August 2005 - Xymon - Xymon mailman web

[hobbit] System Log Monitoring
by jason.kruse＠teldta.com 12 Aug '05

12 Aug '05

> -----Original Message----- > From: henrik at hswn.dk [mailto:henrik at hswn.dk] > > Also, I'd really like to have some mechanism for alerting different > people depending on what log-entry triggers an alert. (Same goes for > the "procs" and perhaps "disk" olumns, by the way - but I know how > to implement that). > > So ideas and suggestions are welcome. I hacked up big brother to do this and was going to try to get this for hobbit when I had free time. I'd post code but I'm not sure if I'm legally allowed. I created a new config file I called the twitchtab. Each entry was: Hostname ; service ; specific item ; people to page ; people to not page I have a wrapper script that parses each service and the warnrules to create the people to page/ignore entry to put in the file. This needs to be consistent with warnrules since I trigger the check after a match of a notification being sent. Messages have a specific item of 'file : " string you matched on "'. I use perl so some of this might be harder in C. Basically I read until '&pagelevel /filename (scanned at ...)', parse the filename and set a hash with the list of recipients. I then read until the next &color /filename, checking each line to see if our string is found. Each line is treated as having it's own list of recipients with a tally being done at the end to find who really gets notified. At the end I walk the hash and create the final list of recipients. Usually it's the same list as the beginning since it's hard to account for all items that may be put in the log. Anyhow, I'm really looking forward to this since it would be one less thing I need to support myself. Jason

1 0

Hobbit Client (newbie questions)
by KSawyer＠Wabtec.com 12 Aug '05

12 Aug '05

I am new with Hobbit and Linux as a whole. I have configured the server and am monitoring several network devices and servers for connectivity. I have also set up the client on a Windows server and am monitoring that successfully with the BB windows client. I am having trouble configuring the client side to work on the server and installing the hobbit-client on additional servers. Note I have not installed the client just the server. Do I need to install the client side on the server or is it part of the package? On the server I have configured the ../client/etc/bb-dftab to warn at an extremely low number (5) /:5:20 for testing, but I am not getting any warning. I have run "service hobbit force-reload" thinking it should reload the config files and also tried to restarted the hobbit service. I have also tried to install the hobbit client on another FC4 server and have been unsuccessful. Can someone point me in the right direction for any docs for client installs? Thanks for all of the help on advance. Kevin

1 0

[hobbit] hobbit-clients.cfg bug?
by Erwin.Furth＠Postbankmail.nl 12 Aug '05

12 Aug '05

David, >From the comments in hobbit-clients.cfg (hobbit v4.1.1): ... # PROC processname minimumcount maximumcount color ... # To check for a process that must NOT be running: Set minimum and # maximum to 0. ... Your lines check for a minimum of 0 processes but specify no maximum. I suggest you try PROC "%some_1_proc" 0 0 red PROC "%some_2_proc" 0 0 red PROC "%some_3_proc" 0 0 red to get a red alarm when you have more than 0 processes. Erwin Furth -----Original Message----- From: David Gore [mailto:David.Gore at mci.com] Sent: vrijdag 12 augustus 2005 6:18 To: hobbit at hswn.dk Subject: [hobbit] hobbit-clients.cfg bug? hobbit-clients.cfg: PROC "%some_1_proc" 0 PROC "%some_2_proc" 0 PROC "%some_3_proc" 0 web page: green %some_1_proc (found 1, req. none) green %some_2_proc (found 1, req. none) green %some_3_proc (found 1, req. none) I would have hoped that the processes would have alarmed 'red' since I was expecting 0 processes? I was trying to mimic the '!' function from BB in bb-proctab. -- David Gore (v965-3670) Enhanced Technology Support (ETS) Network Management Systems (NMS) IMPACT Transport Team Lead - SCSA, SCNA Page: 1-800-PAG-eMCI pin 1406090 Vnet: 965-3676 To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------

2 1

Problems starting snapshot install...
by rgordonjr＠gmail.com 12 Aug '05

12 Aug '05

Hello - I downloaded the latest snapshot tonight and was able to compile and install it. I am running into a problem starting it however. When I execute the hobbit.sh start (or restart) it appears to execute correctly however nothing appears on the website. In looking through the logs I found the following: 2005-08-10 07:06:17 Loading hostnames 2005-08-10 07:06:17 Loading saved state 2005-08-10 07:06:17 Setting up network listener on 0.0.0.0:1984 2005-08-10 07:06:17 Setting up signal handlers 2005-08-10 07:06:17 Setting up hobbitd channels 2005-08-10 07:06:17 Could not attach shm Too many open files 2005-08-10 07:06:17 Cannot setup client channel 2005-08-10 07:06:17 Task hobbitd terminated, status 1 Any ideas? -- --==[ Bob Gordon ]==--

4 16

Error making latest snapshot
by lars.ebeling＠leopg9.no-ip.org 12 Aug '05

12 Aug '05

Hi Got this while making latest snapshot: cc -g -O -D_REENTRANT -DHPUX -I. -I/home/hobbit/snapshot/include -I/usr/local/include -c -o bbproxy.o bbproxy.c bbproxy.c:19:85: sys/select.h: No such file or directory makeÄ1Å: *** Äbbproxy.oÅ Error 1 makeÄ1Å: Leaving directory é/home/hobbit/snapshot/bbproxy' make: *** Äbbproxy-buildÅ Error 2 Regards Lars Ebeling http://leopg9.no-ip.org Hobbithobbyist "Never run after your own hat. Others will be delighted to do it; why spoil their fun?" -- Mark Twain

1 0

[hobbit] hobbit-clients.cfg bug?
by David.Gore＠mci.com 12 Aug '05

12 Aug '05

hobbit-clients.cfg: PROC "%some_1_proc" 0 PROC "%some_2_proc" 0 PROC "%some_3_proc" 0 web page: green %some_1_proc (found 1, req. none) green %some_2_proc (found 1, req. none) green %some_3_proc (found 1, req. none) I would have hoped that the processes would have alarmed 'red' since I was expecting 0 processes? I was trying to mimic the '!' function from BB in bb-proctab. -- David Gore (v965-3670) Enhanced Technology Support (ETS) Network Management Systems (NMS) IMPACT Transport Team Lead - SCSA, SCNA Page: 1-800-PAG-eMCI pin 1406090 Vnet: 965-3676

1 0

[hobbit] hobbitd_client core
by David.Gore＠mci.com 12 Aug '05

12 Aug '05

Sometimes it's up for no more than a couple hours, sometimes it's up and running for more than 12 hours. Sorry, I should have included that it alarms on the hobbit server web page with: - Program crashed Fatal signal caught! hobbit at hobbit:/export/home/hobbit/server> file tmp/core tmp/core: ELF 32-bit MSB core file SPARC Version 1, from 'hobbitd_client' hobbit at hobbit:/export/home/hobbit/server> gdb bin/hobbitd_client tmp/core GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.9"... Core was generated by `hobbitd_client --no-ps-listing --no-clear-msgs'. Program terminated with signal 6, Aborted. Reading symbols from /usr/lib/libpcre.so.0...done. Loaded symbols for /usr/lib/libpcre.so.0 Reading symbols from /usr/lib/libresolv.so.2...done. Loaded symbols for /usr/lib/libresolv.so.2 Reading symbols from /usr/lib/libsocket.so.1...done. Loaded symbols for /usr/lib/libsocket.so.1 Reading symbols from /usr/lib/libnsl.so.1...done. Loaded symbols for /usr/lib/libnsl.so.1 Reading symbols from /usr/lib/libc.so.1...done. Loaded symbols for /usr/lib/libc.so.1 Reading symbols from /usr/lib/libdl.so.1...done. Loaded symbols for /usr/lib/libdl.so.1 Reading symbols from /usr/lib/libmp.so.2...done. Loaded symbols for /usr/lib/libmp.so.2 Reading symbols from /usr/platform/SUNW,Ultra-60/lib/libc_psr.so.1...done. Loaded symbols for /usr/platform/SUNW,Ultra-60/lib/libc_psr.so.1 #0 0xff19fff8 in _libc_kill () from /usr/lib/libc.so.1 (gdb) bt #0 0xff19fff8 in _libc_kill () from /usr/lib/libc.so.1 #1 0xff136cd8 in abort () from /usr/lib/libc.so.1 #2 0x0001e59c in sigsegv_handler (signum=11) at sig.c:57 #3 <signal handler called> (gdb) q -- David Gore (v965-3670) Enhanced Technology Support (ETS) Network Management Systems (NMS) IMPACT Transport Team Lead - SCSA, SCNA Page: 1-800-PAG-eMCI pin 1406090 Vnet: 965-3676

1 0

[hobbit] hobbitd_client core
by David.Gore＠mci.com 12 Aug '05

12 Aug '05

Sometimes it's up for no more than a couple hours, sometimes it's up and running for more than 12 hours. hobbit at hobbit:/export/home/hobbit/server> file tmp/core tmp/core: ELF 32-bit MSB core file SPARC Version 1, from 'hobbitd_client' hobbit at hobbit:/export/home/hobbit/server> gdb bin/hobbitd_client tmp/core GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.9"... Core was generated by `hobbitd_client --no-ps-listing --no-clear-msgs'. Program terminated with signal 6, Aborted. Reading symbols from /usr/lib/libpcre.so.0...done. Loaded symbols for /usr/lib/libpcre.so.0 Reading symbols from /usr/lib/libresolv.so.2...done. Loaded symbols for /usr/lib/libresolv.so.2 Reading symbols from /usr/lib/libsocket.so.1...done. Loaded symbols for /usr/lib/libsocket.so.1 Reading symbols from /usr/lib/libnsl.so.1...done. Loaded symbols for /usr/lib/libnsl.so.1 Reading symbols from /usr/lib/libc.so.1...done. Loaded symbols for /usr/lib/libc.so.1 Reading symbols from /usr/lib/libdl.so.1...done. Loaded symbols for /usr/lib/libdl.so.1 Reading symbols from /usr/lib/libmp.so.2...done. Loaded symbols for /usr/lib/libmp.so.2 Reading symbols from /usr/platform/SUNW,Ultra-60/lib/libc_psr.so.1...done. Loaded symbols for /usr/platform/SUNW,Ultra-60/lib/libc_psr.so.1 #0 0xff19fff8 in _libc_kill () from /usr/lib/libc.so.1 (gdb) bt #0 0xff19fff8 in _libc_kill () from /usr/lib/libc.so.1 #1 0xff136cd8 in abort () from /usr/lib/libc.so.1 #2 0x0001e59c in sigsegv_handler (signum=11) at sig.c:57 #3 <signal handler called> (gdb) q -- David Gore (v965-3670) Enhanced Technology Support (ETS) Network Management Systems (NMS) IMPACT Transport Team Lead - SCSA, SCNA Page: 1-800-PAG-eMCI pin 1406090 Vnet: 965-3676

1 0

[hobbit] client regex, % on web page
by David.Gore＠mci.com 12 Aug '05

12 Aug '05

ps -ef|grep SystemMate root 2737 1 0.0 Sep 13 ?? 04:42:21 /usr/kits/SystemMate/jre/bin/../bin/alpha/native_threads/java -classpath /usr/kits/SystemMate/classes:/usr/kits/SystemMate -DSTM_ROOT_PATH=/usr/kits/SystemMate webTemip.server.start.TemipServer With 'ps -ef' webTemip.server.start.TemipServer (found 1, req. 1 or more) /usr/ucb/ps wwaux|grep SystemMate root 2737 0.0 0.7 43.6M 34M ?? S Sep 13 04:42:21 /usr/kits/SystemMate/jre/bin/../bin/alpha/native_threads/java -classpath /usr/kits/SystemMate/classes:/usr/kits/SystemMate -DSTM_ROOT_PATH=/usr/kits/SystemMate webTemip.server.start.TemipServer With 'ps wwaux' %SystemMate (found 1, req. 1 or more) These are the same process. Everyone here knows what SystemMate is, but they may not know what the first instance is. I know I asked this before, but I didn't know if you may have missed it. I can imagine the regex parsing can be quite complicated, so I was just wondering if you were still looking at removing the '%' from the web page. I was also wondering do the config files actually support all the perl regex characters like \s, \d+ etc...? ~David

2 3

[hobbit] hobbit-alerts.cfg -- Perl regex
by robert.herron＠gmail.com 11 Aug '05

11 Aug '05

Moving the % fixed the problem. Thanks for the help and tip. On 11 Aug 2005 20:45:26 -0000, henrik at hswn.dk (Henrik Stoerner) wrote: > On Thu, Aug 11, 2005 at 03:07:47PM -0300, Werner Michels (Ext Lists) wrote: > > Robert, > > > > Please try change the HG definition as: > > > > $HG-WinSvrsCrit=%nyc(app1|dc1|dc2|ex1|ex03|fs1|fs2|time).domain.com > > > > Observe that the "%" is the first char and this indicates that your using perl regex. > > With this change your host group should work fine. > > Werner is right here - the "%" must be first, it's only mission is to > tell Hobbit to treat this as a regular expression instead of a simple > text string. > > For debugging regular expressions, I routinely use the info-page > display (which shows clearly whether a host/test is matched or not), > but also the "pcretest" tool that comes with the pcre library. Like > this: > > $ pcretest > PCRE version 4.5 01-December-2003 > > re> /nyc(app1|dc1|dc2|ex1|ex03|fs1|fs2|time).domain.com/ > data> nycdc2.domain.com > 0: nycdc2.domain.com > 1: dc2 > data> nycdc4.domain.com > No match > > > Regards, > Henrik > > > > -- Robert Herron robert.herron at gmail.com

1 0