November 2006 - Xymon - Xymon mailman web

Hobbit help
by vorpini＠gmail.com 30 Nov '06

30 Nov '06

Dear Mr.Storner, my name's Giorgio Volpini, I'm a Computer Science student of the university of Pisa. I need some help about your program : Hobbit. Few months ago I used Hobbit during my stage and now I'm writing a thesis about it. I'd like to complete my report with a dimostration of Bash-script to use in the program; my problem is that i don't know Bash-scripting and I have not enought time to learn it. If I don't give you too much trouble, I needa script to control the time of presence rivelators connected in Lan with Hobbit server. I also have a general idea about the script: - ping the rivelator - compare the time of the answer packet with Hobbit system time - decide if it's all ready or not - warn the administrator with e-mail, sms or only with Hobbit web interface I need only a dimostrative script to add an my report, so is not important that it works perfectly, but only that bash-script has right syntax. Your help is very important for me and I think it is an work for you. Thank you very much for your attention. Your faithfully. Giorgio Volpini.

3 3

ncv problem
by stef.coene＠docum.org 30 Nov '06

30 Nov '06

Hi, I'm running hobbit 4.1.2p1 on AIX. I want to use ncv for graphing. My self-written test returns a html table. To get this displayed correctly, I send something like this to the hobbit server: ----- </pre> <table> blabla </table> <pre> ------ This is working fine. But adding ncv to the mix is causing problems. Adding the ncv info before </pre> has the result that I have a graph, but the rest is cut off. Adding ncv after <pre> means no graph and the rrd file is filled with 3 counters. It looks like hobbit is parsing the <table> and some <tr> lines as counters. Is it possible that the ncv modules dislikes html code in the message ? Stef

2 1

Large Log Files
by jkwade＠futurefrontiers.com 30 Nov '06

30 Nov '06

I'm having problems monitoring a large LOG file and can use some assistance. I've tried several entries in the client-local.cfg file, but the results have not been great. Basically, the developers want to monitor a web server log file which is in debug mode. The file fills up to 10mb, then rotates to a date/time stamp. They want to monitor for specific strings. Example: J2CA0056I The problem is that if Hobbit is checking every 5 minutes, or even every 1 or 2 minutes, the error can feed by to fast for Hobbit to detect. I tried using the trigger function, (See Below), but it didn't seem to work. We entered the string into the file manually, and Hobbit gave no errors. One question I have is the MAX size variable. How does this relate to the file size? As you can see below, I increased the MAX size variable. I've put my client-local.cfg entry below. Any suggestions would be appreciated. [server10] log:/var/adm/messages:10240 log:/logs/server10/SystemOut.log:40960 trigger J2CA0056I log:/logs/server10/SystemErr.log:40960 log:`ls /logs/server10/SystemErr_*`:40960 log:`ls /logs/server10/SystemOut_*`:40960 The last two entries, I'm trying to monitor the rollup files as well in case the log rolls over before Hobbit has a chance to see the error. However, this didn't seem to work to effectively either. Thanks.....James

3 2

[hobbit] server load issue?
by David.Gore＠VerizonBusiness.com 30 Nov '06

30 Nov '06

Henrik, For you consideration, I think the server may go a little crazy if you try to send updated client packages to too many hosts at the same time, false failed tests, pages sent on those same false failed tests, and status pages not available for those same false failed tests: bb-display.log: ... 2006-11-30 01:11:44 Whoops ! bb failed to send message - timeout 2006-11-30 01:11:44 hobbitd status-board not available clientdata.log: 2006-11-30 00:51:20 Whoops ! bb failed to send message - timeout 2006-11-30 00:56:12 Whoops ! bb failed to send message - timeout 2006-11-30 00:58:17 Whoops ! bb failed to send message - timeout 2006-11-30 00:59:41 Whoops ! bb failed to send message - timeout hobbitclient.log: [hobbit at hobbit1 logs]$ cat hobbitclient.log 2006-11-30 00:58:16 Whoops ! bb failed to send message - timeout Here is what my config looks like client-local.cfg: [temip-be-hpux11] # these are class names, not host names clientversion:temip-be-hpux11v10 log:/var/adm/syslog/syslog.log:10240 [temip-fe-hpux11] clientversion:temip-fe-hpux11v10 log:/var/adm/syslog/syslog.log:10240 [temip-tns-hpux11] clientversion:temip-tns-hpux11v2 log:/var/adm/syslog/syslog.log:10240 I suppose I updated about 60+ remote hosts at once, perhaps we should just try to figure out what our server can handle? Or should the server be made to be smarter? The server is a simple 3 Ghz dual core Intel Fedora Core 5 host with 1G of memory. -- David

2 4

Need Hobbit Clients for Sparc Solaris
by johnellallen＠gmail.com 30 Nov '06

30 Nov '06

I'm planning to monitor Sparc Solaris machines, version ranging SunOS4.1.3to Solaris 10, but my pre-compiled client from Solaris 10 didn't work on lower solaris versions Hope you could send me your pre-compiled clients on all or any sparc solaris clients you have. Just send me the tar of !HOBBITHOME/client. Thanks a lot in advance. - Johnell

5 6

[hobbit] SMTP and FTP Services Red
by PNIXON＠ci.somerville.ma.us 29 Nov '06

29 Nov '06

Did you try putting an entry for Hobbit server into their hosts files? I think the delay is from the Server trying to do a reverse lookup on the IP Address. You may also have to change the order in which they resolve DNS.... in /etc/nsswitch.conf (or whatever is appropriate for your distribution) change from hosts: db files nisplus nis dns to hosts: files nisplus nis dns db _____ From: Geoff Hallford [mailto:geoff.hallford at gmail.com] Sent: Wednesday, November 29, 2006 3:46 PM To: hobbit at hswn.dk Subject: [hobbit] SMTP and FTP Services Red Hello, On a few of our servers the SMTP and FTP services are RED but when I telnet to them, they do show the proper 220 status good. They are quite slow to respond though, taking sometimes 10-15 seconds. Is there anyway to get Hobbit to pause and wait for this? If not, how long does it wait before it shows a red status? Thank you very much for your help. Geoff Hallford

1 0

SMTP and FTP Services Red
by geoff.hallford＠gmail.com 29 Nov '06

29 Nov '06

Hello, On a few of our servers the SMTP and FTP services are RED but when I telnet to them, they do show the proper 220 status good. They are quite slow to respond though, taking sometimes 10-15 seconds. Is there anyway to get Hobbit to pause and wait for this? If not, how long does it wait before it shows a red status? Thank you very much for your help. Geoff Hallford

1 0

Superimposing rrd graphs
by grsamy＠yahoo.com 29 Nov '06

29 Nov '06

Is it possible to combine the history graph in to one graph by selectively superimposing historical graphs? For example: I would like to see the TCP/IP statistics for last 24 hours and TCP/IP statistics for the previous 24 hours appear on the same graph (with different colors, not as a continous line) so that I can compare them easily. Thanks Ram ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

1 0

Logfile not accessible
by jkwade＠futurefrontiers.com 29 Nov '06

29 Nov '06

I'm monitoring about 8 log files on a system, and on some of them, I'm getting a "Logfile not accessible" . I can login to the box as the hobbit user and cat the files out just fine. The privileges all match up with the other logfiles that are working just fine. Manually, I can see the files just fine. How does Hobbit try to read the log files? I would appreciate any suggestions. Thanks.James

4 5

hobbit-alerts.cfg regex/MACRO problem - need help
by jonescr＠cisco.com 29 Nov '06

29 Nov '06

I am trying to use a regex macro to exclude a number of hosts from an alert. Here is the one I was using at first: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11) Here is how I am using it for the actual alert definition: HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$ This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest": $ pcretest PCRE version 6.6 06-Feb-2006 re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/ data> prod-web-12 No match data> prod-web-11 0: prod-web-11 1: <unset> 2: 11 data> As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it. *However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section. *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert. ../bin/hobbitd_alert --test prod-web-11 procs --color-red 00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging 00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' *** 00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170 00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' *** 00009993 2006-11-09 21:48:30 Mail alert with command 'mail xxxxx at cingularme.com' 00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200) ... 00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded) * Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above). I have also tried enclosing the regex in quotes, which didn't work either. If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong. -Charles

2 5