June 2005 - Xymon - Xymon mailman web

[hobbit] Unexpected service response
by mlowery＠alliedtechgroup.com 23 Jun '05

23 Jun '05

Michael Lowery, MCSE/CCNP Allied Technology Group, LLC. 501.372.4909 ext. 223 Yes, the strange thing is that they all give the 501 error, except Exchange servers, which give a 502 response. They all were returning the 220 message, in the banner, though. I have changed the smtp test to the following, and I get green, no flapping between Yellow and green anymore in the history files either. Is the test just wrong by default, or should I be concerned that I had to change it from the default? [smtp] send "ehlo hostname.domainname.com\r\nquit\r\n" expect "220" options banner port 25 -----Original Message----- From: Thomas [mailto:tlp-hobbit at holme-pedersen.dk] Sent: Friday, June 10, 2005 2:32 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Unexpected service response Have you tried to do a telnet to the host on port 25 and type the commands to see the responce ? Br Thomas Lowery, Michael wrote: >Well, I've upgraded to Hobbit 4.0.4 and I'm still having smtp testing >issues. I'm hoping someone can help me figure out why this is happening >and guide me in the right direction. > >The problem is that I get Yellow results for a host that I'm running the >smtp test on. The server is running postfix and I thought that >information might be relevant, but it apparently isn't. This is >happening on all my smtp servers, but this is the only host that remains >Yellow. The others are always green, but have the same symptoms in >their history files. > >The error I get is "Unexpected service response" on the hobbit page. > >In bb-services I have: >[smtp] > send "mail\r\nquit\r\n" > expect "220" > options banner > port 25 > >In the hist file for the hosts, I get messages like the following: > >Wed Jun 8 23:20:11 2005 yellow 1118290811 38 >Wed Jun 8 23:20:49 2005 green 1118290849 262 >Wed Jun 8 23:25:11 2005 yellow 1118291111 38 >Wed Jun 8 23:25:49 2005 green 1118291149 262 >Wed Jun 8 23:30:11 2005 yellow 1118291411 38 >Wed Jun 8 23:30:49 2005 green 1118291449 263 >Wed Jun 8 23:35:12 2005 yellow 1118291712 20405 >Thu Jun 9 05:15:17 2005 green 1118312117 302 >Thu Jun 9 05:20:19 2005 yellow 1118312419 30 >Thu Jun 9 05:20:49 2005 green 1118312449 268 >Thu Jun 9 05:25:17 2005 yellow 1118312717 33 >Thu Jun 9 05:25:50 2005 green 1118312750 267 >Thu Jun 9 05:30:17 2005 yellow 1118313017 33 >Thu Jun 9 05:30:50 2005 green 1118313050 268 >Thu Jun 9 05:35:18 2005 yellow 1118313318 32 >Thu Jun 9 05:35:50 2005 green 1118313350 268 >Thu Jun 9 05:40:18 2005 yellow 1118313618 31 >Thu Jun 9 05:40:49 2005 green 1118313649 269 >Thu Jun 9 05:45:18 2005 yellow 1118313918 31 >Thu Jun 9 05:45:49 2005 green 1118313949 272 >Thu Jun 9 05:50:21 2005 yellow 1118314221 100607 >Fri Jun 10 09:47:08 2005 green 1118414828 297 >Fri Jun 10 09:52:05 2005 yellow 1118415125 10 >Fri Jun 10 09:52:15 2005 green 1118415135 292 >Fri Jun 10 09:57:07 2005 yellow 1118415427 20 >Fri Jun 10 09:57:27 2005 green 1118415447 279 >Fri Jun 10 10:02:06 2005 yellow 1118415726 31 >Fri Jun 10 10:02:37 2005 green 1118415757 268 >Fri Jun 10 10:07:05 2005 yellow 1118416025 44 >Fri Jun 10 10:07:49 2005 green 1118416069 256 >Fri Jun 10 10:12:05 2005 yellow 1118416325 49 >Fri Jun 10 10:12:54 2005 green 1118416374 251 >Fri Jun 10 10:17:05 2005 yellow 1118416625 56 >Fri Jun 10 10:18:01 2005 green 1118416681 244 >Fri Jun 10 10:22:05 2005 yellow 1118416925 1202 >Fri Jun 10 10:42:07 2005 green 1118418127 299 >Fri Jun 10 10:47:06 2005 yellow 1118418426 55 >Fri Jun 10 10:48:01 2005 green 1118418481 244 >Fri Jun 10 10:52:05 2005 yellow 1118418725 61 >Fri Jun 10 10:53:06 2005 green 1118418786 243 >Fri Jun 10 10:57:09 2005 yellow 1118419029 62 >Fri Jun 10 10:58:11 2005 green 1118419091 239 >Fri Jun 10 11:02:10 2005 yellow 1118419330 11 >Fri Jun 10 11:02:21 2005 green 1118419341 286 >Fri Jun 10 11:07:07 2005 yellow 1118419627 25 >Fri Jun 10 11:07:32 2005 green 1118419652 273 >Fri Jun 10 11:12:05 2005 yellow 1118419925 41 >Fri Jun 10 11:12:46 2005 green 1118419966 259 >Fri Jun 10 11:17:05 2005 yellow 1118420225 51 >Fri Jun 10 11:17:56 2005 green 1118420276 249 >Fri Jun 10 11:22:05 2005 yellow 1118420525 10703 > >Any help is greatly appreciated. > >Thanks, >Michael > >-----Original Message----- >From: Lowery, Michael >Sent: Tuesday, June 07, 2005 8:00 AM >To: hobbit at hswn.dk >Subject: RE: [hobbit] Unexpected service response > >Ok, this may have been a stupid question, I don't know. But after >further investigations, I see that this happens quite a bit on the other >SMTP servers as well, they just report it occasionally and not long >enough for me to be notified. There is only one host that constantly >reports this. > >Is there something I should change in the way the test works to avoid >getting the "Unexpected service response" message? > > >Thanks, >Michael > > >-----Original Message----- >From: Lowery, Michael >Sent: Monday, June 06, 2005 1:51 AM >To: hobbit at hswn.dk >Subject: [hobbit] Unexpected service response > >I've never had a problem with the SMTP test before. Now, testing a >postfix mail server, I get a Yellow alert, and the page says: > >Service smtp on mail.domain.com is not OK : Unexpected service response > > >501 Syntax error in parameters or arguments > > > >I can telnet to port 25 on this server with no problems from the hobbit >server, I get a 220 message upon connect. Here is exactly what I get >(names and IPs changed to protect the innocent). So what can be the >problem here? > >[root at hobbit etc]# telnet mail.domain.com 25 >Trying 20.30.40.51... >Connected to adsl-20-30-40-51.dsl.hometown.isp.net (20.30.40.51). >Escape character is '^]'. >220 SMTP service ready > >Thanks, >Michael > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > > > -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.4 - Release Date: 06-06-2005 To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 3

NT Client trend graphs
by caboyce＠rodney.govt.nz 23 Jun '05

23 Jun '05

Hi, I have moved from BB to hobbit and am having problems getting the memory data graphed from all the windows clients, There is no graph being generated for memory while Cpu and Disk are. I have also added Henrik's Citrix script and these stats are not being passed through. I have checked the LARRDS and GRAPHS section of hobbitserver.cfg and the entries to graph these items are enabled by default. I have enabled the debug options for larrdstatus and larrddata, In checking the log files I can see no entries for the client memory or the citrix stats. Any Ideas. Thanks Craig Boyce ##################################################################################### Disclaimer: The information in this electronic mail message is confidential and may be legally privileged. It is intended solely for the Addressee.Access to this internet electronic mail message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you have received this message in error please notify us immediately. Rodney District Council accepts no responsibility for any effects this email message or attachments has on the recipient network or computer system. #####################################################################################

4 3

[hobbit] Multiple Views
by craig＠cookitservices.com 22 Jun '05

22 Jun '05

An embedded and charset-unspecified text was scrubbed... Name: not available URL: <http://lists.xymon.com/pipermail/xymon/attachments/20050622/91f161f3/attach…>

1 0

Multiple Views
by Al.Jeffcoat＠orhs.org 22 Jun '05

22 Jun '05

Hello All, I've got a question... And I apologize ahead of time if it's been covered already. We have been running bb/hobbit for some time. First it was on UNIX only, because the windows admins didn't like it. Then our execs saw it, and liked it. They then mandated that all systems will be monitored by hobbit. Here's where the problem starts. Windows has been generating a lot of red events. The execs overreact to red events that are really not problems. We've tired to explain that just because something is red, doesn't mean that a system is down. The windows admins are tuning it down as best as they can, but it still happens. So my thought was to have two hobbit's, one that receives client data for our engineers to see and work with, and then another that just does the network tests, and this would be what our execs see. Both would be sitting on the same server, running in separate directories, and separate virtual servers. What I'm trying to get to is two views, an executive view, and a technical view. Has anyone done something like this? Is there a better way within hobbit itself? TIA __________________________________ Al Jeffcoat This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandoregional.org . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Regional Healthcare by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Regional Healthcare.

4 3

[hobbit] System Log Monitoring
by Larry.Barber＠usda.gov 22 Jun '05

22 Jun '05

Enter the phrases you want to look for in the bb-msgtab file in your BB client's etc directory. Thanks, Larry Barber On Wed, 2005-06-22 at 09:26 -0500, callahant at tessco.com wrote: > Morning all, > Is there a way to monitor for certain key words that show up in > the > system logs? ie. I would like for hobbit to page me "iff" the words > "FAILOVER", "LOOP DEAD", and "LOOP DOWN" are detected in the > /var/logs/messages file on our Linux machines. > > Let me know if this is possible. > > Thanks, > Tom Callahan > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

1 0

System Log Monitoring
by callahant＠tessco.com 22 Jun '05

22 Jun '05

Morning all, Is there a way to monitor for certain key words that show up in the system logs? ie. I would like for hobbit to page me "iff" the words "FAILOVER", "LOOP DEAD", and "LOOP DOWN" are detected in the /var/logs/messages file on our Linux machines. Let me know if this is possible. Thanks, Tom Callahan

1 0

hobbitd status-board not available
by tlp-hobbit＠holme-pedersen.dk 22 Jun '05

22 Jun '05

Running Hobbit 4.0.4 on RHEL linux in a kinda special way. I have 2 BBNET servers, one server is also the BBDISPLAY server. On the BBNET server without display I am running hobbit basicly only bbnet process. On this host I am also running bbproxy for my production BBDISPLAY and my test BBDISPLAY (third seperate server). Now the problem started when I decided to "upgrade" the hobbit BBNET only server to also be a BBDISPLAY server. I did this by starting hobbit on port 1986 (--listen=172.17.110.20:1986) along with the bbdisplay/histry/lard etc processes and then add a third bbdisplay server to my bbproxy configuration (--bbdisplay=172.17.110.20:1986). Hobbitd.log and hobbitlaunch.log are fine - no errors - but on my "primary" BBDISPLAY I now have the above line as status. I tried to add --debug to the hobbitd and bbdisplay configurations in hobbitlaunch.cfg but this crashed. Tried to disable the HEARTBEAT in hobbitlaunch but this did not solve the problem. If I stop hobbit the state is written to the tmp/hobbit.chk file and started again has the saved state. If this was not enough the "new" BBDISPLAY is making the headlines but no hosts. :-( Any help is appresiated. BR Thomas

2 2

Redundant Hobbit Servers
by mlowery＠alliedtechgroup.com 21 Jun '05

21 Jun '05

I'm interested in knowing what everyone is doing for redundancy. I currently have 2 hobbit servers and each one performs the same tests as the other. I find this to be a bit wasteful and am looking for the active/passive type of configuration that has been talked about on this list before. This configuration works fine, except for alerting. In order to not be overwhelmed by messages, I only have one hobbit server performing the alerting task, the other only sends alerts on the other hobbit host. I have considered using the "depends=" test, but then I have to maintain two separate bb-hosts files, rather than copying and pasting from one to the other. Is there a better way than what I'm doing? My goal is to have both servers configured the same, as much as possible, and have only one of them at a time send me alerts. I'd love to know what you guys are doing to get around these limits. I could easily have missed something in the newest update that solves this problem, but I haven't seen it yet. Thanks for your thoughts on this subject. Michael

3 2

[hobbit] Redundant Hobbit Servers
by Scott.Kelley＠disney.com 21 Jun '05

21 Jun '05

We are moving to running all our monitoring services in (VMWare) virtual machines. The vm's are backed up each night to a NAS share. If the physical server dies, no big deal I can just start the vm on another host connected to the same SAN. If the SAN dies (unlikely), I can restore the vm from the backup on some other host. We also run Sitescope, which alerts us if BigBrother/Hobbit dies (and vice versa). -- Scott Kelley, Disney Enterprise IT Platform Services -----Original Message----- From: hobbit-return-2800-Scott.Kelley=disney.com at hswn.dk [mailto:hobbit-return-2800-Scott.Kelley=disney.com at hswn.dk] On Behalf Of Lowery, Michael Sent: Tuesday, June 21, 2005 9:13 AM To: hobbit at hswn.dk Subject: [hobbit] Redundant Hobbit Servers I'm interested in knowing what everyone is doing for redundancy. I currently have 2 hobbit servers and each one performs the same tests as the other. I find this to be a bit wasteful and am looking for the active/passive type of configuration that has been talked about on this list before. This configuration works fine, except for alerting. In order to not be overwhelmed by messages, I only have one hobbit server performing the alerting task, the other only sends alerts on the other hobbit host. I have considered using the "depends=" test, but then I have to maintain two separate bb-hosts files, rather than copying and pasting from one to the other. Is there a better way than what I'm doing? My goal is to have both servers configured the same, as much as possible, and have only one of them at a time send me alerts. I'd love to know what you guys are doing to get around these limits. I could easily have missed something in the newest update that solves this problem, but I haven't seen it yet. Thanks for your thoughts on this subject. Michael To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] only alert if X number of hosts are already in error
by blysik＠shutterfly.com 20 Jun '05

20 Jun '05

> My best suggestion would be to use the bbcombotest tool to define > a pseudo "host" with the combined status of your host "pool". > > E.g. if you're monitoring http on 5 hosts, you could define a > combination test like this: > > Pool1.http=(hostA.http+hostB.http+hostC.http+hostD.http+hostE.http)>3 > > That would give you a red alert if 3 or fewer hosts in the pool were > green. And you could then trigger an alert based on that test result. Pretty unwieldy when you have large pools of servers, however. I just started writing a smart paging script which will keep track of downed hosts and decide whether or not to page. One question I have so far is: Does hobbit wait for an alerting script to return before continuing to evaluate other rules? -- Bruce Z. Lysik <blysik at shutterfly.com> Operations Engineer The information contained in this message (including any attachments) may be confidential. This message (including any attachments) is intended to be read only by the recipient(s) to whom it is addressed. If the reader of this message is not the intended recipient, you are on notice that any distribution of this message, in any form, is strictly prohibited. If you have received this message in error, please immediately notify the sender and/or Shutterfly by telephone at (650) 610-5200 and delete or destroy any copy of this message (including any attachments).

3 2