November 2006 - Xymon - Xymon mailman web

[hobbit] Purples, all non-green view
by KauffmanT＠nibco.com 23 Jan '07

23 Jan '07

Oh, my! It certainly does! Tom Kauffman -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Friday, May 12, 2006 11:05 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Purples, all non-green view On Fri, May 12, 2006 at 02:41:19PM +0000, David Gore wrote: > There was some talk of the purples not showing up on the 'All non-green > view'. We are also disappointed that the purples have been removed from > this page. Our main page is the ANV page and would really like to have > that back. Could we at least have it back with a flag? Or did we some > how remove the purples on the ANV page with some flag in the latest > snapshot? Seems I broke it somewhere. This should put the purples back on the bb2 page. Henrik CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

2 3

how can I receive alerts for every new trigger matched for 'LOG'
by jjj863＠gmail.com 19 Dec '06

19 Dec '06

hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if the STATUS is red/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. - Does anybody know how to change the default from 30m to 5m (for a single check/test)? - Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...

2 4

[hobbit] server load issue?
by David.Gore＠VerizonBusiness.com 15 Dec '06

15 Dec '06

Henrik, For you consideration, I think the server may go a little crazy if you try to send updated client packages to too many hosts at the same time, false failed tests, pages sent on those same false failed tests, and status pages not available for those same false failed tests: bb-display.log: ... 2006-11-30 01:11:44 Whoops ! bb failed to send message - timeout 2006-11-30 01:11:44 hobbitd status-board not available clientdata.log: 2006-11-30 00:51:20 Whoops ! bb failed to send message - timeout 2006-11-30 00:56:12 Whoops ! bb failed to send message - timeout 2006-11-30 00:58:17 Whoops ! bb failed to send message - timeout 2006-11-30 00:59:41 Whoops ! bb failed to send message - timeout hobbitclient.log: [hobbit at hobbit1 logs]$ cat hobbitclient.log 2006-11-30 00:58:16 Whoops ! bb failed to send message - timeout Here is what my config looks like client-local.cfg: [temip-be-hpux11] # these are class names, not host names clientversion:temip-be-hpux11v10 log:/var/adm/syslog/syslog.log:10240 [temip-fe-hpux11] clientversion:temip-fe-hpux11v10 log:/var/adm/syslog/syslog.log:10240 [temip-tns-hpux11] clientversion:temip-tns-hpux11v2 log:/var/adm/syslog/syslog.log:10240 I suppose I updated about 60+ remote hosts at once, perhaps we should just try to figure out what our server can handle? Or should the server be made to be smarter? The server is a simple 3 Ghz dual core Intel Fedora Core 5 host with 1G of memory. -- David

2 6

hobbit-alerts.cfg regex/MACRO problem - need help
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

I am trying to use a regex macro to exclude a number of hosts from an alert. Here is the one I was using at first: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11) Here is how I am using it for the actual alert definition: HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$ This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest": $ pcretest PCRE version 6.6 06-Feb-2006 re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/ data> prod-web-12 No match data> prod-web-11 0: prod-web-11 1: <unset> 2: 11 data> As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it. *However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section. *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert. ../bin/hobbitd_alert --test prod-web-11 procs --color-red 00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging 00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' *** 00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170 00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' *** 00009993 2006-11-09 21:48:30 Mail alert with command 'mail xxxxx at cingularme.com' 00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200) ... 00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded) * Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above). I have also tried enclosing the regex in quotes, which didn't work either. If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong. -Charles

3 8

Running Hobbit on custom apache port
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

Im running my Hobbit apache on a custom port. At the bottom of alerts, it does not specify the port number, and also does not use the FQDN: "See http://hobbitserver/hobbit-cgi/bb-hostsvc.sh?HOST=somehost&SERVICE=cpu" Where can I make a change so that instead I get the FQDN, and the port, like: "See http://hobbitserver.mydomain.com:8000/hobbit-cgi/bb-hostsvc.sh?HOST=somehos…" -Charles

3 5

Error compiling snapshot
by lars.ebeling＠leopg9.no-ip.org 05 Dec '06

05 Dec '06

I have not downloaded the latest snapshot for a while, but today I did. The same error that I had the last time occured today again. I am compiling on HP-UX 11.11 gcc -g -O -D_REENTRANT -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DHPUX -I. -I /home/hobbit/snapshot/include -I/usr/local/include -I. -I../include -c -o loc ator.o locator.c locator.c: In function écall_locator': locator.c:81: error: éMSG_DONTWAIT' undeclared (first use in this function) locator.c:81: error: (Each undeclared identifier is reported only once locator.c:81: error: for each function it appears in.) makeÄ1Å: *** Älocator.oÅ Error 1 makeÄ1Å: Leaving directory é/home/hobbit/snapshot/lib' make: *** Älib-buildÅ Error 2 Regards Lars Ebeling http://leopg9.no-ip.org Hobbithobbyist "It is better to keep your mouth shut and appear stupid than to open it and remove all doubt." -- Mark Twain

2 3

Custom RRD graphs
by ger＠fwi.ie 03 Dec '06

03 Dec '06

Hi folks, I have created a custom script for capturing CPU utilisation from a device and updated all the relevant files but I cannot get my rrd files to update correctly. An initial rrd file gets created but the data does not get input into it. I have created a rrd-ext sript which is running and is capturing the incomming status data and by looking at the /tmp files I can see that the echo outputs are being generated correctly every 5 mintes. ----> rrd-ext.sh HOSTNAME="$1" TESTNAME="$2" FNAME="$3" if [ "$TESTNAME" = "acpu" ] then echo "`date`" >> /tmp/hobbit.$HOSTNAME.$TESTNAME echo "$FNAME" >> /tmp/hobbit.$HOSTNAME.$TESTNAME # Analyze the message we got # ACPU=`grep "connected" $FNAME | awk '{print $14}'` ACPU=`grep "The 5" $FNAME | cut -d"(" -f2 | cut -d"." -f1` # The RRD dataset definitions echo "DS:acpu:GAUGE:600:0:100" # The filename echo "acpu.rrd" # The data echo "$ACPU" echo "$ACPU" >> /tmp/hobbit.$HOSTNAME.$TESTNAME fi The value I want to graph is simply a cpu % counter, have I got the above values and setting correct for this ? Any help or pointers appreciated. Output that this produces is below showing that it is getting the data correctly from the status input. ---> /tmp/hobbit.$HOSTNAME.$TESTNAME Wed Nov 29 19:54:07 GMT 2006 /usr/lib/hobbit/server/tmp/rrd_msg_13879 14 Wed Nov 29 19:59:05 GMT 2006 /usr/lib/hobbit/server/tmp/rrd_msg_26569 25 Wed Nov 29 20:04:07 GMT 2006 /usr/lib/hobbit/server/tmp/rrd_msg_2788 17 Wed Nov 29 20:09:12 GMT 2006 /usr/lib/hobbit/server/tmp/rrd_msg_11944 9 Ger.

4 9

[hobbit] SMTP and FTP Services Red
by PNIXON＠ci.somerville.ma.us 02 Dec '06

02 Dec '06

Did you try putting an entry for Hobbit server into their hosts files? I think the delay is from the Server trying to do a reverse lookup on the IP Address. You may also have to change the order in which they resolve DNS.... in /etc/nsswitch.conf (or whatever is appropriate for your distribution) change from hosts: db files nisplus nis dns to hosts: files nisplus nis dns db _____ From: Geoff Hallford [mailto:geoff.hallford at gmail.com] Sent: Wednesday, November 29, 2006 3:46 PM To: hobbit at hswn.dk Subject: [hobbit] SMTP and FTP Services Red Hello, On a few of our servers the SMTP and FTP services are RED but when I telnet to them, they do show the proper 220 status good. They are quite slow to respond though, taking sometimes 10-15 seconds. Is there anyway to get Hobbit to pause and wait for this? If not, how long does it wait before it shows a red status? Thank you very much for your help. Geoff Hallford

5 8

lsof monitor?
by jkwade＠futurefrontiers.com 01 Dec '06

01 Dec '06

Has anyone written or will Hobbit monitor the number of open connections to an application? As an example, using lsof. Sorry if I'm repeating myself. I asked earlier but didn't get an answer. I thought I'd ask again and see if anyone knows a way to monitor it across the clients. I want to check and alert if an application has to many open connections. ie. >1000 Thanks..James

5 5

HTTP error 0
by lebarber＠gmail.com 01 Dec '06

01 Dec '06

What does "HTTP error 0" signify when given as the result of an http test? An empty page? Thanks, Larry Barber

2 1