December 2006 - Xymon - Xymon mailman web

No Alert
by jkwade＠futurefrontiers.com 07 Dec '06

07 Dec '06

I had a system go red today on disk space, but it didn't alert anyone, not even me, and I'm setup to receive all alerts. This is at the top of hobbit-alerts.cfg HOST=* MAIL me at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED Here's the DB Folks: HOST=%ddu* SERVICE=conn,disk MAIL DBS at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED HOST=%dpu* SERVICE=conn,disk MAIL DBS at myemail.com REPEAT=15 COLOR=RED DURATION<30 RECOVERED (The hosts dpu and ddu are database production unix, and database development unix) Anyone have any ideas on were I can track this down at? Why it didn't page anyone. I checked the notification file in /var/log/hobbit, and it showed no page going on. Not sure why. This was a database server, so I've got folks asking why they didn't get notified that the disk was full. I found out when I came in this morning and looked at the Display page. Thanks...James

2 1

shire mailing list
by gjohnson＠trantor.org 07 Dec '06

07 Dec '06

Has anyone else had issues with emails not getting to The Shire's developer list? =G=

1 0

FW: [hobbit] NCV rrd help
by Alun.Watson＠fp.co.nz 07 Dec '06

07 Dec '06

Wow ... don't I feel like a boob. Thanks Dan you were right I've changed the squid and squidclients to this and it works. [squid] TITLE Squid IN-OUT YAXIS # bits DEF:serverhttpbitsin=squid.rrd:serverhttpbitsin:AVERAGE DEF:serverhttpbitsout=squid.rrd:serverhttpbitsout:AVERAGE LINE2:serverhttpbitsin#555555:IN_Traffic LINE2:serverhttpbitsout#880000:OUT_Traffic COMMENT:\n GPRINT:serverhttpbitsin:LAST:IN_Traffic \: %5.1lf%s (cur) GPRINT:serverhttpbitsin:MAX: \: %5.1lf%s (max) GPRINT:serverhttpbitsin:MIN: \: %5.1lf%s (min) GPRINT:serverhttpbitsin:AVERAGE: \: %5.1lf%s (avg)\n GPRINT:serverhttpbitsout:LAST:OUT_Traffic \: %5.1lf%s (cur) GPRINT:serverhttpbitsout:MAX: \: %5.1lf%s (max) GPRINT:serverhttpbitsout:MIN: \: %5.1lf%s (min) GPRINT:serverhttpbitsout:AVERAGE: \: %5.1lf%s (avg)\n [squidclients] TITLE Squid Clients YAXIS # count DEF:numberofclients=squidclients.rrd:numberofclients:AVERAGE LINE2:numberofclients#880000:Number_of_clients COMMENT:\n GPRINT:numberofclients:LAST:Number_of_clients \: %5.1lf%s (cur) GPRINT:numberofclients:MAX: \: %5.1lf%s (max) GPRINT:numberofclients:MIN: \: %5.1lf%s (min) GPRINT:numberofclients:AVERAGE: \: %5.1lf%s (avg)\n ________________________________ From: Dan Vande More [mailto:bigdan at gmail.com] Sent: Thursday, 7 December 2006 12:02 To: hobbit at hswn.dk Subject: Re: [hobbit] NCV rrd help Ok, that looks good. This might be stupid, but according to this: http://oss.oetiker.ch/rrdtool/tut/cdeftutorial.en.html Your DEF lines should be of the format: DEF:var_name_1= some.rrd:ds_name:CF But in your case you have: DEF:serverhttpbitsin=squid.rrd:IN:AVERAGE DEF:serverhttpbitsout=squid.rrd:OUT:AVERAGE DEF:numberofclients=squidclients.rrd:clients:AVERAGE Where you seem to have an odd $ds_name Where did IN, OUT, and clients come from? Your rrds says your ds names are numberofclients, serverhttpbitsin, serverhttpbitsout. It seems this is your problem. Forgive me if it's not, I've only recently gained a rudimentary understanding of how CDEFs work, their complexity has overwhelmed me far too long than I care to admit. Dan

1 0

NCV rrd help
by Alun.Watson＠fp.co.nz 06 Dec '06

06 Dec '06

Hello, I was hoping that you guy's might be able to suggest why my NCV is not displaying. I get links on the both the trends webpage and the new report page. I've set up script that reports squid serverhttpbitsin : 38871.2 serverhttpbitsout : 8186.26 and squidclients numberofclients:28 I've entered into "hobbitserver.cfg" TEST2RRD="cpu=la<snip>,squid=ncv,squidclients=ncv" GRAPHS="la,<snip>,ncv,squid,squidclients" NCV_squid="serverhttpbitsin:GAUGE,serverhttpbitsout:GAUGE,*:NONE" NCV_squidclients="numberofclients:GAUGE,*:NONE" "hobbitgraph.cfg" [squid] TITLE Squid IN-OUT YAXIS # bits DEF:serverhttpbitsin=squid.rrd:IN:AVERAGE DEF:serverhttpbitsout=squid.rrd:OUT:AVERAGE LINE2:IN#555555:IN_Traffic LINE2:OUT#880000:OUT_Traffic COMMENT:\n GPRINT:IN:LAST:IN_Traffic \: %5.1lf%s (cur) GPRINT:IN:MAX: \: %5.1lf%s (max) GPRINT:IN:MIN: \: %5.1lf%s (min) GPRINT:IN:AVERAGE: \: %5.1lf%s (avg)\n GPRINT:OUT:LAST:OUT_Traffic \: %5.1lf%s (cur) GPRINT:OUT:MAX: \: %5.1lf%s (max) GPRINT:OUT:MIN: \: %5.1lf%s (min) GPRINT:OUT:AVERAGE: \: %5.1lf%s (avg)\n [squidclients] TITLE Squid Clients YAXIS # count DEF:numberofclients=squidclients.rrd:clients:AVERAGE LINE2:clients#880000:Number_of_clients COMMENT:\n GPRINT:clients:LAST:Number_of_clients \: %5.1lf%s (cur) GPRINT:clients:MAX: \: %5.1lf%s (max) GPRINT:clients:MIN: \: %5.1lf%s (min) GPRINT:clients:AVERAGE: \: %5.1lf%s (avg)\n

2 3

hobbit-alerts.cfg regex/MACRO problem - need help
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

I am trying to use a regex macro to exclude a number of hosts from an alert. Here is the one I was using at first: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)|prod-web-(1|2|3|4|9|10|11) Here is how I am using it for the actual alert definition: HOST=%(prod-.*) SERVICE=* EXHOST=$UNUSED_PROD MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms I ran into a problem with the host "prod-app-12" matching the regex. I realized this was because I was not terminating the numbers, so I changed my variable to: $UNUSED_PROD=%prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$ This SHOULD work according to online regex testing tools, and I also at Henriks advice, verified it using "pcretest": $ pcretest PCRE version 6.6 06-Feb-2006 re> /prod-app-(2|3|4|5|6|7|8|9|10|11|12|18|20|21|22|23|24)$|prod-web-(1|2|3|4|9|10|11)$/ data> prod-web-12 No match data> prod-web-11 0: prod-web-11 1: <unset> 2: 11 data> As seen above, the host "prod-web-12" does NOT match, but "prod-web-11" DOES, which is exactly how I want it. *However, when I use this in hobbit-alerts.cfg. I do not get the expected behavior. Instead, ALL hosts match, according to pages sent out and from viewing the "info" section. *The strange thing is, according to hobbitd_alert --test, the hostname was successfully excluded, but clicking on the "info" column for hosts that are supposed to be excluded reveals that they are still configured to alert. ../bin/hobbitd_alert --test prod-web-11 procs --color-red 00009993 2006-11-09 21:48:30 send_alert prod-web-11:procs state Paging 00009993 2006-11-09 21:48:30 *** Match with 'HOST=%(prod-.*) SERVICE=*' *** 00009993 2006-11-09 21:48:30 Matching host:service:page 'prod-web-11:procs:PROD/PRODWEB' against rule line 170 00009993 2006-11-09 21:48:30 *** Match with 'MAIL $PRIMARY color=red REPEAT=60 RECOVERED NOTICE format=sms' *** 00009993 2006-11-09 21:48:30 Mail alert with command 'mail xxxxx at cingularme.com' 00009993 2006-11-09 21:48:30 Failed 'MAIL $SECONDARY color=red DURATION>20 REPEAT=60 RECOVERED NOTICE format=sms' (min. duration 0<1200) ... 00009993 2006-11-09 21:48:30 Failed 'HOST=* SERVICE=* EXHOST=$UNUSED_PROD' (hostname excluded) * Another thing, when I do the same test as above, using hostname "prod-web-12", which is a host that should NOT be excluded, hobbitd_alert still says that it was excluded (same last line of output as the prod-web-11 test above). I have also tried enclosing the regex in quotes, which didn't work either. If anyone has any insight, please let me know. I have contacted Henrik about this, but I believe he misread my email, as he suggested that I add $ to the regex, which I had already tried...so now I am hoping that he or someone else sees this message and can see what Im doing wrong. -Charles

3 8

Running Hobbit on custom apache port
by jonescr＠cisco.com 06 Dec '06

06 Dec '06

Im running my Hobbit apache on a custom port. At the bottom of alerts, it does not specify the port number, and also does not use the FQDN: "See http://hobbitserver/hobbit-cgi/bb-hostsvc.sh?HOST=somehost&SERVICE=cpu" Where can I make a change so that instead I get the FQDN, and the port, like: "See http://hobbitserver.mydomain.com:8000/hobbit-cgi/bb-hostsvc.sh?HOST=somehos…" -Charles

3 5

Problem with HP-UX 11.11 ld error
by rleon＠racenter.com 05 Dec '06

05 Dec '06

do_rrd.o ../lib/libbbgen.a -L/opt/rrd/lib -lrrd -L/usr/local/lib -lpng -L/usr/local/lib -lpcre -lnsl /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (hobbitd_rrd.o) was detected. The linked output may not run on a PA 1.x system. /usr/ccs/bin/ld: Unrecognized argument: +init /usr/ccs/bin/ld: Usage: /usr/ccs/bin/ld [options] [flags] files collect2: ld returned 1 exit status gmake[1]: *** [hobbitd_rrd] Error 1 gmake[1]: Leaving directory `/home/bbnet/hobbit-4.2.0/hobbitd' gmake: *** [hobbitd-build] Error 2 root at baclaw:/home/bbnet/hobbit-4.2.0#

1 0

A little off topic
by shea_greg＠emc.com 05 Dec '06

05 Dec '06

Hi all, I've followed the port monitoring threads looking for a solution and while there wasn't one in the list I thought I would ask, because you never know. Is anybody monitoring UDP ports and reporting the data to Hobbit? Anyone have any ideas? I've looked at a number of things already, just want to see if someone else is doing something similar. Thanks -Grs- Gregory R Shea EMC Corporation

1 0

apache graph
by stef.coene＠docum.org 05 Dec '06

05 Dec '06

Hi, I tried to get the apache graphs working. Everything is working, they show up on the trends page, I can see the apache.rrd file and it is upated each 5 minutes. However, there are no updates, so the graph shows NaNQ. This is for an apache server, part of an oracle mid tier installation. If you know oracle, it is possible they changed the layout of the server-status page. I attached the server-status page. Can somebody checks the layout of this page or has a solution for my problem ? Stef

3 5

[hobbit] NCV_testname= specification
by Thomas.Kern＠hq.doe.gov 05 Dec '06

05 Dec '06

Sorry, folks, that wasn't meant for the whole list. I need to read the From/To lines a bit more closely. /Thomas Kern /301-903-2211 > -----Original Message----- > From: Kern, Thomas [mailto:Thomas.Kern at hq.doe.gov] > Sent: Tuesday, December 05, 2006 3:19 PM > To: hobbit at hswn.dk > Subject: RE: [hobbit] NCV_testname= specification >

1 0