October 2006 - Xymon - Xymon mailman web

hobbitd goes yellow
by cgayde＠isugw.indstate.edu 10 Oct '06

10 Oct '06

Can someone help me get rid of this error. Oversize status msg from xxx.xxx.xxx.xxx for machinename:ports truncated (n=406136, limit=262144)

2 1

Misnamed man page... v4.2.0 - no patches
by rgordonjr＠gmail.com 10 Oct '06

10 Oct '06

Hello... V4.2.0 (no patch set) Not sure if anyone else has noticed this.. When navigating through the menu for the Hobbit Man pages if you click on the link for "Custom hobbit Webpages" it brings up /help/manpages/man1/bb- webpage.cgi.1.html .... On the file system, the html page is missing the "cgi" (bb-webpage.1.html) Thanks - -- --==[ Bob Gordon ]==--

1 0

Remove/Drop all of one test type
by shane.presley＠gmail.com 10 Oct '06

10 Oct '06

Hello, I have ~300 servers, and recently changed the ping column from "conn" to "Ping". Now of course my old conn column is all purple. How can I remove all my conn tests? I tried this, but it didn't work: bb 127.0.0.1 "drop * testname conn" Thanks, Shane

2 2

[hobbit] hobbit mailack question
by KauffmanT＠nibco.com 10 Oct '06

10 Oct '06

Thanks, Henrik. Everything is working fine now. All I need to do now is work out the rewrite rule for procmail (or build another filter before mailack) to change '<phone number at provider>' back into a name people can recognise. Tom -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Monday, October 09, 2006 5:30 PM To: hobbit at hswn.dk Subject: Re: [hobbit] hobbit mailack question On Mon, Oct 09, 2006 at 03:30:22PM -0400, Kauffman, Tom wrote: > Now -- what is mailack actually looking for? I'm trying to get things > configured so I can email alerts to a cell phone and have them > acknowledged by replying to the message. With my cell phone, I seem to > have two options: 'reply' and 'reply with copy'. 'Reply with copy' > doesn't seem to be setting the acknowledgement flag. It looks for a subject line matching this regular expression: .*(Hobbit|BB)[ -]* \[*(-*[0-9]+)[\]!]* i.e. the word "Hobbit" or "BB" followed by some space and perhaps a dash, and then the ack-code which may be enclosed in brackets. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

1 0

[hobbit] Running logfetch 'by hand'
by henrik＠hswn.dk 10 Oct '06

10 Oct '06

(this message was eaten by my spamfilter for some odd reason) On Mon, Sep 11, 2006 at 12:38:16PM +0100, Andrew Jackson wrote: > Just thought I'd raise this up again. What I am trying to do is monitor > a few machines outside our firewall. I am firing off > hobbitclient-<OS>.sh using ssh from the hobbit server then submitting > the output from the hobbit server like the suggestion in the discussion > on agentless clients. Unlike the agentless client example I have > installed the hobbit client on the target machine and fire off the > hobbitclient-<OS>.sh by using a command associated with the ssh key > being used for access. In the agentless client discussion the output > from the data submission which is used as the configuration file for > logfetch is discarded. I can see it being generated in hobbitclient.sh > when the client submits it's own data. I know I would have to get this > file back to the client if I wanted log monitoring on my systems outside > the firewall. What I can't find is where the logfetch status file > (second argument for logfetch in hobbitclient-<OS>.sh) comes from or is > updated. The second file is maintained by logfetch itself. It contains the locations into the various logfiles that logfetch has processed in earlier runs. Instead of ssh'ing into the box, perhaps you could use the msgcache/hobbitfetch utilities ? That lets you run the normal client on a box together with msgcache, and then hobbitfetch contacts the client to pick up the data. Log monitoring does work normally with that setup. Regards, Henrik

2 1

hobbit mailack question
by KauffmanT＠nibco.com 09 Oct '06

09 Oct '06

I've given up on getting MS-Exchange to forward email within the domain and am now running fetchmail to get the messages from exchange. Now -- what is mailack actually looking for? I'm trying to get things configured so I can email alerts to a cell phone and have them acknowledged by replying to the message. With my cell phone, I seem to have two options: 'reply' and 'reply with copy'. 'Reply with copy' doesn't seem to be setting the acknowledgement flag. Here's the relevant chunk of the email: Subject: --------------- (644431 roanoke.hacmp) roanoke:hac Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-pstn-levels: (S:64.56310/99.90000 ) X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 X-pstn-addresses: from <5743701164 at vtext.com> [db-null] Return-Path: 5743701164 at vtext.com X-OriginalArrivalTime: 09 Oct 2006 19:14:57.0608 (UTC) FILETIME=[3594D480:01C6EB D7] --------------- (644431 roanoke.hacmp) roanoke:hacmp red [644431] red Mon Oct 9 14:51:36 EDT 2006 clinfo is not run Suggestions? Tom Kauffman NIBCO, Inc CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

2 1

depends tag questions, possible feature request
by jonescr＠cisco.com 09 Oct '06

09 Oct '06

First a quick summary of the pertinent part of my bb-hosts: subpage PRODDB Prod DB 1.2.3.4 prod-db1 # ssh pulldata TRENDS:*,disk:disk|disk1,vmstat:vmstat1 # subpage PRODURLS Prod URLS 1.2.3.5 URL-SomePortal # cont;http://username:password at vhost.com;SUCCESSFUL 1.2.3.5 URL-SomeApp # cont;http://someapp.com/monitor.php;SUCCESS 1.2.3.6 URL-SomeOtherApp # cont;http://someotherapp.com/monitor.php;SUCCESS (In case you are wondering, I have URLS monitored that way because the URLS monitored are load balanced across many servers. I have other tests for the httpd processes for those specific servers, but the PRODURLS entries are for alerting when those external URLS are not responding). That being said, today we had a problem with prod-db1. Basically Oracle went nuts and the system load went to 110+, and as a result all of the PRODURLS alerts went off. Now, no problem so far, since this is by design. The problem is that As the DB was able to handle a request here and there, the PRODURLS were "flapping" (changing status from red to green to red to green). So, Acks had no effect, "Disable until OK" had no effect. I was tasked with how to reduce the amount of pager spam the next time this happens. The obvious way is to just go in an disable the affected hosts/services for a specific time period, but this is easier said than done when the world is on fire and you are on a conference bridge and have people standing around you waiting for things to be fixed...In short, the guys that were oncall didn't have time to go log into Hobbit and do the disables...meanwhile their pagers are going nuts which adds to their frustration. *It would be nice if Hobbit had "flap detection"*, where if a service changes states more than X times in X minutes or seconds, it turns clear or blue (or maybe even a new color). I am reminded that Nagios has this feature, and Hobbit is totally better than Nagios, so we shouldn't have that feature missing right? ;-) *It would be nice if the depend tag worked for any column/test type*. I looked at using the "depends" tag, but it appears that *depends only works for network checks*. In other words, I cannot do: 1.2.3.5 URL-SomeApp # cont;http://someapp.com/monitor.php;SUCCESS depends=(http:prod-db1/procs,prod-db1/cpu) If I have misunderstood about the depends tag, let me know, but it appears from the man page that it only works for network tests: "The 'depends' tag is evaluated on the BBNET server while running the network tests. It can therefore only refer to other network tests that are handled by the same BBNET server - there is currently no way to use the e.g. the status of locally run tests (disk, cpu, msgs) or network tests from other BBNET servers in a dependency definition. Such dependencies are silently ignored."

2 1

DOWNTIME problem
by jonescr＠cisco.com 09 Oct '06

09 Oct '06

1.2.3.4 prod-db2 # ssh pulldata TRENDS:*,disk:disk|disk1,vmstat:vmstat1 DOWNTIME=*:0159:0400:Database_Resync 1.2.3.5 prod-db3 # ssh pulldata TRENDS:*,disk:disk|disk1,vmstat:vmstat1 DOWNTIME=*:0159:0400:Database_Resync My hobbitd status currently says: "Invalid timespec - expected 4 digits, got: 'Database_Resync'" I see nothing wrong with my syntax, the bb-hosts man page says: DOWNTIME=day:starttime:endtime:cause[,day:starttime:endtime:cause] What am I doing wrong? Also, is it possible to specify DOWNTIME per service? Because I do not want to put the entire host into maint mode, just the "procs", in this case.

2 1

Just another Feature Request: Firefox live bookmark on pages that have rss defined :D
by fduranti＠q8.it 09 Oct '06

09 Oct '06

Hi Henrik :D Continuing on the feature request series :D Do you think it's possible to implement a Firefox Live Bookmark on the pages generated by Hobbit? It's a link like: <link rel="alternate" type="application/rss+xml" title="sometitle" href="http://bbserver/page/page.rss" /> For normal pages or <link rel="alternate" type="application/rss+xml" title="sometitle" href="http://bbserver/bb2.rss" /> For the bb2 page It could be a nice feature just to add the rss feed generated by hobbit with a simple click ... Francesco

1 0

Main Page setup and RRDTools
by ManningR＠uhd.edu 09 Oct '06

09 Oct '06

We are evaluating Hobbit to replace Big Brother and my boss has two questions. The first is how can we modify the main (startup) page and put the subpage list below the client list, and can we take the RRDTool information that we have been collecting prior to this, and integrate it into Hobbits RRDTools data? Thanks Robert Manning Unix and Web Administrator University of Houston-Downtown Information Technology Voice:713.221.2790 Email:manningr at uhd.edu

2 1