May 2006 - Xymon - Xymon mailman web

client-local.cfg: "ignore" ignored?
by Dominique.Frise＠unil.ch 30 Jun '06

30 Jun '06

Hi, We have following config. in our server's client-local.cfg: ---------- [mailc] log:/var/log/messages:10240 ignore MailScanner ---------- The /var/log/messages of the "mailc" client is filled up with lines like following that we would like to exclude totally: ---------- May 13 06:26:41 mailc MailScanner[933]: HTML Img tag found in message 1Feli1-0004tG-Dt from dmawllet at hotmail.com ---------- The lines with "MailScanner" of "mailc" client (Debian 2.4.22) are never ignored. I.e. we get -yellow/red- alarms for lines with "MailScanner" tag in it. --- some infos from the client --- bb at mailc:~$ wc -l /var/log/messages 10790 /var/log/messages bb at mailc:~$ grep MailScanner /var/log/messages | wc -l 10795 bb at mailc:/soft/pub/BB/hobbit/client/tmp$ cat logfetch.* log:/var/log/messages:10240 ignore MailScanner /var/log/messages:1306142:1281851:1252634:1227431:1200018:1156195:1115234 bb at mailc:/soft/pub/BB/hobbit/client/tmp$ --- What are we doing wrong? (client is running a snapshot of 25th april) Dominique UNIL - University of Lausanne

2 2

problem compiling HP-UX 11.11 using gcc
by neil.camp＠deca.mil 26 Jun '06

26 Jun '06

Sorry, done. Has anyone had luck with HP-UX. I have searched and searched and searched. It seems like several people have had luck, but I keep getting compilation errors. Here is my latest using gcc gmake[1]: Entering directory `/home/campnd/hobbit-4.1.2p1/bbnet' gcc -static -DHPUX -D_REENTRANT -DHPUX -I. -I/home/campnd/hobbit-4.1.2p1/include -I/usr/local/pcre-6.4/include -DBBGEN_SSL -I/usr/include -c -o bbtest-net.o bbtest-net.c bbtest-net.c: In function 'send_rpcinfo_results': bbtest-net.c:1795: warning: assignment makes pointer from integer without a cast bbtest-net.c:1802: error: dereferencing pointer to incomplete type bbtest-net.c:1814: error: dereferencing pointer to incomplete type bbtest-net.c:1819: error: dereferencing pointer to incomplete type bbtest-net.c: In function 'main': bbtest-net.c:2262: warning: pointer targets in assignment differ in signedness gmake[1]: *** [bbtest-net.o] Error 1 gmake[1]: Leaving directory `/home/campnd/hobbit-4.1.2p1/bbnet' gmake: *** [bbnet-build] Error 2 --neil ManTech DeCA Operations Systems Administrator (804) 734-8353 neil.camp at deca.mil -----Original Message----- From: Thomas Krieger [mailto:tom at tom-krieger.de] Sent: Tuesday, February 07, 2006 1:07 PM To: hobbit at hswn.dk Subject: Re: [hobbit] problem compiling HP-UX 11.11 using aCC Can you please stop requesting reading confirmations for your emails. It's anoying. Bye

4 10

Viewing bb2.rss with Firefox livebook mark
by johng＠idttechnology.com 07 Jun '06

07 Jun '06

Using Firefox 1.0.7 to view bb2.rss seems to have stopped working when I upgraded to 4.2. I am running a snapshot from 04-25-06. I tried Firefox 1.5 and that didn't work either. AKregator is able to read in the alerts OK for bb2.rss. I just added --rss to my 4.1.2 production server and it works. I don't see anything obviously wrong with the format of the .rss files. Can anyone confirm this behavior with Firefox and 4.2? hobbitlaunch.cfg: CMD bbgen $BBGENOPTS --report --rss --max-eventtime=1440 I tried --rssversion={0.91|0.92|1.0|2.0} but none of the versions seems to work. Thanks, John

2 4

BBWin 0.7 available
by etienne.grignon＠gmail.com 06 Jun '06

06 Jun '06

Hello everyone, I publish today BBWin 0.7 (a free Big Brother Hobbit Windows client). I know I'm late, I said it would be on last monday :-) You can download the MSI installer of this preview from http://sourceforge.net/projects/bbwin This preview contains the new following stuffs: * The msgs agent : it monitors the event logs. It uses match and ignore rules with a lot of options. Rules can be specified with EventId, Event type, Source, LogFile and description (perl regular expressions can be used). * BBWin configuration auto reloading : BBWin auto reload can be set so any change to the BBWin.cfg file will indicate BBWin to reload its configuration without restarting the service itself. * bbpager : BBWin now supports bbpager feature (used with Big Brother server, not compatible with hobbit) * cpu improved : Cpu has been rewritten and reports now contains process owner and priority * Documentation: the documentation is now delivered as a chm file, easyer to read than first my ReadMe.txt file. It will be more complete with time. Also, it may contains many english bad spelling. I will take english lesssons soon but you are welcome to send me corrections :) * Migration tools: configuration migration from bbnt to BBWin for bbpager and msgs has been implemented Note : This new version now use registry for the hostname setting. I decided that because it will help to have generic BBWin.cfg files. You may delete the hostname xml setting in your BBWin.cfg file and fill the registry key HKEY_LOCAL_MACHINE\SOFTWARE\BBWin\hostname. The BBWin 0.6 contained the following stuffs : * Resolution of a major bugs with the configuration agents which was the cause of many crashs at the start or stop of the BBWin service. * The svcs agent dll : it monitors the windows services ---------- I also create a poll on the BBWin forum page about future features of BBWin. You are welcome to participate to it, so people can give ideas and remarks so, we can improve BBWin to obtain the best tool for everyone. To finish, I would like to thanks Steve Aiello and Hermann-Josef Beckers for their help in testing BBWin. Have a nice day, Etienne.

4 7

MRTG graphs
by ctruffier＠pack-solutions.com 05 Jun '06

05 Jun '06

Hello, Following this page: http://hobbitmon.sourceforge.net/docs/hobbit-mrtg.html I added MRTG graph to my hobbit server, but when I look to trends page I didn't see anything. The RRD file is clearly updated but when I want to see image of the graph hobbitgraph.sh say: The image “http://hobbit/hobbit-cgi/hobbitgraph.sh?host=master&service=mrtg&graph_width=576&graph_height=120&first=1&count=1&disp=master&graph=hourly&action=view” cannot be displayed, because it contains errors. I've search but found nothing to explain why I've this error. Any idea ? Thanks -- Christophe Truffier Pack-Solutions

4 23

system log and application log monitoring
by olivier＠qalpit.com 04 Jun '06

04 Jun '06

Hi, Up to now i didnt have time to look at hobbit "non-stable"; I started playing with "msgs" log reporting.. henrik's work is remarkable :) (this might have already been discussed on the list) as for me ,system log monitoring should be a default, which is not the case for my network... well.. i was glad to find OS log files definitions in client-local.cfg Could there be basic OS pattern definitions in hobbit-client.cfg's DEFAULT ? next step: application log monitoring let's say i have 100 servers (differents OS of course) running mysql, and i want to follow "ended" in /var/log/mysqld.log ->setting up 100 entries in client-local.cfg doesn't seem great, could there be some kind of grouping in client-local.cfg (PAGE actually..) ? (i guess this would required to processing client-local.cfg before transferring to the clients..) Olivier -- Olivier Beau

3 4

[hobbit] Skinning BB
by Alun.Watson＠fp.co.nz 03 Jun '06

03 Jun '06

Thanks for the Cisco info Michael I'll get the network guys to have a look for me. Our helpdesk uses the All Non-green web page a lot and are only interested in the errors and have problems when they have to scroll up and down the page to figure out which column is which. hostname con msg hostname2 msg ports hostname23 disk So I wanted to have the all non green out put like this ... no pretty gifs etc and I might be able to fit more on the page. A --nogifs option for bbdisplay in hobbitlaunch.cfg would be an ideal option for me if Henrick would consider it ;o). Alun -----Original Message----- From: Michael Lowery [mailto:mlowery at alliedtechgroup.com <mailto:mlowery at alliedtechgroup.com> ] Sent: Tuesday, 16 May 2006 2:01 To: hobbit at hswn.dk Subject: RE: [hobbit] Skinning BB If speed is the problem, I know that the pages load extremely slow if you are going through a PIX or Cisco router when "fixup protocol http" or "inspect iosfw http" are enabled due to the javascript menu. Turning that off will greatly speed up the loading of the hobbit pages. -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk <mailto:henrik at hswn.dk> ] Sent: Sunday, May 14, 2006 3:17 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Skinning BB On Thu, May 11, 2006 at 05:10:27PM +1200, Alun Watson wrote: > This might be heresy but has anyone changed Hobbit so the web page > layout is different? I'm sure someone has modified it to fit in with their local setups. > Perhaps one that uses less graphics ... replace current and recently changed > gifs with html text etc. "less graphics" ??? The entire "gifs" directory in Hobbit is a whopping 141 KB of data. This is very little by any current web-standard. So if you want to get rid of all the graphics, you have something else in mind. > Is there an easy way to change this by changing templates or do I have to > hack the C code to modify how the client data in the pages are displayed? For a complete elimination of the graphics, you will need to hack the C code - specifically, bbdisplay/pagegen.c and lib/*log.c . And the templates. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

7 20

Generated Reports coredump
by CHRIS.MORRIS＠RWEnpower.com 02 Jun '06

02 Jun '06

Hi, This problem has been outstanding for quite a while now on AIX. When running the pre-generated reports, bbgen coredumps. I have run /usr/local/hobbit/server/bin/bbcmd --env=/usr/local/hobbit/server/etc/hobbitserver.cfg hobbitreports.sh weekly with a --debug on the bbgen command and get output like :- 2006-05-31 16:19:00 find_or_create_column(hobbitd) 2006-05-31 16:19:00 Skipped to entry starting 1133359651 2006-05-31 16:19:00 Got entry starting 1133359351 lasting 300 2006-05-31 16:19:00 Got entry starting 1133359651 lasting 3112 2006-05-31 16:19:00 Got entry starting 1133362763 lasting 301 2006-05-31 16:19:00 Got entry starting 1133363064 lasting 412240 2006-05-31 16:19:00 Got entry starting 1133775304 lasting 301 2006-05-31 16:19:00 Got entry starting 1133775605 lasting 3915090 2006-05-31 16:19:00 Got entry starting 1137690695 lasting 0 2006-05-31 16:19:00 Got entry starting 1137690695 lasting 7770444 2006-05-31 16:19:00 Got entry starting 1145461139 lasting 300 2006-05-31 16:19:00 Got entry starting 1145461439 lasting 493186 2006-05-31 16:19:00 Got entry starting 1145954625 lasting 301 2006-05-31 16:19:00 Got entry starting 1145954926 lasting 8235 2006-05-31 16:19:00 Got entry starting 1145963161 lasting 301 2006-05-31 16:19:00 Got entry starting 1145963462 lasting 1986143 2006-05-31 16:19:00 Got entry starting 1147949605 lasting 301 2006-05-31 16:19:00 Got entry starting 1147949906 lasting 449557 2006-05-31 16:19:00 Got entry starting 1148399463 lasting 300 2006-05-31 16:19:00 Got entry starting 1148399763 lasting 71611 2006-05-31 16:19:00 Reporting starts with this entry: Tue May 23 16:56:03 2006 green 1148399763 71611 2006-05-31 16:19:00 In-range entry starting 1148425200 lasting 46174 color 0: Tue May 23 16:56:03 2006 green 1148399763 71611 2006-05-31 16:19:00 In-range entry starting 1148471374 lasting 301 color 4: Wed May 24 12:49:34 2006 yellow 1148471374 301 2006-05-31 16:19:00 Looking at history logfile /usr/local/hobbit/data/histlogs/tru2407/hobbitd/Wed_May_24_12:49:34_2006 /usr/local/hobbit/server/bin/hobbitreports.sh: line 83: 26868 IOT/Abort trap (core dumped) BBWEB=$REPORTTOPURL/$REPDIR $BBHOME/bin/bbgen --debug --reportopts=$STIME:$ETIME:0:nongr $BBGENREPOPTS $REPORTTOPDIR/$REPDIR If I remove the bbgen & hobbitd history logs, then the report runs through ok. Does this give any more clues? Regards, Chris **************************************************************************** The information contained in this email is intended only for the use of the intended recipient at the email address to which it has been addressed. If the reader of this message is not an intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination or copying of the message or associated attachments is strictly prohibited. If you have received this email in error, please contact the sender by return email or call 01793 877777 and ask for the sender and then delete it immediately from your system.Please note that neither RWE npower nor the sender accepts any responsibility for viruses and it is your responsibility to scan attachments (if any). *****************************************************************************

2 2

Hobbit Ping
by Alun.Watson＠fp.co.nz 02 Jun '06

02 Jun '06

Hello again, Has anyone else noticed the ping times increase by a large amount as soon as you change from fping to hobbit ping? On our site ping times to clients were averaging 1.5m and now they are 29.9m. I have 4.2-alpha-20060502 installed on Solaris 10 and have been updating to the latest snapshot on a fairly regular basis. Cheers, Alun

3 4

Easy question on GRAPHS and trends
by emayoral＠arsys.es 02 Jun '06

02 Jun '06

I have successfully migrated from BB to hobbit (excellent software IMHO), however there is a small thing that I cannot get solved. I collect rrd data for the tests vmstat, vmstat1, vmstat2,vmstat3,vmstat4 and vmstat5 If I build an URL like: http://MYBBDISPLAY/hobbit-cgi/hobbitgraph.sh?host=AHOBBITCLIENT&service=vms… I can see the graph just fine (so the data on the rrd files and the graph definitions - which come standard on hobbitgraph.cfg - are OK), however I cannot get hobbit to display the graph and link in the trends page. It only displays vmstat , but not vmstat1-vmstat5 According to the documentation I should just add the graph names to the GRAPHS variable at hobbitserver.cfg, but I have already done that: GRAPHS="la,disk,inode,qtree,memory,users,vmstat,vmstat3,vmstat4,vmstat5,iostat,tcp.http,tcp,netstat,temperature,ntpstat,apache,bind,sendmail,mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,postfix,mrtg::1" The funny thing is that I also made a custom graph 'postfix' for postfix queues and that one shows up on the trends page perfectly, it is only the vmstat family which refuses to appear. My version is hobbit-4.1.2p1-1 on Fedora Core 3. Thanks in advance for your help.

4 9