June 2006 - Xymon - Xymon mailman web

PROC test question
by marco.pizzoli＠gmail.com 21 Aug '09

21 Aug '09

Hi all, I am a hobbit newby. I have a question about the PROC test: is there a way to define a test about the presence of a particular proc executed by a particular user? I'm in a situation where I have some daemons that could be started by a lot of (machine)users and so I would like to check the user the proc run as. Thanks in advance Marco

4 3

cupsd
by stoner-lists＠comcast.net 04 Jun '08

04 Jun '08

For those who want to monitor a cups print server, here's a definition you can put in your bb-services file: [cupsd] send "GET /printers\r\n" expect "HTTP/1.1 200 OK" port 631 Alternatively, you could just use http://host:631/printers in your bb-hosts file. The cupsd is, for monitoring purposes, a web server. -Jeff "Fun with Users #1: ln -s /dev/random /etc/motd"

2 1

[hobbit] Purples, all non-green view
by KauffmanT＠nibco.com 23 Jan '07

23 Jan '07

Oh, my! It certainly does! Tom Kauffman -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Friday, May 12, 2006 11:05 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Purples, all non-green view On Fri, May 12, 2006 at 02:41:19PM +0000, David Gore wrote: > There was some talk of the purples not showing up on the 'All non-green > view'. We are also disappointed that the purples have been removed from > this page. Our main page is the ANV page and would really like to have > that back. Could we at least have it back with a flag? Or did we some > how remove the purples on the ANV page with some flag in the latest > snapshot? Seems I broke it somewhere. This should put the purples back on the bb2 page. Henrik CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

2 3

Email alert based on specific process
by iqbala-hobbit＠qwestip.net 15 Nov '06

15 Nov '06

Hi All I am using bb-proctab to monitor a list of processes and if any process a whole group get alert. Is there a way I can setup the alert with process specific. So if proc 1 out the list dies only user 1 get alert and so on. I know I could use the SCRIPT feature but like to keep that as the last resort. I am using hobbit 4.1.2 on Solaris 8. The process list I am concern about is running bb1.9c client on Solaris 8 as well. Sorry if it were already discussed in the mailing list. Thanks -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu "..there are two kinds of people: those who work and those who take the credit...try to be in the first group;...less competition there." - Indira Gandhi

6 7

Small enhancement to Hobbit JavaScript menu
by frederic.mangeant＠steria.com 05 Oct '06

05 Oct '06

Hi Henrik I didn't find bb-datepage.sh the first time I set up Hobbit, maybe this small modification to ~/server/www/menu/menu_items.js would be helpful : --- menu_items.js.orig 2005-11-18 15:46:58.000000000 +0100 +++ menu_items.js 2005-11-18 15:53:50.000000000 +0100 @@ -6,7 +6,12 @@ ], ['Reports', null, null, ['Event log Report', '/hobbit-cgi/bb-eventlog.sh'], - ['Availability Report', '/hobbit-cgi/bb-rep.sh'], + ['Availability Reports', null, null, + ['Daily Report', '/hobbit-cgi/bb-datepage.sh?type=day'], + ['Weekly Report', '/hobbit-cgi/bb-datepage.sh?type=week'], + ['Monthly Report', '/hobbit-cgi/bb-datepage.sh?type=month'], + ['Custom Report', '/hobbit-cgi/bb-rep.sh'], + ], ['Snapshot Report', '/hobbit-cgi/bb-snapshot.sh'], ['Config Report', '/hobbit-cgi/hobbit-confreport.sh'], ], Regards, -- Frédéric Mangeant Steria EDC Sophia-Antipolis

3 2

[hobbit] Hobbit, Net-snmp snmptrap,and HPOV
by nfigaro＠effigie.fr 28 Jul '06

28 Jul '06

There is an option to snmptrap (from net snmp) to send full OIDs, otherwise they are cut. Instead of "snmptrap -v 1", the options should be : "snmptrap -v 1 -Of" Otherwise only the end of the OID is sent. Nicolas Figaro > -----Message d'origine----- > De : David Gore [mailto:David.Gore at mci.com] > Envoyé : lundi 19 septembre 2005 17:11 > À : hobbit at hswn.dk > Objet : Re: [hobbit] Hobbit, Net-snmp snmptrap,and HPOV > > > David Gore wrote: > > Coupe, Mark (ITD) wrote: > > > >> All, > >> > >> I'm trying to push alarms from Hobbit to HPOV. We have a custom > >> script that is invoking Netsnmp's snmptrap. The snmp traps are > >> reaching the HP Node Manager Event Browser correctly. > However, the OV > >> operations trap condition is not recognizing the trap. > The trap is > >> being displayed as "unmatched" in the Message Browser even though > >> there is a condition set up for that specific trap. > >> > >> When we look at the unmatched trap, it appears that the OID is not > >> being recognized and an '0' is inserted, for example instead of > >> .1.3.6.1.4.1.7058.0.XX, we are seeing .0.0.XX. > >> > >> Any guidance would be greatly appreaciated. > >> > >> Thanks, > >> > >> -Mark Coupe > > > > > > I, and perhaps others would be interested in what precisely you are > > doing? Are you pushing all hobbit alarms from the hobbit server to > > HPOV? > > > > Sorry, I am HPOV ignorant, but we are interested in > forwarding all the > > hobbit alarms/alerts as SNMP traps to one of Concord's > products. I am > > not to familiar with Concord's product either. I just know > the powers > > that be would like to have snmp traps from all our monitored hosts. > > > > In otherwords, I am interested in any system or methodology that > > someone > > has setup to forward alarms from the hobbit server to an > SNMP server. > > Any setups out there that someone is willing to share the details? > > > > David > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > > > Here is Mark's script posted with permission: > > SCRIPT > > #!/bin/bash > > #SVCCODES="disk:100,cpu:200,procs:300,svcs:350,msgs:400,conn:5 > 00,http:60 > 0,ftp:721,ssh:722,ssh1:722,ssh2:722,telnet:723,smtp:725,fping: > 727,mq:729 > ,dns:800,pop2:809,pop-2:809,pop:810,pop3:810,pop-3:810,nntp:81 9,imap:843 > ,imap2:843,imap3:843,imap4:843,mrtg:850,swap:860,memory:870,sy > s:880,err: > 890,test:901" > > #Variables > #$OID - OID to be used without trailing value (.1.3.6.1.4.1.7058)(BB > default) > #$OIDTAIL - ending value of OID particluar to alarm type; > determined by "case" statement #$MACHIP - IP address of > device generating alarm; determined by hobbit #$BBHOSTNAME - > hostname of device generating alarm; determined by the hobbit > bb-hosts file #$BBSVCNUM - service code corresponding to the > service being monitored; determined by hobbit configuration > #$BBCOLORLEVEL - alarm level; determined by hobbit > #$RECOVERED - '0' denotes alarm; '1' denotes recovery #$HPOV > - the IP address of the destination HPOV server #TMPDIR - > directory for location of temporary file necessary for sed of $MACHIP > > ###Start script ### > ### > CHRONO=`date` > OID=.1.3.6.1.4.1.7058 > #Put your own OV server IP address in the next line. > HPOV=xxx.xxx.xxx.xxx TMPDIR=/home/hobbit/server/ext > > > case $BBSVCNUM in > 100) #Disk > OIDTAIL=10 > ;; > 200) #CPU > OIDTAIL=20 > ;; > 300) #Procs > OIDTAIL=30 > ;; > 350) #Svcs > OIDTAIL=40 > ;; > 400) #Msgs > OIDTAIL=50 > ;; > 500) #Conn > OIDTAIL=60 > ;; > 600) #Http > OIDTAIL=70 > ;; > #OIDTAIL=80 (not assigned) > 721) #FTP > OIDTAIL=90 > ;; > 722) #SSH > OIDTAIL=100 > ;; > 723) #Telnet > OIDTAIL=110 > ;; > 725) #SMTP > OIDTAIL=120 > ;; > 727) #Fping > OIDTAIL=130 > ;; > 729) #MQ > OIDTAIL=140 > ;; > 800) #DNS > OIDTAIL=150 > ;; > 809) #POP2 > OIDTAIL=160 > ;; > 810) #POP > OIDTAIL=170 > ;; > 819) #NNTP > OIDTAIL=180 > ;; > 843) #IMAP > OIDTAIL=190 > ;; > 850) #MRTG > OIDTAIL=200 > ;; > 860) #Swap > OIDTAIL=210 > ;; > 870) #Memory > OIDTAIL=220 > ;; > 880) #Sys > OIDTAIL=230 > ;; > 890) #ERR > OIDTAIL=240 > ;; > 901) #Test > OIDTAIL=250 > ;; > esac > > if [[ "$RECOVERED" = "0" ]]; then > if [[ "$BBCOLORLEVEL" = "purple" ]]; then > OIDTAIL=$(($OIDTAIL + 1)) > elif [[ "$BBCOLORLEVEL" = "yellow" ]]; then > OIDTAIL=$(($OIDTAIL + 2)) > elif [[ "$BBCOLORLEVEL" = "red" ]]; then > OIDTAIL=$(($OIDTAIL + 3)) > fi > elif [[ "$RECOVERED" = "1" ]]; then > BBCOLORLEVEL=green > fi > > #Following line: reads Hobbit IP into temporary file > echo $MACHIP > $TMPDIR/tmpfile.txt > > #Following lines: puts Hobbit 12 digit IP format in dotted > decimal and removes any leading zeroes. MACHIP=`sed > 's/$...$$...$$...$$...$/\1.\2.\3.\4/' > $TMPDIR/tmpfile.txt` > echo $MACHIP > $TMPDIR/tmpfile.txt > MACHIP=`sed -e 's/^00//' -e 's/^0//' -e 's/\.000/./' -e > 's/\.00/./' -e 's/\.0/./' -e 's/\.000/./' -e 's/\.00/./' -e > 's/\.0/./' -e 's/\.000/./' -e 's/\.00/./' -e 's/\.0/./' -e > 's/\.\.\./.0.0./' -e 's/\.\./.0./' -e 's/\.$/.0/' $TMPDIR/tmpfile.txt` > > #Following line: removes the temporary file > rm -f $TMPDIR/tmpfile.txt > > #Following line: forwards the error message to HPOV as an > SNMP message `snmptrap -v 1 -c mitcovo $HPOV "$OID" "$MACHIP" > 6 $OIDTAIL ""` > > echo "DATE: $CHRONO" >> /home/hobbit/server/ext/hpov-push.log > echo "snmptrap -v 1 -c public $HPOV "$OID" "$MACHIP" 6 > $OIDTAIL "" " >> /home/hobbit/server/ext/hpov-push.log > > > END SCRIPT > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

5 5

descriptions in alerts
by kflavin＠iswest.net 10 Jul '06

10 Jul '06

Hi, We've inserted information using the "Descr:" tags in our bb-hosts file that we'd like to be able to include in some of our alerts. Is there a variable that we can use in our paging scripts to include this information - or is there a way to grab this information about a host when sending an alert? Kevin Flavin

2 1

BBTest Error
by david＠stenhouseconsulting.com 06 Jul '06

06 Jul '06

Pardon my ignorance, but what does this mean? Error output: Timeout waiting for data from child, killing it Timeout waiting for data from child, killing it Child process terminated with signal 15 And can I apply it to my five year old when she is not doing what I ask? :) David Gilmore Consultant Stenhouse Consulting, LLC. 4 Traverse St Providence, RI 02906 401.453.6900 x12 401.454.7581 (fax)

2 2

[hobbit] Problems starting hobbit
by skasperowicz＠c-cor.com 30 Jun '06

30 Jun '06

I added --debug to hobbitlaunch.cfg, but I don't seem to be getting any more info in hobbitlaunch.log. I started hobbit and am seeing the same stuff: 2006-06-30 16:50:57 Task rrddata terminated, status 1 2006-06-30 16:50:57 Task rrdstatus terminated, status 1 2006-06-30 16:50:57 Task bbpage terminated, status 1 2006-06-30 16:50:57 Task clientdata terminated, status 1 2006-06-30 16:51:03 Task rrddata terminated, status 1 2006-06-30 16:51:03 Task rrdstatus terminated, status 1 2006-06-30 16:51:03 Task bbpage terminated, status 1 2006-06-30 16:51:03 Task clientdata terminated, status 1 2006-06-30 16:51:38 Task bbdisplay terminated by signal 9 2006-06-30 16:52:38 Task bbdisplay terminated by signal 9 The hobbitd.log just had a couple lines from a long time ago: 2006-06-15 11:31:57 Setup complete 2006-06-15 14:23:50 Setup complete Thanks, -Shaun -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Wednesday, June 28, 2006 10:31 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Problems starting hobbit On Wed, Jun 28, 2006 at 03:29:37PM -0700, Kasperowicz, Shaun wrote: > 2006-06-28 15:15:16 Could not get shm of size 262144: No such file or directory > 2006-06-28 15:15:16 Channel not available > > Looks like still more shared memory problems? Perhaps. It doesn't sound right, since this would show up in the hobbitd startup also, and your last log-snippet didn't show that. Could you try editing your server/etc/hobbitlaunch.cfg file: The first entry with the "CMD hobbitd ...." line, add "--debug" at the end of that (very long) line so it becomes something like [hobbitd] ENVFILE /usr/lib/hobbit/server/etc/hobbitserver.cfg CMD hobbitd --pidfile=$BBSERVERLOGS/hobbitd.pid --restart=$BBTMP/hobbitd.chk --checkpoint-file=$BBTMP/hobbitd.chk --checkpoint-interval=600 --log=$BBSERVERLOGS/hobbitd.log --admin-senders=127.0.0.1,$BBSERVERIP --maint-senders=127.0.0.1 --debug That should dump a bit more detail about what is happening into hobbitlaunch.log. Is there a "hobbitd.log" file in the same directory as hobbitlaunch.log? Anything in that ? Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

Hobbit monitor: Security issue with Hobbit 4.2-beta client
by henrik＠hswn.dk 30 Jun '06

30 Jun '06

I was just notified by a Hobbit user that the current beta client has a security problem in the client "logfetch" utility, when installed as suid-root (which is the default if "make install" is executed as root). Impact ------ The effect of this is that any user who is able to login and create files on a system with the Hobbit client installed, can use the "logfetch" utility to get read access to any file on the system. Which versions are affected --------------------------- This issue affects all of the pre-release (alfa-, beta- and snapshot-versions) of the Hobbit client version 4.2 released until today (2006-Jun-30), when the client was installed as root and ~hobbit/client/bin/logfetch is suid-root. The 4.1.x releases of the Hobbit client does not include the "logfetch" utility, and are therefore NOT affected by this. Remedy ------ It is recommended that you remove the suid bit from the logfetch utility on systems where you have installed the Hobbit 4.2-beta client package. To do this: chmod 755 ~hobbit/client/bin/logfetch Note that this may cause logfile monitoring to break, if the client does not have read access to the monitored logfiles. Running logfetch as suid-root will most likely be removed in the final Hobbit 4.2 release of the client. Regards, Henrik Storner, the Hobbit developer

4 4