March 2006 - Xymon - Xymon mailman web

[hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
by EES2Y＠hscmail.mcc.virginia.edu 02 Mar '06

02 Mar '06

Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should have worked (or at least, it works on my server running the openssh version of sshd). Have you tried telneting into the port and typing the version number in yourself? If it accepts it, you'll get some crazy diffie-hellman text, otherwise it will spit a protocol mismatch line back at you. Also, silly question, but did you make sure to include to '\r\n' at the end of the message? If you did, you might want to try messing with that (changing it to just '\r' or '\n') because the protocol error in your syslog looks a little weird (extra newline), so I'm wondering if there isnt something wrong there. -Eric > -----Original Message----- > From: McGraw, Robert P. [mailto:rmcgraw at purdue.edu] > Sent: Thursday, March 02, 2006 2:19 PM > To: hobbit at hswn.dk > Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > I am having the same problem and trying to follow your instructions. > > > > I ran > > > > ##R##-zorn->[227] ##> ssh -V > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > To get the version number. > > > > I also ran telnet host 22 and got back the following > > > > SSH-2.0-Sun_SSH_1.0.1 > > > > I have tried the following > > > > SSH-2.0-Sun_SSH_1.0.1 > > Sun_SSH_1.1 > > Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f > > > > as the version number with no luck. > > > > I keep getting the following message log. > > > > Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 > auth.info] Bad protocol version identification 'Sun_SSH_1.1 > > Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 > > > > The only change in the log message is the version > identification string. > > > > How do I find the right version number to use? > > > > Thanks > > > > Robert > > > > > > > > _____________________________________________________________________ > > Robert P. McGraw, Jr. > > Manager, Computer System > EMAIL: rmcgraw at purdue.edu > > Purdue University > ROOM: MATH-807 > > Department of Mathematics > PHONE: (765) 494-6055 > > 150 N. University Street > FAX: (419) 821-0540 > > West Lafayette, IN 47907-2067 > > ________________________________ > > From: thomas.seglard.enata at cnp.fr > [mailto:thomas.seglard.enata at cnp.fr] > Sent: Thursday, March 02, 2006 12:21 PM > To: hobbit at hswn.dk > Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog > > > > > Thank you ! > > the second option (the one you preferred) was a good bet ! > I added the lines as you indicate and that's solved my problem. > > Best regards, > > Thomas Seglard > > "Schwimmer, Eric E *HS" <EES2Y at hscmail.mcc.virginia.edu> a > écrit sur 02/03/2006 17:31:10 : > > > > > Three posibilities, off the top of my head: > > > > On the client side: > > 1. Install syslog-ng instead of ksyslogd, and > > filter on the ip address of your hobbit server. > > 2. Call your logrotate script (assuming you use one) > > more often, and/or make it compress your old syslog > > messages. > > > > On the hobbit server side: > > (this is my preferred option) > > 1. change your bb-services file ($HOBBIT/server/etc/bb-services) > > so that ssh test sends the version string. I think that will > > stop your sshd from complaining. > > > > ie.: > > > > [ssh|ssh1|ssh2] > > send "SSH-2.0-OpenSSH_4.1\r\n" > > expect "SSH" > > options banner > > port 22 > > > >

1 0

[hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
by rmcgraw＠purdue.edu 02 Mar '06

02 Mar '06

I am having the same problem and trying to follow your instructions. I ran ##R##-zorn->[227] ##> ssh -V Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f To get the version number. I also ran telnet host 22 and got back the following SSH-2.0-Sun_SSH_1.0.1 I have tried the following SSH-2.0-Sun_SSH_1.0.1 Sun_SSH_1.1 Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f as the version number with no luck. I keep getting the following message log. Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1 Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 The only change in the log message is the version identification string. How do I find the right version number to use? Thanks Robert _____________________________________________________________________ Robert P. McGraw, Jr. Manager, Computer System EMAIL: rmcgraw at purdue.edu Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (765) 494-6055 150 N. University Street FAX: (419) 821-0540 West Lafayette, IN 47907-2067 _____ From: thomas.seglard.enata at cnp.fr [mailto:thomas.seglard.enata at cnp.fr] Sent: Thursday, March 02, 2006 12:21 PM To: hobbit at hswn.dk Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <EES2Y at hscmail.mcc.virginia.edu> a écrit sur 02/03/2006 17:31:10 : > > Three posibilities, off the top of my head: > > On the client side: > 1. Install syslog-ng instead of ksyslogd, and > filter on the ip address of your hobbit server. > 2. Call your logrotate script (assuming you use one) > more often, and/or make it compress your old syslog > messages. > > On the hobbit server side: > (this is my preferred option) > 1. change your bb-services file ($HOBBIT/server/etc/bb-services) > so that ssh test sends the version string. I think that will > stop your sshd from complaining. > > ie.: > > [ssh|ssh1|ssh2] > send "SSH-2.0-OpenSSH_4.1\r\n" > expect "SSH" > options banner > port 22

1 0

[hobbit] Order in rules keyword
by EES2Y＠hscmail.mcc.virginia.edu 02 Mar '06

02 Mar '06

Are you referring to the host tags in the bb-hosts file? like: 10.0.0.1 myhost # badconn1:1:2 NOPROPRED:conn If so, then no, the order of the tags after the '#' doesn't matter. -Eric > -----Original Message----- > From: Lardinois, Pierre [mailto:plardinois at be.tiauto.com] > Sent: Thursday, March 02, 2006 11:43 AM > To: 'hobbit at hswn.dk' > Subject: [hobbit] Order in rules keyword > > > Hi again, > > Is There a specific order in the keywords ? > > Thanks you for your support, > > regards, > > P. Lardinois > > > The information contained in this transmission may contain > privileged and > confidential information. It is intended only for the use of the > person(s) named above. If you are not the intended recipient, you are > hereby notified that any review, dissemination, distribution or > duplication of this communication is strictly prohibited. If > you are not > the intended recipient, please contact the sender by reply email and > destroy all copies of the original message. > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > >

1 0

Order in rules keyword
by plardinois＠be.tiauto.com 02 Mar '06

02 Mar '06

Hi again, Is There a specific order in the keywords ? Thanks you for your support, regards, P. Lardinois The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

1 0

RRDTool Upgrade Known Issues?
by Robert.Taylor＠HendrickAuto.com 02 Mar '06

02 Mar '06

All, Has anyone run into issues upgrading from RRDTool 1.0.x to 1.2.x with Hobbit 4.1.1? I am thinking of upgrading on my Hobbit server and just want to see if there are any known issues. Also, is there a need to re-compile Hobbit after the RRDTool upgrade? Robert Taylor

2 1

[hobbit] Question about NOTICE in hobbit-alerts.cfg
by thomas.seglard.enata＠cnp.fr 02 Mar '06

02 Mar '06

Accusé de réception Votre [hobbit] Question about NOTICE in hobbit-alerts.cfg document : a été Thomas SEGLARD/FI6/ANFI/CNP Assurances reçu par : le : 02/03/2006 11:25:58 Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.

1 0

[hobbit] using var in bb-hosts?
by brandste＠hebis.de 02 Mar '06

02 Mar '06

Hi all, maybe a not important question... Using bb-hosts with multiple hosts elongates to quiet a view lines ;-) But using different tests, slas, maintenance windows and stuff easy generates a lot of rows...and the line gets hard to read and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts? So one could group: $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0" $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3" 1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-service 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA-service ... man for bb-hosts says nothing about it. Best Mathias

1 0

Moving to new Hobbit server
by allan＠zandahar.net 02 Mar '06

02 Mar '06

Hey guys, Can't seem to find anything on this but then again I haven't gone through all the results that come up on the mailing list search either. We moved from BB server to a Hobbit server a while ago but it was on the same box so there was no issue there. We are shuffling some old hardware around and decided to give our hobbit server some more grunt and also add some other odd apps on it. We'll want to progrssively move the hosts over to the new server so the clients are cool, just update the ip in windows ones, and the ip and hostname in the nix ones As for the server I'm assuming I can just copy the data dir over for the host I'm moving. I cannot imagine there being anything server specific in any of the status messages or graphs ? So action plan would be, shut down client on XYZ, define it in bb-hosts file on NEWHOBBIT, has it out in the OLDHOBBIT bb-hosts file, copy appropriate data folders from OLDHOBBIT to NEWHOBBIT (update ownership if need be), update ip addy and hostname in XYZ client settings, start client XYZ, be happy :) Any flaws in this thinking or suggestions of easier way even though I cannot imagine one can you please let me know Thanks Allan

5 9

[hobbit] Slightly OT: External Perl Script
by EES2Y＠hscmail.mcc.virginia.edu 01 Mar '06

01 Mar '06

It's 118 lines, it does open a TCP socket, strictly for message sending, but it also does a little error handling and combo msging to make life easier on your bb server: http://nerdvana.org/eric/files/bbmsg.pm You could probably also send other commands (drop, rename, etc) through it, but I havent tried, so caveat emptor :) -Eric > -----Original Message----- > From: Charles Jones [mailto:jonescr at cisco.com] > Sent: Wednesday, March 01, 2006 2:45 PM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Slightly OT: External Perl Script > > If it's short please post it, or a link to it. Isn't all that > is needed is to make a TCP connection, or are you completely > emulating all of the functions of the bb binary? > > -Charles > > Schwimmer, Eric E *HS wrote: > > I've got a perl module that emulates the bb binary, if anybody > is interested. > > -Eric > > > > -----Original Message----- > From: FARRIOR, Andy > [mailto:Andy.Farrior at victoriacollege.edu] > Sent: Wednesday, March 01, 2006 11:23 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Slightly OT: External Perl Script > > > ARGH! replied to the wrong person.... must > drink more coffee.... > > > that'd do it to. I know his $msg had a bunch > of quotes in it > and was killing the shell. > > > again, sorry about that. > > andy > > > ________________________________ > > From: Sherman, Larry, GCM > [mailto:Larry.Sherman at rbsgc.com] > Sent: Wednesday, March 01, 2006 8:41 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Slightly OT: External Perl Script > > > > How about > > > > $LINE = "status $hostname.ups $color $now - > some Text if you > want it $msg"; > > system("/path/to/bb $bbhost \"$LINE\" &") > > > > That's what I do > > > > > > > > -----Original Message----- > From: Taylor, Robert > [mailto:Robert.Taylor at HendrickAuto.com] > Sent: Wednesday, March 01, 2006 9:24 AM > To: hobbit at hswn.dk > Subject: [hobbit] Slightly OT: External Perl Script > > > > All, > > > > This may be slightly off topic, but I figured > that there is > someone here > > that can help. Over the past weekend I wrote > my first Perl script to > > replace a number of aging shell scripts that I > had. What I > have done is > > written Perl scripts to query Liebert UPS > systems, Netbotz environment > > monitors and Juniper SSL VPN appliances. > Needless to say I am now a > > believer in how much faster Perl is than shell. > My scripts > dropped from > > about almost two minutes to run to 8 seconds. > > > > I can see all of the output when I print to > screen so I know > that it is > > polling everything okay. The problem that I am > having is getting Perl > > to send this data to Hobbit. It is just a > formatting issue as I can > > have it send plain text fine, but I am trying > to send HTML to create > > nice looking status pages. I have looked at previous > scripts, but they > > all use the BigBrother.pm module and I would > like to get this working > > without that. I am by no means a programmer > but this problem is going > > to bother me until I can get it working. > > > > Perhaps someone could provide just a bit of > Perl guidance? > The portion > > of the code that I think it is getting hung up > on is the colons in the > > HTML, but I am not sure. > > > > sub sendupdates { > > > > $msg = <<EOM; > > <html><body><center> > >  > > <table border=\"0\" align=\"center\" id=\"table1\" > > style=\"height: 197px; width: 649px;\"> > > <tbody> > > <tr> > > <th align=\"center\"> > > <hr width=\"100%\"></th> > > </tr> > > > > < snip other HTML > > > > > </center> > > </body> > > </html> > > > > EOM > > > > my $now = localtime($^T) . "\n"; > > > > if ($debug eq "yes"){ > > print "------------------- Time Stamp > --------------------\n"; > > print "Time Stamp: $now\n"; > > print "------------------- HTML Output > -------------------\n"; > > print $msg; > > } > > > > > > system("$bb $bbhost \"status ${bbhostname}.ups > $color $now ${msg}\""); > > > > > > } > > > > > > The error messages that our output to the > screen give the following: > > > > bb: incorrect number of arguments > > Format: <IP-ADDR> <DATA> > > sh: line 5: width:: command not found > > sh: line 13: > > > > > then there are also a lot of the following messages: > > > > sh: line 14: > </div> > > <table id=table2 style=width:: No such > file or directory > > sh: line 14: height:: command not found > > sh: line 17: > > > <tbody> > > <tr> > > <th width=267style=font-weight:: > command not found > > sh: line 17: text-align:: command not found > > sh: line 18: >Hostname:</th> > > > > > > Thanks in advance for any help. > > > > Robert Taylor > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > > > ________________________________ > > > > > ******************************************************************* > * > > This e-mail is intended only for the addressee > named above. > As this e-mail may contain confidential or > privileged information, > if you are not the named addressee, you are not > authorized > to retain, read, copy or disseminate this > message or any part of > it. > > > ******************************************************************* > * > > > > > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > >

1 0

[hobbit] Slightly OT: External Perl Script
by EES2Y＠hscmail.mcc.virginia.edu 01 Mar '06

01 Mar '06

I've got a perl module that emulates the bb binary, if anybody is interested. -Eric > -----Original Message----- > From: FARRIOR, Andy [mailto:Andy.Farrior at victoriacollege.edu] > Sent: Wednesday, March 01, 2006 11:23 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Slightly OT: External Perl Script > > > ARGH! replied to the wrong person.... must drink more coffee.... > > > that'd do it to. I know his $msg had a bunch of quotes in it > and was killing the shell. > > > again, sorry about that. > > andy > > > ________________________________ > > From: Sherman, Larry, GCM [mailto:Larry.Sherman at rbsgc.com] > Sent: Wednesday, March 01, 2006 8:41 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Slightly OT: External Perl Script > > > > How about > > > > $LINE = "status $hostname.ups $color $now - some Text if you > want it $msg"; > > system("/path/to/bb $bbhost \"$LINE\" &") > > > > That's what I do > > > > > > > > -----Original Message----- > From: Taylor, Robert [mailto:Robert.Taylor at HendrickAuto.com] > Sent: Wednesday, March 01, 2006 9:24 AM > To: hobbit at hswn.dk > Subject: [hobbit] Slightly OT: External Perl Script > > > > All, > > > > This may be slightly off topic, but I figured that there is > someone here > > that can help. Over the past weekend I wrote my first Perl script to > > replace a number of aging shell scripts that I had. What I > have done is > > written Perl scripts to query Liebert UPS systems, Netbotz environment > > monitors and Juniper SSL VPN appliances. Needless to say I am now a > > believer in how much faster Perl is than shell. My scripts > dropped from > > about almost two minutes to run to 8 seconds. > > > > I can see all of the output when I print to screen so I know > that it is > > polling everything okay. The problem that I am having is getting Perl > > to send this data to Hobbit. It is just a formatting issue as I can > > have it send plain text fine, but I am trying to send HTML to create > > nice looking status pages. I have looked at previous > scripts, but they > > all use the BigBrother.pm module and I would like to get this working > > without that. I am by no means a programmer but this problem is going > > to bother me until I can get it working. > > > > Perhaps someone could provide just a bit of Perl guidance? > The portion > > of the code that I think it is getting hung up on is the colons in the > > HTML, but I am not sure. > > > > sub sendupdates { > > > > $msg = <<EOM; > > <html><body><center> > >  > > <table border=\"0\" align=\"center\" id=\"table1\" > > style=\"height: 197px; width: 649px;\"> > > <tbody> > > <tr> > > <th align=\"center\"> > > <hr width=\"100%\"></th> > > </tr> > > > > < snip other HTML > > > > > </center> > > </body> > > </html> > > > > EOM > > > > my $now = localtime($^T) . "\n"; > > > > if ($debug eq "yes"){ > > print "------------------- Time Stamp --------------------\n"; > > print "Time Stamp: $now\n"; > > print "------------------- HTML Output -------------------\n"; > > print $msg; > > } > > > > > > system("$bb $bbhost \"status ${bbhostname}.ups $color $now ${msg}\""); > > > > > > } > > > > > > The error messages that our output to the screen give the following: > > > > bb: incorrect number of arguments > > Format: <IP-ADDR> <DATA> > > sh: line 5: width:: command not found > > sh: line 13: > > > > > then there are also a lot of the following messages: > > > > sh: line 14: > </div> > > <table id=table2 style=width:: No such file or directory > > sh: line 14: height:: command not found > > sh: line 17: > > > <tbody> > > <tr> > > <th width=267style=font-weight:: command not found > > sh: line 17: text-align:: command not found > > sh: line 18: >Hostname:</th> > > > > > > Thanks in advance for any help. > > > > Robert Taylor > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > > > ________________________________ > > > > ******************************************************************* > * > > This e-mail is intended only for the addressee named above. > As this e-mail may contain confidential or privileged information, > if you are not the named addressee, you are not authorized > to retain, read, copy or disseminate this message or any part of > it. > > ******************************************************************* > * > > >

2 1