October 2006 - Xymon - Xymon mailman web

[hobbit] log file monitoring issues
by gmbfly98＠gmail.com 02 Nov '06

02 Nov '06

Maybe I'm just missing something in the documentation, but I can't seem to get the log file monitoring to work properly. In the example below, I'm trying to look at the "messages" and "maillog" files on Linux. Particularly, I'm trying to EXCLUDE the following "messages" lines: Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 21:19:45 www upsd[7860]: Client on 127.0.0.1 logged out Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 16:44:01 www crond(pam_unix)[5382]: session opened for user root by (uid=0) Aug 9 16:44:14 www crond(pam_unix)[5382]: session closed for user root Aug 9 16:45:01 www crond(pam_unix)[5484]: session opened for user mailman by (uid=0) Aug 9 16:45:01 www crond(pam_unix)[5484]: session closed for user mailman And EXCLUDE the following "maillog" lines: Aug 6 11:55:02 www sendmail[15076]: k76Ft1pU015076: from=<mailman at HOSTNAME>, size=576, class=0, nrcpts=1, msgid=<200608061555.k76Ft1A2015075 at HOSTNAME>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1] Below is the respective lines from the "client-local.cfg" file: log:/var/log/messages:10240 ignore upsd* Client|Connection 127.0.0.1 ignore session opened|closed for user mailman|root log:/var/log/maillog:10240 ignore relay=localhost.localdomain trigger denied And below the specific log entries I'm looking for from "hobbit-clients.cfg": LOG /var/log/maillog "relaying denied" color="yellow" Now, the problem I'm having... The "ignore" line for the /var/log/maillog file appears to be working correctly, as it does indeed ignore such entries as shown above. Also working is the "ignore session opened..." line for the /var/log/messages file. What is NOT working is the "ignore" line for the "upsd*" lines in /var/log/messages. For the life of me, I just can't figure out how to get that to work properly. That is, two of the three "ignore" lines are not working, as those lines still show up in the "full log" output. If anyone has any ideas, let me know. I'm also having problems with some logs not showing up on the messages page. Do you need both a "LOG" entries in the hobbit-clients.cfg AND client-local.cfg, or will an entry in only client-local.cfg be sufficient to have it show up on the messages page?

5 17

Recovery pages after using DISABLE - bug or feature?
by jonescr＠cisco.com 31 Oct '06

31 Oct '06

When I disable a red alert, first a "recovery" notice is sent, indicating that the host "recovered". Then the disable notice is sent, informing that the host was disabled. The first message is a bit confusing since for example it will say the host recovered but the df output in the email/page clearly shows the disk is still 99% full. I would think that recovery messages should not be sent if a host/service is DISABLED, but perhaps it is a feature to notify folks who do not have the NOTIFY tag on their alert definition? -Charles

2 1

Critical Systems / NK
by rmunsch＠solutionsforprogress.com 31 Oct '06

31 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm not making any use of this feature in 4.2; i upgraded my server from 4.1.pwhatever, but don't see any new documentation about the critical systems config etc. I don't see anything on the wiki either. TIA, Rob Oh, Henrik: have you gotten to look at that howto? And is it any good :D - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFRmt/BvBcJFK6xYURArfrAJ0dG5ZfksCcjZE5zhhud0GStYy9BACfQSca qYo+nyYq7rNwRKENw4Xc6kQ= =EMCS -----END PGP SIGNATURE-----

3 3

[hobbit] looking for sample code or a template in java to send status info to hobbit
by KauffmanT＠nibco.com 31 Oct '06

31 Oct '06

Which requires he already be familiar with TCP/IP programming in java, and work out how to parse bb-hosts to find the server name(s) . . . and the reason he's looking for a template or other sample code. Tom -----Original Message----- From: Rich Smrcina [mailto:rsmrcina at wi.rr.com] Sent: Monday, October 30, 2006 3:10 PM To: hobbit at hswn.dk Subject: Re: [hobbit] looking for sample code or a template in java to send status info to hobbit Open a connection on port 1984 and send a status message. There should be message examples in the doc. Kauffman, Tom wrote: > As it says -- one of our staff is up to his neck in java applications on > wintel and would appreciate some examples for schlepping status to > hobbit from within his process. > > Anything on deadcat or the shire I could point him at? > > TIA > > Tom Kauffman > NIBCO, Inc > CONFIDENTIALITY NOTICE: This email and any attachments are for the > exclusive and confidential use of the intended recipient. If you are not > the intended recipient, please do not read, distribute or take action in > reliance upon this message. If you have received this in error, please > notify us immediately by return email and promptly delete this message > and its attachments from your computer system. We do not waive > attorney-client or work product privilege by the transmission of this > message. > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > -- Rich Smrcina VM Assist, Inc. Phone: 414-491-6001 Ans Service: 360-715-2467 rich.smrcina at vmassist.com Catch the WAVV! http://www.wavv.org WAVV 2007 - Green Bay, WI - May 18-22, 2007 To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

1 0

New Hobbit stuff: Scalability and H/A work
by henrik＠hswn.dk 31 Oct '06

31 Oct '06

A couple of weeks ago, I was asked if our Hobbit system at work could handle monitoring of one more customer. Of course, I said - no problem. Well, there was one gotcha: This customer has 1100+ servers that need to be monitored. Which means my Hobbit installation is about to double in the number of hosts monitored. Hmm ... This will be interesting to watch. I am fairly confident that Hobbit can handle it, with one exception: The disks on my Hobbit server will be overloaded. It already spends about 50% of it's time in I/O wait, so doubling the number of hosts with cpu/memory/disk etc. graphs will probably crash it. So something needs to be done - fast: These hosts should go into our Hobbit before Christmas. That is why I currently may seem a bit absent from the mailing list. The way I plan to handle it will be by distributing the load of RRD updates onto several servers, each handling a subset of the total set of hosts; Hobbit will automatically detect which of the 3 RRD-servers handles a specific host and direct rrd-updates to that server. New hosts are distributed across all of the RRD servers in a weighted round-robin fashion. The way this is going to be done means that it can be used not only for distributing the load of the RRD file updates, but also for distributing the other hobbitd_* modules (alerting, history logs, client data processing etc). In other words, this will be a major win for Hobbit in large installations. It also has one more benefit: I think this can be evolved to handle automatic failover, so you can run multiple Hobbit servers that process the same data - meaning all of the on-disk data will be identical across all of the Hobbit servers. This should make it possible to setup a group of Hobbit servers for very high availability of the monitoring system. I haven't worked out all of the implementation details yet, but I think it is possible. Regards, Henrik

3 3

[hobbit] Hobbit-perl-notes
by fduranti＠q8.it 31 Oct '06

31 Oct '06

> > This is great! The only problem I'm having is if I define a > Link, the link URL is ignored and instead the link that is > created is a link to the notes page. A sample link definition > that I am using is: > "Reports URL|Internal Link|http://internal.reports.mydomain.com/" > > When I view the notes for the host, the "Internal Link" takes > me to > https://hobbitserver/hobbit-cgi/hobbitperl-notes.sh?HOST=myhostname# > The link is right, it should launch a javascript that will open a new page with the link. Can you check the source of the html page? Thanks Francesco

2 1

[hobbit] New Hobbit stuff: Scalability and H/A work
by fduranti＠q8.it 31 Oct '06

31 Oct '06

It will be a really nice addition :D If it will also allow the creation of custom program for rrd creation with some config file/Makefile to link with hobbit library it will be fantastic :D Francesco > -----Original Message----- > From: Henrik Stoerner [mailto:henrik at hswn.dk] > Sent: Tuesday, October 31, 2006 5:04 PM > To: hobbit at hswn.dk > Subject: [hobbit] New Hobbit stuff: Scalability and H/A work > > A couple of weeks ago, I was asked if our Hobbit system at > work could handle monitoring of one more customer. Of course, > I said - no problem. > Well, there was one gotcha: This customer has 1100+ servers > that need to be monitored. Which means my Hobbit installation > is about to double in the number of hosts monitored. Hmm ... > > This will be interesting to watch. I am fairly confident that > Hobbit can handle it, with one exception: The disks on my > Hobbit server will be overloaded. It already spends about 50% > of it's time in I/O wait, so doubling the number of hosts > with cpu/memory/disk etc. graphs will probably crash it. > > So something needs to be done - fast: These hosts should go > into our Hobbit before Christmas. That is why I currently may > seem a bit absent from the mailing list. > > The way I plan to handle it will be by distributing the load > of RRD updates onto several servers, each handling a subset > of the total set of hosts; Hobbit will automatically detect > which of the 3 RRD-servers handles a specific host and direct > rrd-updates to that server. New hosts are distributed across > all of the RRD servers in a weighted round-robin fashion. > > The way this is going to be done means that it can be used > not only for distributing the load of the RRD file updates, > but also for distributing the other hobbitd_* modules > (alerting, history logs, client data processing etc). In > other words, this will be a major win for Hobbit in large > installations. > > It also has one more benefit: I think this can be evolved to > handle automatic failover, so you can run multiple Hobbit > servers that process the same data - meaning all of the > on-disk data will be identical across all of the Hobbit > servers. This should make it possible to setup a group of > Hobbit servers for very high availability of the monitoring > system. I haven't worked out all of the implementation > details yet, but I think it is possible. > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

1 0

Hobbit-perl-notes v1.01
by fduranti＠q8.it 31 Oct '06

31 Oct '06

Hi all, just some bug fix: 1.01 - Corrected some bugs - VOIP Url is now correctly saved - Corrected a problem of the view of groups - Corrected a problem when you delete a group and the group is not deleted Francesco

1 0

[hobbit] New Hobbit stuff: Scalability and H/A work
by PNIXON＠ci.somerville.ma.us 31 Oct '06

31 Oct '06

While off topic, but how do you guys measure your IO to disk? --Pat -----Original Message----- From: Gildas Le Nadan [mailto:gn1 at sanger.ac.uk] Sent: Tuesday, October 31, 2006 11:49 AM To: hobbit at hswn.dk Subject: Re: [hobbit] New Hobbit stuff: Scalability and H/A work Henrik Stoerner wrote: > A couple of weeks ago, I was asked if our Hobbit system at work could > handle monitoring of one more customer. Of course, I said - no problem. > Well, there was one gotcha: This customer has 1100+ servers that need > to be monitored. Which means my Hobbit installation is about to double > in the number of hosts monitored. Hmm ... > > This will be interesting to watch. I am fairly confident that Hobbit > can handle it, with one exception: The disks on my Hobbit server will > be overloaded. It already spends about 50% of it's time in I/O wait, > so doubling the number of hosts with cpu/memory/disk etc. graphs will > probably crash it. Strange that I/O seem to be an issue for you. What kind of system do you run the hobbit server on? I have ~3300 rrd files updated here on a blade with an old 40 Gig 5400 2,5" hard drive and it is almost idle. Cheers, Gildas To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

2 1

Patch for Debian client install errors
by wens＠csie.org 31 Oct '06

31 Oct '06

Hi, I have had some problems with installing the hobbitmon package on debian, the problem being the configuration file is not properly set. I have fixed it, and would like to submit the following patch. ---------------start of patch---------------- diff -ur hobbit-4.2.0/debian/hobbit-client.postinst hobbit-4.2.0-patched/debian/hobbit-client.postinst --- hobbit-4.2.0/debian/hobbit-client.postinst 2006-08-10 04:10:17.000000000 +0800 +++ hobbit-4.2.0-patched/debian/hobbit-client.postinst 2006-10-07 18:11:48.000000000 +0800 @@ -36,8 +36,8 @@ db_stop # Update configuration file - sed -e 's/^HOBBITSERVERS=.*/HOBBITSERVERS=\"${HOBBITSERVERS}\"/' \ - -e 's/^CLIENTHOSTNAME=.*/CLIENTHOSTNAME=\"${CLIENTHOSTNAME}\"/' \ + sed -e "s/^HOBBITSERVERS=.*/HOBBITSERVERS=\"${HOBBITSERVERS}\"/" \ + -e "s/^CLIENTHOSTNAME=.*/CLIENTHOSTNAME=\"${CLIENTHOSTNAME}\"/" \ < $CONFIGFILE > $CONFIGFILE.tmp mv -f $CONFIGFILE.tmp $CONFIGFILE ;; diff -ur hobbit-4.2.0/debian/hobbit.postinst hobbit-4.2.0-patched/debian/hobbit.postinst --- hobbit-4.2.0/debian/hobbit.postinst 2006-08-10 04:10:17.000000000 +0800 +++ hobbit-4.2.0-patched/debian/hobbit.postinst 2006-10-07 18:14:24.000000000 +0800 @@ -47,9 +47,9 @@ # Update configuration file cp -a -f $CONFIGFILE $CONFIGFILE.tmp - sed -e 's/^BBSERVERHOSTNAME=.*/BBSERVERHOSTNAME=\"${BBSERVERHOSTNAME}\"/' \ - -e 's/^BBSERVERIP=.*/BBSERVERIP=\"${BBSERVERIP}\"/' \ - -e 's/^BBSERVERWWWNAME=.*/BBSERVERWWWNAME=\"${BBSERVERWWWNAME}\"/' \ + sed -e "s/^BBSERVERHOSTNAME=.*/BBSERVERHOSTNAME=\"${BBSERVERHOSTNAME}\"/" \ + -e "s/^BBSERVERIP=.*/BBSERVERIP=\"${BBSERVERIP}\"/" \ + -e "s/^BBSERVERWWWNAME=.*/BBSERVERWWWNAME=\"${BBSERVERWWWNAME}\"/" \ < $CONFIGFILE > $CONFIGFILE.tmp mv -f $CONFIGFILE.tmp $CONFIGFILE ;; ------------------end of patch--------------- Hope this helps. :) Cheers, wens

1 0