December 2006 - Xymon - Xymon mailman web

All network test suddenly purple
by Ralf.Strandell＠silja.com 07 Dec '06

07 Dec '06

Hi I am doing a migration from BigBrother to Hobbit. I have installed Hobbit on a new dedicated Linux server and configured the bb-hosts and started Hobbit. First everything seemed to work. I had nice results from ping, http and dns tests. After that I did not even touch the Hobbit system. Then it all suddenly stopped. All my network tests are purple. Bb-network.log is zero bytes. The ONLY error message that I can find is "df: cannot read table of mounted file systems: Permission denied" and that is not a problem. There's also "hobbitd status-board not available" in the Hobbit server log. I guess something must be wrong with bbtest-net. Any ideas? PID PPID STIME ELAPSED COMMAND 18428 1 Nov30 5-03:06:20 /home/hobbit/server/bin/hobbitlaunch --config=/home/hobbit/server/etc/hobbitlaunch.cfg --env=/h 18429 18428 Nov30 5-03:06:20 hobbitd --pidfile=/var/log/hobbit/hobbitd.pid --restart=/home/hobbit/server/tmp/hobbitd.chk --c 18430 18428 Nov30 5-03:06:15 hobbitd_channel --channel=stachg --log=/var/log/hobbit/history.log hobbitd_history 18431 18430 Nov30 5-03:06:15 hobbitd_history 18432 18428 Nov30 5-03:06:15 hobbitd_channel --channel=clichg --log=/var/log/hobbit/hostdata.log hobbitd_hostdata 18433 18432 Nov30 5-03:06:15 hobbitd_hostdata 18434 18428 Nov30 5-03:06:15 hobbitd_channel --channel=page --log=/var/log/hobbit/page.log hobbitd_alert --checkpoint-file=/ 18435 18434 Nov30 5-03:06:15 hobbitd_alert --checkpoint-file=/home/hobbit/server/tmp/alert.chk --checkpoint-interval=600 18436 18428 Nov30 5-03:06:15 hobbitd_channel --channel=status --log=/var/log/hobbit/rrd-status.log hobbitd_rrd --rrddir=/hom 18437 18428 Nov30 5-03:06:15 hobbitd_channel --channel=data --log=/var/log/hobbit/rrd-data.log hobbitd_rrd --rrddir=/home/ho 18438 18436 Nov30 5-03:06:15 hobbitd_rrd --rrddir=/home/hobbit/data/rrd 18439 18437 Nov30 5-03:06:15 hobbitd_rrd --rrddir=/home/hobbit/data/rrd 18440 18428 Nov30 5-03:06:15 hobbitd_channel --channel=client --log=/var/log/hobbit/clientdata.log hobbitd_client 18441 18440 Nov30 5-03:06:15 hobbitd_client 26129 18428 Dec04 22:35:09 bbtest-net --report --ping --checkresponse 9286 1 14:36 01:24 sh -c vmstat 300 2 1>/home/hobbit/client/tmp/hobbit_vmstat.slfitkusap007.9269 2>&1; mv /home/ho 9287 9286 14:36 01:24 vmstat 300 2

5 11

No Alert
by jkwade＠futurefrontiers.com 07 Dec '06

07 Dec '06

I had a system go red today on disk space, but it didn't alert anyone, not even me, and I'm setup to receive all alerts. This is at the top of hobbit-alerts.cfg HOST=* MAIL me at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED Here's the DB Folks: HOST=%ddu* SERVICE=conn,disk MAIL DBS at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED HOST=%dpu* SERVICE=conn,disk MAIL DBS at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED (The hosts dpu and ddu are database production unix, and database development unix) Anyone have any ideas on were I can track this down at? Why it didn't page anyone. I checked the notification file in /var/log/hobbit, and it showed no page going on. Not sure why. This was a database server, so I've got folks asking why they didn't get notified that the disk was full. I found out when I came in this morning and looked at the Display page. Thanks...James

2 1

shire mailing list
by gjohnson＠trantor.org 07 Dec '06

07 Dec '06

Has anyone else had issues with emails not getting to The Shire's developer list? =G=

1 0

FW: [hobbit] NCV rrd help
by Alun.Watson＠fp.co.nz 07 Dec '06

07 Dec '06

Wow ... don't I feel like a boob. Thanks Dan you were right I've changed the squid and squidclients to this and it works. [squid] TITLE Squid IN-OUT YAXIS # bits DEF:serverhttpbitsin=squid.rrd:serverhttpbitsin:AVERAGE DEF:serverhttpbitsout=squid.rrd:serverhttpbitsout:AVERAGE LINE2:serverhttpbitsin#555555:IN_Traffic LINE2:serverhttpbitsout#880000:OUT_Traffic COMMENT:\n GPRINT:serverhttpbitsin:LAST:IN_Traffic \: %5.1lf%s (cur) GPRINT:serverhttpbitsin:MAX: \: %5.1lf%s (max) GPRINT:serverhttpbitsin:MIN: \: %5.1lf%s (min) GPRINT:serverhttpbitsin:AVERAGE: \: %5.1lf%s (avg)\n GPRINT:serverhttpbitsout:LAST:OUT_Traffic \: %5.1lf%s (cur) GPRINT:serverhttpbitsout:MAX: \: %5.1lf%s (max) GPRINT:serverhttpbitsout:MIN: \: %5.1lf%s (min) GPRINT:serverhttpbitsout:AVERAGE: \: %5.1lf%s (avg)\n [squidclients] TITLE Squid Clients YAXIS # count DEF:numberofclients=squidclients.rrd:numberofclients:AVERAGE LINE2:numberofclients#880000:Number_of_clients COMMENT:\n GPRINT:numberofclients:LAST:Number_of_clients \: %5.1lf%s (cur) GPRINT:numberofclients:MAX: \: %5.1lf%s (max) GPRINT:numberofclients:MIN: \: %5.1lf%s (min) GPRINT:numberofclients:AVERAGE: \: %5.1lf%s (avg)\n ________________________________ From: Dan Vande More [mailto:bigdan at gmail.com] Sent: Thursday, 7 December 2006 12:02 To: hobbit at hswn.dk Subject: Re: [hobbit] NCV rrd help Ok, that looks good. This might be stupid, but according to this: http://oss.oetiker.ch/rrdtool/tut/cdeftutorial.en.html Your DEF lines should be of the format: DEF:var_name_1= some.rrd:ds_name:CF But in your case you have: DEF:serverhttpbitsin=squid.rrd:IN:AVERAGE DEF:serverhttpbitsout=squid.rrd:OUT:AVERAGE DEF:numberofclients=squidclients.rrd:clients:AVERAGE Where you seem to have an odd $ds_name Where did IN, OUT, and clients come from? Your rrds says your ds names are numberofclients, serverhttpbitsin, serverhttpbitsout. It seems this is your problem. Forgive me if it's not, I've only recently gained a rudimentary understanding of how CDEFs work, their complexity has overwhelmed me far too long than I care to admit. Dan

1 0

NCV rrd help
by Alun.Watson＠fp.co.nz 06 Dec '06

06 Dec '06

Hello, I was hoping that you guy's might be able to suggest why my NCV is not displaying. I get links on the both the trends webpage and the new report page. I've set up script that reports squid serverhttpbitsin : 38871.2 serverhttpbitsout : 8186.26 and squidclients numberofclients:28 I've entered into "hobbitserver.cfg" TEST2RRD="cpu=la<snip>,squid=ncv,squidclients=ncv" GRAPHS="la,<snip>,ncv,squid,squidclients" NCV_squid="serverhttpbitsin:GAUGE,serverhttpbitsout:GAUGE,*:NONE" NCV_squidclients="numberofclients:GAUGE,*:NONE" "hobbitgraph.cfg" [squid] TITLE Squid IN-OUT YAXIS # bits DEF:serverhttpbitsin=squid.rrd:IN:AVERAGE DEF:serverhttpbitsout=squid.rrd:OUT:AVERAGE LINE2:IN#555555:IN_Traffic LINE2:OUT#880000:OUT_Traffic COMMENT:\n GPRINT:IN:LAST:IN_Traffic \: %5.1lf%s (cur) GPRINT:IN:MAX: \: %5.1lf%s (max) GPRINT:IN:MIN: \: %5.1lf%s (min) GPRINT:IN:AVERAGE: \: %5.1lf%s (avg)\n GPRINT:OUT:LAST:OUT_Traffic \: %5.1lf%s (cur) GPRINT:OUT:MAX: \: %5.1lf%s (max) GPRINT:OUT:MIN: \: %5.1lf%s (min) GPRINT:OUT:AVERAGE: \: %5.1lf%s (avg)\n [squidclients] TITLE Squid Clients YAXIS # count DEF:numberofclients=squidclients.rrd:clients:AVERAGE LINE2:clients#880000:Number_of_clients COMMENT:\n GPRINT:clients:LAST:Number_of_clients \: %5.1lf%s (cur) GPRINT:clients:MAX: \: %5.1lf%s (max) GPRINT:clients:MIN: \: %5.1lf%s (min) GPRINT:clients:AVERAGE: \: %5.1lf%s (avg)\n

2 3

[hobbit] hobbit-alerts.cfg regex/MACRO problem - need help
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

I offer $5 via paypal to anyone who can help me figure this out. :-) -Charles Charles Jones wrote: > As of today this problem is still a thorn in my side. I've been out > sick this week so just now working on it again. > > Charles Jones wrote: >> I'm still having this problem. If anyone has any ideas I'm open to >> suggestions :) >> >> -Charles >> >> Charles Jones wrote: >>> I am trying to use a regex macro to exclude a number of hosts from >>> an alert. Here is the one I was using at first: >>> $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11) >>> >>> >>> Here is how I am using it for the actual alert definition: >>> HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD >>> MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms >>> MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms >>> >>> >>> I ran into a problem with the host "prod-app-12" matching the regex. >>> I realized this was because I was not terminating the numbers, so I >>> changed my variable to: >>> >>> $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$ >>> >>> >>> This SHOULD work according to online regex testing tools, and I also >>> at Henriks advice, verified it using "pcretest": >>> $ pcretest >>> PCRE version 6.6 06-Feb-2006 >>> >>> re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/ >>> data> prod-web-12 >>> No match >>> data> prod-web-11 >>> 0: prod-web-11 >>> 1: <unset> >>> 2: 11 >>> data> >>> >>> As seen above, the host "prod-web-12" does NOT match, but >>> "prod-web-11" DOES, which is exactly how I want it. >>> >>> *However, when I use this in hobbit-alerts.cfg. I do not get the >>> expected behavior. Instead, ALL hosts match, according to pages sent >>> out and from viewing the "info" section. *The strange thing is, >>> according to hobbitd_alert --test, the hostname was successfully >>> excluded, but clicking on the "info" column for hosts that are >>> supposed to be excluded reveals that they are still configured to alert. >>> >>> ../bin/hobbitd_alert --test prod-web-11 procs --color-red >>> 00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging >>> 00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' *** >>> 00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170 >>> 00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' *** >>> 00009993 2006-11-09 21:48:30 Mail alert with command 'mail xxxxx at cingularme.com' >>> 00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200) >>> ... >>> 00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded) >>> >>> * Another thing, when I do the same test as above, using hostname >>> "prod-web-12", which is a host that should NOT be excluded, >>> hobbitd_alert still says that it was excluded (same last line of >>> output as the prod-web-11 test above). >>> >>> I have also tried enclosing the regex in quotes, which didn't work >>> either. >>> >>> If anyone has any insight, please let me know. I have contacted >>> Henrik about this, but I believe he misread my email, as he >>> suggested that I add $ to the regex, which I had already tried...so >>> now I am hoping that he or someone else sees this message and can >>> see what Im doing wrong. >>> >>> -Charles >>> >> >

2 2

Hobbit alert URL in emails (Re: [hobbit] Running Hobbit on custom apache port)
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

I just discovered a new issue. My Hobbit server Apache only runs in SSL mode, so the url is https, not http. At the bottom of alert emails, it says to go to http. Is there anywhere to change this to https, other than hacking the source and recompiling? -Charles Charles Jones wrote: > Thanks Greg! I should have thought to look there before asking :) > > -Charle > > Hubbard, Greg L wrote: >> In the file ~server/etc/hobbitserver.cfg, change the setting of >> BBSERVERWWWNAME to include your port -- i.e. change from >> "myserver.myspot.com" to "myserver.myspot.com:8000" -- this should >> propagate throughout Hobbit. >> >> -----Original Message----- >> From: Charles Jones [mailto:jonescr at cisco.com] Sent: Monday, October >> 23, 2006 12:39 PM >> To: hobbit at hswn.dk >> Subject: [hobbit] Running Hobbit on custom apache port >> >> Im running my Hobbit apache on a custom port. At the bottom of alerts, >> it does not specify the port number, and also does not use the FQDN: >> >> "See >> http://hobbitserver/hobbit-cgi/bb-hostsvc.sh?HOST=somehost&SERVICE=cpu" >> >> Where can I make a change so that instead I get the FQDN, and the port, >> like: >> >> "See >> http://hobbitserver.mydomain.com:8000/hobbit-cgi/bb-hostsvc.sh?HOST=some >> host&SERVICE=cpu" >> > >

2 2

Problem with HP-UX 11.11 ld error
by rleon＠racenter.com 05 Dec '06

05 Dec '06

do_rrd.o ../lib/libbbgen.a -L/opt/rrd/lib -lrrd -L/usr/local/lib -lpng -L/usr/local/lib -lpcre -lnsl /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (hobbitd_rrd.o) was detected. The linked output may not run on a PA 1.x system. /usr/ccs/bin/ld: Unrecognized argument: +init /usr/ccs/bin/ld: Usage: /usr/ccs/bin/ld [options] [flags] files collect2: ld returned 1 exit status gmake[1]: *** [hobbitd_rrd] Error 1 gmake[1]: Leaving directory `/home/bbnet/hobbit-4.2.0/hobbitd' gmake: *** [hobbitd-build] Error 2 root at baclaw:/home/bbnet/hobbit-4.2.0#

1 0

A little off topic
by shea_greg＠emc.com 05 Dec '06

05 Dec '06

Hi all, I've followed the port monitoring threads looking for a solution and while there wasn't one in the list I thought I would ask, because you never know. Is anybody monitoring UDP ports and reporting the data to Hobbit? Anyone have any ideas? I've looked at a number of things already, just want to see if someone else is doing something similar. Thanks -Grs- Gregory R Shea EMC Corporation

1 0

apache graph
by stef.coene＠docum.org 05 Dec '06

05 Dec '06

Hi, I tried to get the apache graphs working. Everything is working, they show up on the trends page, I can see the apache.rrd file and it is upated each 5 minutes. However, there are no updates, so the graph shows NaNQ. This is for an apache server, part of an oracle mid tier installation. If you know oracle, it is possible they changed the layout of the server-status page. I attached the server-status page. Can somebody checks the layout of this page or has a solution for my problem ? Stef

3 5