March 2005 - Xymon - Xymon mailman web

[hobbit] Forward Hobbit alarms as SNMP traps?
by David.Gore＠mci.com 08 Mar '05

08 Mar '05

In the near future we may be forced to use an SNMP alarm collection network management platform from Concord Communications. Is it possible to forward Hobbit alarms as SNMP traps to another platform? I can script fairly well in Korn Shell and PERL. Although I used to code in C, I would like to avoid that, it has been too long and I certianly don't want to get back into it. Any suggestions, starting points? ~David

2 1

hobbitd_larrd crash
by blysik＠shutterfly.com 07 Mar '05

07 Mar '05

Hi. So hobbitd_larrd has been crashing on my hobbit install. I don't see any core files anywhere, but I see this in larrd-data.log: 2005-02-23 15:15:25 xfree: Trying to free a NULL pointer2005-02-23 15:15:25 Worker process died with ex it code 134, terminating 2005-02-23 15:25:33 xfree: Trying to free a NULL pointer2005-02-23 15:25:33 Worker process died with ex it code 134, terminating 2005-02-23 16:06:43 Worker process died with exit code 0, terminating 2005-02-23 16:06:43 Could not get shm of size 102400: No such file or directory 2005-02-23 16:06:43 Channel not available I'm using the custom larrd graphs, and I figure the crashes started after I implemented it. Any info I can provide to track this down? Thanks. -- Bruce Z. Lysik <blysik at shutterfly.com> Operations Engineer

2 1

Double recovery messages
by Kevin.Hanrahan＠novainfo.com 07 Mar '05

07 Mar '05

Hi, I am getting double recovery messages. When I get a failed test, I get a single message...as I should but when the service recovers, I get double recovery messages. I have all my alert rules setup as such: $SECURITY=%server1|server2|server3 $SYSADMIN=kevin at domain.com HOST=$SECURITY MAIL $SYSADMIN COLOR=red EXSERVICE=msgs,cpu REPEAT=30m RECOVERED MAIL $SYSADMIN COLOR=red SERVICE=cpu DURATION>20 REPEAT=30m RECOVERED MAIL $SYSADMIN COLOR=purple REPEAT=1h RECOVERED Can anybody see an error I made in syntax? Does anybody else get this symptom? Thanks Kevin Note: The information contained in this email and in any attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. The recipient should check this email and any attachments for the presence of viruses. Sender accepts no liability for any damages caused by any virus transmitted by this email. If you have received this email in error, please notify us immediately by replying to the message and delete the email from your computer. This e-mail is and any response to it will be unencrypted and, therefore, potentially unsecure. Thank you. NOVA Information Systems, Inc.

2 1

yellow/red warnings based on conn time
by idxman01＠gmail.com 07 Mar '05

07 Mar '05

Hello, Is there a way to specify warn/panic thresholds for the ping test? I'm monitoring several routers and would like to send notification to the network admins if things start getting too slow. -r

3 4

[hobbit] Who's using
by Kevin＠ewormhole.com 07 Mar '05

07 Mar '05

Jeff, I have been trying to gather the same info for my VP. I have just watched the signatures at the bottom of the emails and here is what I have seen so far: Domestic Oregon Department of Human Services Raritan Bay Federal Credit Union MSA Software Production Facility Austin Energy Time Warner Cable JEN-A-SyS San Luis Obispo Superior Court Cicada Macrovision Corporation Global Market Insite (GMI) United States Dept. of Agriculture NIBCO, Inc MSA Software Production Facility Hendrick Automotive Group Startouch International LTD Department of Mental Health - Commonwealth of Massachusetts Universities Purdue University University of Virginia, Health System Computing Services Syracuse University, System Infrastructure Services (SIS) International Getronics, The Netherlands Bell Sympatico Centric IT Solutions, Gouda, The Netherlands BASF IT Services GmbH Australian Gov't, Information Management Branch TUSC Computer Systems Pty Ltd, Australia The City of Calgary _____ hope that helps Kevin From: Jeffcoat, Al [mailto:ajeffco at orhs.org] Sent: Friday, March 04, 2005 11:47 PM To: hobbit at hswn.dk Subject: [hobbit] Who's using Importance: Low Hello All, We presented Hobbit to our new director today, in hopes of getting it more widely utilized(he's also looking for a solution to monitor applications running on windows servers on our network, some of which have a serious failure rate.) We have been using it to monitor the UNIX/Big Iron side of the house for about 6 years now, but could never grow it outside of that, for various reasons (free=no support, non-acceptance of unix based products from our windows admins, etc). He really was impressed with Hobbit, and said it's the first time he's seen a presentation where someone wasn't asking for any money and the product was already implemented. During the presentation, he asked who else is using BB/Hobbit. There used to be a client list on the bb4.net page, which is no longer there. So I figured I'd solicit the list to see who else is using Hobbit or BB (commercial or free), to answer the only question he asked that I couldn't. Thank you Al Jeffcoat This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandoregionalorg <mailto:postmaster at orlandoregional.org> . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Regional Healthcare by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Regional Healthcare.

2 1

[hobbit] alerting alternate pagesets
by dstuffle＠deltafaucet.com 07 Mar '05

07 Mar '05

Thanks for the info. Actually, I can see how defining alerts for pagesets could cause page rules to conflict since you could have hosts in multiple pagesets. I don't know, may not even be worth it... BTW, the March archives for this list aren't showing up at http://www.hswn.dk/hobbiton/. Thanks David stuffle -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Sunday, March 06, 2005 12:08 PM To: hobbit at hswn.dk Subject: Re: [hobbit] alerting alternate pagesets On Sun, Mar 06, 2005 at 09:04:24AM -0500, Stuffle, David wrote: > From what I can tell, defining alerts such as "PAGE=os/aix SERVICE=*" > does not work for alternate pagesets. Does the "PAGE" keyword in > alert rules only work on pages in the host file and not the alternate > pagesets? Yes, the PAGE setting in hobbit-alerts.cfg uses the default pagename from bb-hosts - it doesn't know about the alternate pagesets. > I have set up alternate pagesets for AIX, Linux, and Windows, and it > would be nice to be able to define alerts based on these pages. So far, the alternate pagesets have been purely a "display" thing - they only exist in the "mind" of bbgen when creating webpages. The hobbit daemon doesn't know about them. So it's not as easy as it seems to implement this. I'll try to come up with a way of doing it, but it definitely will not be in the upcoming release. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

1 0

DOWNTIME in bb-hosts not working for client-based test
by idxman01＠gmail.com 07 Mar '05

07 Mar '05

Hello, So this weekend was the first time I've had hobbit running during a reboot of two monitored servers and while it didn't alert during the specified DOWNTIME for network tests, it started sending purple messages 30m later when the client-based tests weren't reporting. The bb-hosts entry looks something like: ip host # DOWNTIME:0:0400:0445 ftp ssh etc.. The server reboots at 4am and takes about 12-15 minutes to get moving again. (ibm h70) So a cron starts the cluster at 4:30 which in turn starts the bb client. Bug or something to change in my config? Thank You, -r

3 3

[hobbit] DOWNTIME in bb-hosts not working for client-based test
by dhd733＠yahoo.se 07 Mar '05

07 Mar '05

Every evening I shutdown my bb-client server. I disable all tests. This morning I didn't start the machine before the disabletime runout. I thought I should test the DOWNTIME i bb-hosts, so I put this in: DOWNTIME=*:1800:0700 The connectiontests (conn, ftp and telnet) becam blue but the local tests (cpu, disk....) still was purple. I think this is the same as Robert got. Regards Lars Andy France <Andy at zespri.com> wrote: > ---------- > Från: Andy France[SMTP:ANDY at ZESPRI.COM] > Skickat: den 7 mars 2005 02:51:25 > Till: hobbit at hswn.dk > Ämne: Re: [hobbit] DOWNTIME in bb-hosts not working for client-based test > Automatiskt vidarebefordrat av en regel > > > > > > > See comment below... Robert Edeker wrote on 07/03/2005 14:44:26: > Hello, > So this weekend was the first time I've had hobbit running during a > reboot of two monitored servers and while it didn't alert during the > specified DOWNTIME for network tests, it started sending purple > messages 30m later when the client-based tests weren't reporting. > The bb-hosts entry looks something like: > ip host # DOWNTIME:0:0400:0445 ftp ssh etc.. the manpage for bb-hosts says this should read DOWNTIME=0:0400:0445 > The server reboots at 4am and takes about 12-15 minutes to get moving > again. (ibm h70) So a cron starts the cluster at 4:30 which in turn > starts the bb client. > Bug or something to change in my config? > Thank You, > -r HTH, Andy. ##################################################################################### This email is intended for the person to whom it is addressed only. If you are not the intended recipient, do not read, copy or use the contents in any way. The opinions expressed may not necessarily reflect those of ZESPRI Group of Companies ('ZESPRI'). While every effort has been made to verify the information contained herein, ZESPRI does not make any representations as to the accuracy of the information or to the performance of any data, information or the products mentioned herein. ZESPRI will not accept liability for any losses, damage or consequence, however, resulting directly or indirectly from the use of this e-mail/attachments. ##################################################################################### To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] Odd alerts behavior
by Kevin.Hanrahan＠novainfo.com 06 Mar '05

06 Mar '05

I believe I found it and it was self induced as usual. It was a stinkin typo! I had this: $IDG=%qa-server1|iw-server|econex-dc02|biz-mts-s2|via-ktest-s1|iw-tsite-s1| via-cart-s1 Instead of this: $IDG=%qa-server1|iw-server|econex-dc02|biz-mts-s2|via-ktest-s1|iw-tsite-s1|v ia-cart-s1 That one space at the end did it so my advice to all.....don't do this!! Thanks KEvin -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Sunday, March 06, 2005 5:23 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Odd alerts behavior On Sun, Mar 06, 2005 at 05:03:32PM -0500, Kevin.Hanrahan at novainfo.com wrote: > When I get to a certain amount of entries, (I haven't narrowed it down > to how many yet), it appears to double all entries for all servers so > that I now get TWO emails for each event. This is also reflected in > the "Info" area for all servers! > > Is there a diagnostic I can use to see if I am making a syntax or > proceedure error? This is driving me nuts! Add "--cfid" to the hobbitd_alert commandline in hobbitlaunch.cfg. This will add "[cfid:N]" to the e-mail subject; "N" is the linenumber in the config file that triggered the alert. Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk Note: The information contained in this email and in any attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. The recipient should check this email and any attachments for the presence of viruses. Sender accepts no liability for any damages caused by any virus transmitted by this email. If you have received this email in error, please notify us immediately by replying to the message and delete the email from your computer. This e-mail is and any response to it will be unencrypted and, therefore, potentially unsecure. Thank you. NOVA Information Systems, Inc.

1 0

Odd alerts behavior
by Kevin.Hanrahan＠novainfo.com 06 Mar '05

06 Mar '05

I am getting some very odd alerts behavior. I have everything setup using macros like this: $AV=%sserver1|server2|server3|server4|server5 $SYSADMIN=kevin.hanrahan at domain.com HOST=$AV MAIL $SYSADMIN COLOR=red EXSERVICE=msgs,cpu REPEAT=30m RECOVERED MAIL $SYSADMIN COLOR=red SERVICE=cpu DURATION>20 REPEAT=30m RECOVERED MAIL $SYSADMIN COLOR=purple REPEAT=1h RECOVERED I have this repeated for multiple groups of servers. I have been adding one server group in the HOST definitions one by one and all appeared fine. Also checking the "Info" column for each server I saw the proper alerts definition reflected there. When I get to a certain amount of entries, (I haven't narrowed it down to how many yet), it appears to double all entries for all servers so that I now get TWO emails for each event. This is also reflected in the "Info" area for all servers! Is there a diagnostic I can use to see if I am making a syntax or proceedure error? This is driving me nuts! Thanks KEvin Note: The information contained in this email and in any attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. The recipient should check this email and any attachments for the presence of viruses. Sender accepts no liability for any damages caused by any virus transmitted by this email. If you have received this email in error, please notify us immediately by replying to the message and delete the email from your computer. This e-mail is and any response to it will be unencrypted and, therefore, potentially unsecure. Thank you. NOVA Information Systems, Inc.

2 1