the regular first-line pagers that get the alerts and can acknowledge as they start working on the issue. Some hosts and services are of higher priority within the company, and if they're down for an extended period of time, upper management wants to get a notification regardless of the ACK status. Its usually expected that the person with the pager has already done this before BB sends an alert to management, but when troubleshooting a difficult problem time can fly quite quickly. The management can then go to the webpage, view the acked alert and see who acked it (based on the ID code) and contact them for a status report. This saves management the hassle of contacting all the pagers to find out who is working on a downed service, because they've been identified by the ACK code pager ID. With several different pagers in the group, management either needs to know which pager a particular host and service alert is sent to, or otherwise be able to easily identify who got paged and is working on the issue. I also use an extension to the bb-ack page which lists all current alerts with their codes and which pager address or phone number the alert was sent to. If an alert hasn't been acked, management can go there and see who should have been responding to the issue. This has also been a handy place to send ACKs to multiple alerts at once. The addition of the INFO column in BBGEN nicely displays what pagers a host and its services will send to, and this has also been a help to management. --- Brent B McCrackin UNIX Systems Specialist - Bell Sympatico Brent.McCrackin at Bell.ca PH: 416-353-0692 "Serenity through viciousness." -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: February 14, 2005 11:37 AM To: hobbit at hswn.dk Subject: [hobbit] Escalated alerts - necessary ? I changed the subject, because this is a somewhat different issue that the rest of the mail Brent wrote: On Mon, Feb 14, 2005 at 09:39:52AM -0500, brent.mccrackin at bell.ca wrote: > A feature I'd like to see is the ability to allow an identified > acknowledge of an alert based on the two-digit code, that stops alerts > for all recipients except escalation recipients (those being the people > that need to be alerted if a downed service is not fixed after a > specific time period regardless of someone working on it). This would > do away with the need for a '99' acknowledge to stop alerts for > everyone, and let the person responding to the alert work on fixing it > faster (at least until the escalation person starts asking for status > reports). Hobbit does not have the concept of "escalating" an alert that BB has. I didn't fully understand what the BB's idea of "escalating" an alert meant, until I read Brent's message. I see that it could be useful, but also that it will be somewhat tricky to implement with the current design of Hobbit's alert-module. So - how much do you use it ? Do you need to have alerts going out for problems that have been acknowledged ? Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] ACK with Delay
by brent.mccrackin＠bell.ca 14 Feb '05

14 Feb '05

We use RIM pagers to receive our BB alerts. This allows us to acknowledge alerts by replying to the message, and the bb-mailack script takes care of everything else - including using the ACK code to identify the user that is performing the ACK. Granted, using the email address could be worked into the script, but everything that I have in place now uses the ACK code as generated by BB with dependencies on the Pager ID in the code. Not every alert comes in through the web interface. Would it be posisble to 'preconfigure' the pager codes? Instead of having Hobbit generate the codes based on position in the matched rules list, define the ID codes in advance in the config files. Then we always know which ID belongs to which pager, regardless of how the rules are built. --- Brent B McCrackin UNIX Systems Specialist - Bell Sympatico Brent.McCrackin at Bell.ca PH: 416-353-0692 "Serenity through viciousness." -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: February 14, 2005 11:30 AM To: hobbit at hswn.dk Subject: Re: [hobbit] ACK with Delay On Mon, Feb 14, 2005 at 09:39:52AM -0500, brent.mccrackin at bell.ca wrote: > > The ACKCODE in BB is made up of a 5-digit alert code and a 2-digit pager > code to identify who the alert was sent to. The 5-digit alert code is > the same for all recipients of that alert. The pager code would change > depending on the sequence that the matching rule was encountered in the > bb-warnrules configuration. Replacing the provided pager code with a 99 > in the ACK input would acknowledge the alert for all recipients (except > the escalation ones marked with ^). > > Is this feature retained in Hobbit? No. the acknowledgement cookie in Hobbit only identifies a host+service. The same ack-cookie is sent to everyone who is alerted. The main reason Hobbit does not generate unique cookies for each recipient is that to do so, the core daemon (hobbitd) and the alert module (hobbitd_alert) would have to be a lot more aware of each other than they are now. > If not, how do we identify who acknowledged an alert? Make sure you include that information in the ack message you provide when ack'ing the alert. I admit that this isn't something I've given much thought, because it isn't a real problem for me. But I've just added a bit of code to the bb-ack CGI, so if you have the acknowledgement web form in the secure CGI directory (which is the default setup), then the username used to login to the secure area will be included in the ack-message, and shown on the status page. If that is not good enough, then we'll have to discuss how to do it for the next release. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

Escalated alerts - necessary ?
by henrik＠hswn.dk 14 Feb '05

14 Feb '05

I changed the subject, because this is a somewhat different issue that the rest of the mail Brent wrote: On Mon, Feb 14, 2005 at 09:39:52AM -0500, brent.mccrackin at bell.ca wrote: > A feature I'd like to see is the ability to allow an identified > acknowledge of an alert based on the two-digit code, that stops alerts > for all recipients except escalation recipients (those being the people > that need to be alerted if a downed service is not fixed after a > specific time period regardless of someone working on it). This would > do away with the need for a '99' acknowledge to stop alerts for > everyone, and let the person responding to the alert work on fixing it > faster (at least until the escalation person starts asking for status > reports). Hobbit does not have the concept of "escalating" an alert that BB has. I didn't fully understand what the BB's idea of "escalating" an alert meant, until I read Brent's message. I see that it could be useful, but also that it will be somewhat tricky to implement with the current design of Hobbit's alert-module. So - how much do you use it ? Do you need to have alerts going out for problems that have been acknowledged ? Regards, Henrik

1 0

[hobbit] ACK with Delay
by brent.mccrackin＠bell.ca 14 Feb '05

14 Feb '05

I think the question was asking if the unique pager identifier is available in Hobbit. The ACKCODE in BB is made up of a 5-digit alert code and a 2-digit pager code to identify who the alert was sent to. The 5-digit alert code is the same for all recipients of that alert. The pager code would change depending on the sequence that the matching rule was encountered in the bb-warnrules configuration. Replacing the provided pager code with a 99 in the ACK input would acknowledge the alert for all recipients (except the escalation ones marked with ^). Is this feature retained in Hobbit? If not, how do we identify who acknowledged an alert? A feature I'd like to see is the ability to allow an identified acknowledge of an alert based on the two-digit code, that stops alerts for all recipients except escalation recipients (those being the people that need to be alerted if a downed service is not fixed after a specific time period regardless of someone working on it). This would do away with the need for a '99' acknowledge to stop alerts for everyone, and let the person responding to the alert work on fixing it faster (at least until the escalation person starts asking for status reports). --- Brent B McCrackin UNIX Systems Specialist - Bell Sympatico Brent.McCrackin at Bell.ca PH: 416-353-0692 "Serenity through viciousness." -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: February 14, 2005 1:44 AM To: hobbit at hswn.dk Subject: Re: [hobbit] ACK with Delay On Sun, Feb 13, 2005 at 09:07:33PM -0500, Asif Iqbal wrote: > > Is the ACKCODE same for all recipients? I know in bigbrother it was > different for different reciepent so you can either delay it for all OR > delay it for specific reciepient They are the same for all recipients. Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

2 1

Installing hobbit
by lars.ebeling＠duni.se 14 Feb '05

14 Feb '05

Dear all, I started to install Hobbit (RC2) and found out that something called pcre was needed. Downloaded it and started to install it. Configure went well so also make. But make install gave some errors and was aborted. see below I'm using HP-UX 11.11 larrd 0.43c Could someone help me? Regards Lars Ebeling Hobby installing Hobbit at home /bin/sh ./mkinstalldirs /usr/local/lib echo "/bin/sh ./libtool --mode=install /usr/local/larrd/install -c libpcre.la /" /bin/sh ./libtool --mode=install /usr/local/larrd/install -c libpcre.la /usr/loa /bin/sh ./libtool --mode=install /usr/local/larrd/install -c libpcre.la /usr/loa /usr/local/larrd/install -c .libs/libpcre.sl.0.1 /usr/local/lib/libpcre.sl.0.1 /usr/local/larrd/install[2]: =: not found. /usr/local/larrd/install[4]: use: not found. /usr/local/larrd/install[5]: =: not found. /usr/local/larrd/install[6]: Syntax error at line 6 : `(' is not expected. make: *** [install] Error 127

1 0

Hobbit Release candidate 2 available
by henrik＠hswn.dk 14 Feb '05

14 Feb '05

Release candidate 2 of Hobbit is now available on http://sourceforge.net/projects/hobbitmon/ This fixes a series of bugs, most notably some bugs in the alert module, the "iishealth" RRD handler, and a crash of the bbtest-net tool when two or more hosts had the "apache" test enabled. An RRD handler for the "temperature" reports was added to hobbitd_larrd, and a plug-in mechanism was added so you can fairly easily add graphs for custom data you may be using. The hobbitgraph CGI tool has been enhanced with a "zoom" function taken from the "Cacti" project (which is also GPL). This will be enhanced further after version 4.0 is released; the current version only supports zooming in on a period of time. And the generated HTML was cleaned up, so hopefully everything is now HTML 4.0 compliant. Full changelog below. Please beat on this - I hope this will be the last release candidate, so the next announcement is for the full 4.0 release. Regards, Henrik Changes from RC-1 -> RC-2 ------------------------- Bugfixes: * The alert module now gets color changes that move a status from critical (alert) state into a not-yet-recovered state. So if you only want pages on red, you should no longer see pages when it goes from red to yellow. * Alert rules with a color specification followed by some other criteria would ignore the color spec. * Alerts would only get repeated when a new message arrived, not necessarily with the interval set by the REPEAT configuration. * The alert configuration file was reloaded every time. It should now only reload when it has been changed. This caused a noticable change in hobbitd_alert's CPU usage. * A MAIL recipient can now have multiple recipients. * The "iishealth" RRD handler was broken. * DHCP hosts (those that have an IP of 0.0.0.0) are allowed to report their status from any IP. * The bb-eventlog CGI was cleaned up (now it actually works!) and a proper submission form and menu item were added. * bbtest-net would crash when multiple "apache" tests were defined. * The bb-ack.sh CGI - when located in the secure CGI area - was posting to bb-ack.sh in the unsecure CGI directory. Changed so it always posts to the same location it was originally called from. Improvements: * Lots of small tweaks to the HTML templates and some code, to ensure that all HTML generated is HTML 4.0 compliant. Thanks to Firefox and the HTML Validator plugin! * hobbitgraph.cgi enhanced with a "zoom-in" function taken from the Cacti project. This allows zooming in on a period of time. Zoom on both axis (time and value) will be implemented in the next version of Hobbit, since it requires a modification to the RRDtool library; this is too large a change to add currently. * A handler for the "temperature" reports was added to hobbitd_larrd. * An external handler mechanism was implemented for hobbitd_larrd, so users can add their own graphs without having to do C coding. * The "bbcmd" utility now loads the standard hobbitserver.cfg environment if no "--env" setting is used on the command line. * The default for the "find host" form was changed to do a case-insensitive match (since hostnames do not normally care about upper- or lower-case).

5 10

ACK with Delay
by iqbala-hobbit＠qwestip.net 14 Feb '05

14 Feb '05

How do you send an ACK with Delay through the email in Hobbit? Should I need to use BB commands? Does it generate any ACK Code that I can associate with BB command to delay? Thanks for the help -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu "...it said: Install Windows XP or better...so I installed Solaris..."

2 8

[hobbit] Hobbit Release candidate 2 available
by Kevin＠ewormhole.com 14 Feb '05

14 Feb '05

Excellent, thank you. I will read it. On more odd property of the "upgrade" was that the Event Log Report was not available. It did not even show up in the menu. After doing the make setup, it appeared. More testing to follow....thanks KEvin -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Sunday, February 13, 2005 5:58 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Hobbit Release candidate 2 available Importance: Low On Sun, Feb 13, 2005 at 05:40:33PM -0500, Kevin Hanrahan wrote: > You were correct!...as usual! Running the make setup did it! This was > the first time I did an upgrade instead of a clean install. OK, that's one of the "rough edges" of using multiple beta-releases on top of each other. > On another note, Where can I get more info about this other feature > you mentioned to make your own graphs? What is required? How do I do it? "man hobbitd_larrd", in the "CUSTOM RRD DATA" section. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] Hobbit Release candidate 2 available
by Kevin＠ewormhole.com 13 Feb '05

13 Feb '05

You were correct!...as usual! Running the make setup did it! This was the first time I did an upgrade instead of a clean install. On another note, Where can I get more info about this other feature you mentioned to make your own graphs? What is required? How do I do it? Thanks Henrik Kevin -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Sunday, February 13, 2005 5:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Hobbit Release candidate 2 available Importance: Low On Sun, Feb 13, 2005 at 04:05:37PM -0500, Kevin Hanrahan wrote: > > OK, I have got to be doing something wrong here. I cannot get the "zoom" > feature to work at all. All I see is a broken link in I.E. and using > Mozilla-firefox I get a simple hyperlink that allows me to do nothing > with the graph. I never see the "glass" icon and I cannot get a zoom > function at all. It's probably just a couple of new files that didn't get installed when you ran "make install" (the ~/server/web/zoom.js and ~/server/www/gifs/zoom.gif). Try running a "make setup" and it should get everything straightened out. Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

2 1

[hobbit] Hobbit Release candidate 2 available
by Kevin＠ewormhole.com 13 Feb '05

13 Feb '05

Sorry, My last post was a mistaken reply to a different problem. OK, I have got to be doing something wrong here. I cannot get the "zoom" feature to work at all. All I see is a broken link in I.E. and using Mozilla-firefox I get a simple hyperlink that allows me to do nothing with the graph. I never see the "glass" icon and I cannot get a zoom function at all. I am using: RH 7.2 Hobbit RC2 (upgrade) Kevin

2 1