October 2006 - Xymon - Xymon mailman web

[hobbit] Hobbit and bb-central
by dave＠auctionhelper.com 15 Nov '06

15 Nov '06

What version of SPLAT are you running? I am running the hobbit client on R56 - R60 and R61. -----Original Message----- From: Andy France [mailto:Andy at zespri.com] Sent: Monday, September 11, 2006 3:32 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Hobbit and bb-central I'd be interested in hearing about this too :-) I've only taken a short look at devmon - can it be configured to use a non standard SNMP port? The SecurePlatform SNMP runs on port 260 rather than the standard 161/162. Andy. "Bob Gordon" <rgordonjr at gmail.com> wrote on 12/09/2006 10:21:48 a.m.: > > On 9/11/06, Michael A. Price <mprice at hst.nasa.gov> wrote: > Thanx so much for getting back to me so quickly. The problem is that I > am running a very, very secure version of Linux called Secure Platform > from Checkpoint. > > Ouch... I remember them... :( > > Do the appliances support SNMP monitoring? If they do you could try > using Devmon instead of the client..... (http://devmon.sourceforge.net/ ) > > -- > --==[ Bob Gordon ]==-- ######################################################################## ############# This email is intended for the person to whom it is addressed only. If you are not the intended recipient, do not read, copy or use the contents in any way. The opinions expressed may not necessarily reflect those of ZESPRI Group of Companies ('ZESPRI'). While every effort has been made to verify the information contained herein, ZESPRI does not make any representations as to the accuracy of the information or to the performance of any data, information or the products mentioned herein. ZESPRI will not accept liability for any losses, damage or consequence, however, resulting directly or indirectly from the use of this e-mail/attachments. ######################################################################## ############# To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 2

Email alert based on specific process
by iqbala-hobbit＠qwestip.net 15 Nov '06

15 Nov '06

Hi All I am using bb-proctab to monitor a list of processes and if any process a whole group get alert. Is there a way I can setup the alert with process specific. So if proc 1 out the list dies only user 1 get alert and so on. I know I could use the SCRIPT feature but like to keep that as the last resort. I am using hobbit 4.1.2 on Solaris 8. The process list I am concern about is running bb1.9c client on Solaris 8 as well. Sorry if it were already discussed in the mailing list. Thanks -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu "..there are two kinds of people: those who work and those who take the credit...try to be in the first group;...less competition there." - Indira Gandhi

6 7

ganglia-style graph aggregation with hobbit
by gn1＠sanger.ac.uk 07 Nov '06

07 Nov '06

Hello, I'd like to completely replace the ganglia system we have here with hobbit. Most of the needed features are there, except the ability to produce aggregated graphs with multiple hosts, as in http://monitor.millennium.berkeley.edu/?c=PSI%20Cluster&m=&r=hour&s=descend… I suppose the following things will need to be done: - find a neat way to group the hosts (all the hosts in a group or a page for instance) - collect all the values from the rrd for all the hosts in a group and add them (when different from 0/NaN) - graph the result What would be the best way to do it? I'd like not to reinvent the wheel, so if some bits are already existing, I'd better use them... Cheers, Gildas

7 14

BUG? Graphing http response times of long URLs
by jonescr＠cisco.com 04 Nov '06

04 Nov '06

I have several hosts that I am graphing the http response time (Hobbit automatically does it when you use the /http/ option in bb-hosts). I have noticed that hosts where the http URL I am checking (I also do /cont/ check), display no graphs on the http page nor the trends page. I am assuming this is because the URL is in the graph legend, and perhaps the extra-long URL is breaking the graph generation somehow? -Charles

1 1

New Hobbit stuff: Scalability and H/A work
by henrik＠hswn.dk 02 Nov '06

02 Nov '06

A couple of weeks ago, I was asked if our Hobbit system at work could handle monitoring of one more customer. Of course, I said - no problem. Well, there was one gotcha: This customer has 1100+ servers that need to be monitored. Which means my Hobbit installation is about to double in the number of hosts monitored. Hmm ... This will be interesting to watch. I am fairly confident that Hobbit can handle it, with one exception: The disks on my Hobbit server will be overloaded. It already spends about 50% of it's time in I/O wait, so doubling the number of hosts with cpu/memory/disk etc. graphs will probably crash it. So something needs to be done - fast: These hosts should go into our Hobbit before Christmas. That is why I currently may seem a bit absent from the mailing list. The way I plan to handle it will be by distributing the load of RRD updates onto several servers, each handling a subset of the total set of hosts; Hobbit will automatically detect which of the 3 RRD-servers handles a specific host and direct rrd-updates to that server. New hosts are distributed across all of the RRD servers in a weighted round-robin fashion. The way this is going to be done means that it can be used not only for distributing the load of the RRD file updates, but also for distributing the other hobbitd_* modules (alerting, history logs, client data processing etc). In other words, this will be a major win for Hobbit in large installations. It also has one more benefit: I think this can be evolved to handle automatic failover, so you can run multiple Hobbit servers that process the same data - meaning all of the on-disk data will be identical across all of the Hobbit servers. This should make it possible to setup a group of Hobbit servers for very high availability of the monitoring system. I haven't worked out all of the implementation details yet, but I think it is possible. Regards, Henrik

6 6

[hobbit] OpenVMS, Hobbit client, precompiled?
by David.Gore＠verizonbusiness.com 02 Nov '06

02 Nov '06

Anyone have a compiled hobbit client for OpenVMS they would like to share? ~David

2 1

[hobbit] log file monitoring issues
by gmbfly98＠gmail.com 02 Nov '06

02 Nov '06

Maybe I'm just missing something in the documentation, but I can't seem to get the log file monitoring to work properly. In the example below, I'm trying to look at the "messages" and "maillog" files on Linux. Particularly, I'm trying to EXCLUDE the following "messages" lines: Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 21:19:45 www upsd[7860]: Client on 127.0.0.1 logged out Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 16:44:01 www crond(pam_unix)[5382]: session opened for user root by (uid=0) Aug 9 16:44:14 www crond(pam_unix)[5382]: session closed for user root Aug 9 16:45:01 www crond(pam_unix)[5484]: session opened for user mailman by (uid=0) Aug 9 16:45:01 www crond(pam_unix)[5484]: session closed for user mailman And EXCLUDE the following "maillog" lines: Aug 6 11:55:02 www sendmail[15076]: k76Ft1pU015076: from=<mailman at HOSTNAME>, size=576, class=0, nrcpts=1, msgid=<200608061555.k76Ft1A2015075 at HOSTNAME>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1] Below is the respective lines from the "client-local.cfg" file: log:/var/log/messages:10240 ignore upsd* Client|Connection 127.0.0.1 ignore session opened|closed for user mailman|root log:/var/log/maillog:10240 ignore relay=localhost.localdomain trigger denied And below the specific log entries I'm looking for from "hobbit-clients.cfg": LOG /var/log/maillog "relaying denied" color="yellow" Now, the problem I'm having... The "ignore" line for the /var/log/maillog file appears to be working correctly, as it does indeed ignore such entries as shown above. Also working is the "ignore session opened..." line for the /var/log/messages file. What is NOT working is the "ignore" line for the "upsd*" lines in /var/log/messages. For the life of me, I just can't figure out how to get that to work properly. That is, two of the three "ignore" lines are not working, as those lines still show up in the "full log" output. If anyone has any ideas, let me know. I'm also having problems with some logs not showing up on the messages page. Do you need both a "LOG" entries in the hobbit-clients.cfg AND client-local.cfg, or will an entry in only client-local.cfg be sufficient to have it show up on the messages page?

5 17

Critical Systems / NK
by rmunsch＠solutionsforprogress.com 01 Nov '06

01 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm not making any use of this feature in 4.2; i upgraded my server from 4.1.pwhatever, but don't see any new documentation about the critical systems config etc. I don't see anything on the wiki either. TIA, Rob Oh, Henrik: have you gotten to look at that howto? And is it any good :D - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFRmt/BvBcJFK6xYURArfrAJ0dG5ZfksCcjZE5zhhud0GStYy9BACfQSca qYo+nyYq7rNwRKENw4Xc6kQ= =EMCS -----END PGP SIGNATURE-----

3 4

hobbit-alerts.cfg REPEAT option
by shane.presley＠gmail.com 01 Nov '06

01 Nov '06

Is there a global way to change the REPEAT value? I don't want my alerts to repeat, so I set them manually on each alert line with REPEAT=9999. Thanks Shane

4 5

Recovery pages after using DISABLE - bug or feature?
by jonescr＠cisco.com 31 Oct '06

31 Oct '06

When I disable a red alert, first a "recovery" notice is sent, indicating that the host "recovered". Then the disable notice is sent, informing that the host was disabled. The first message is a bit confusing since for example it will say the host recovered but the df output in the email/page clearly shows the disk is still 99% full. I would think that recovery messages should not be sent if a host/service is DISABLED, but perhaps it is a feature to notify folks who do not have the NOTIFY tag on their alert definition? -Charles

2 1