June 2006 - Xymon - Xymon mailman web

Port BB ext script to Hobbit
by allan＠zandahar.net 05 Jun '06

05 Jun '06

Hey guys, Just wondering what is required to port a BB ext script from somewhere like Deadcat over to the hobbitclient ? I've had a poke and it looks as it the hobbit client sets all of the old $BB variables so the script should be fine but Im still having troubles cos I a script newb :) This raid monitor script is the only one I managed to get working on one of the boxes here so I'd prefer to stick with it. As far as I know the script should be fine although the line where it execs bbedf.sh obviously wont work so I'm assuming this is why the hobbitlaunch.cfg sets the ENVFILE ? Script is attached, if anyone could have a look and let me know whats up it would be GREATLY appreciated Cheers Allan

3 3

Does decreasing the interval of checks require recreating the rrd files?
by jonescr＠cisco.com 05 Jun '06

05 Jun '06

Subject pretty much says it all. If I want a more granular graphs, which checks done and graphed every 2 minutes instead of the default 5, what all do I have to change? I'm also being asked that...if the hobbit interval is currently every 5 minutes, are client-reported alerts sent out instantly (as soon as they are received), or are they only processed during the update interval. For some very critical services, waiting 5 minutes to find out that it's down can be too long. Thanks, -Charles

1 0

Small modification to hobbitclient-linux.sh
by frederic.mangeant＠steria.com 05 Jun '06

05 Jun '06

Hi Henrik hobbitclient-linux.sh uses "uname -a" to report information about the OS, which gives something like this : Linux hades 2.6.14.2 #2 Wed Nov 16 10:14:26 CET 2005 i686 Pentium III (Katmai) GNU/Linux IMHO it would be great to display less information about the running kernel and add information about the Linux distribution, something like that : Linux 2.6.14.2 i686 - Gentoo Base System version 1.6.14 Linux 2.6.9-34.EL i686 - CentOS release 4.3 (Final) Linux 2.4.20-28.7 i686 - Red Hat Linux release 7.3 (Valhalla) Linux 2.4.26-vs1.28 i686 - Debian 3.1 Linux 2.4.18-64GB-SMP i686 - SuSE Linux 8.0 (i386) If you like this idea, I've tested the attached "patch" (on top of latest snapshot) with RedHat / CentOS, Gentoo, Debian and SuSE. Regards, -- Frédéric Mangeant Steria EDC Sophia-Antipolis

4 5

MRTG graphs
by ctruffier＠pack-solutions.com 05 Jun '06

05 Jun '06

Hello, Following this page: http://hobbitmon.sourceforge.net/docs/hobbit-mrtg.html I added MRTG graph to my hobbit server, but when I look to trends page I didn't see anything. The RRD file is clearly updated but when I want to see image of the graph hobbitgraph.sh say: The image “http://hobbit/hobbit-cgi/hobbitgraph.sh?host=master&service=mrtg&graph_width=576&graph_height=120&first=1&count=1&disp=master&graph=hourly&action=view” cannot be displayed, because it contains errors. I've search but found nothing to explain why I've this error. Any idea ? Thanks -- Christophe Truffier Pack-Solutions

4 23

Hobbit SUID's
by jonescr＠cisco.com 04 Jun '06

04 Jun '06

I'm installing Hobbit for a client where root access is not available, and having SUID files is on an as-needed basis (as-needed as in "this app simply won't function without it), and even then only after having a darn good reason and approval from Infosec after they audit the code. As such, I am installing Hobbit as a normal user and get the following errors when I do "make install" chown 0 /users/monitor/local/hobbit/client/bin/logfetch /users/monitor/local/hobbit/client/bin/clientupdate || echo "" chown: changing ownership of `/users/monitor/local/hobbit/client/bin/logfetch': Operation not permitted chown: changing ownership of `/users/monitor/local/hobbit/client/bin/clientupdate': Operation not permitted chgrp 0 /users/monitor/local/hobbit/client/bin/logfetch /users/monitor/local/hobbit/client/bin/clientupdate || echo "" chgrp: changing group of `/users/monitor/local/hobbit/client/bin/logfetch': Operation not permitted chgrp: changing group of `/users/monitor/local/hobbit/client/bin/clientupdate': Operation not permitted (There were also errors for "hobbitping", which I understand why that needs to be SUID.) Can you tell me if these (logfetch and clientupdate) absolutely require being SUID root? I believe logfetch does not, provided that the user that hobbit is running as has permissions to read the specified files. It's a lot easier to get the security ninjas to do "chmod o+r /var/log/messages" than it is to convince them to SUID "some code you downloaded off the internet". What about "clientupdate". What does it do, and what does it use root access for? *pause for RTFM* Oka I just read the logfetch and clientupdate man pages, which seems to have answered those questions. I will post it here for anyone else who was wondering the same thing: ---snip--- SUID ROOT INSTALLATION logfetch may be installed with suid-root privileges. This allows Hobbit to monitor logfiles regardless of any access restrictions there may be in place for these files. If logfetch is not installed suid-root, it will of course only be able to monitor logs that it has read-access to. But logfetch will function without suid-root privileges. For security reasons, logfetch drops all root privileges except when opening logfiles. In particular, logfetch will not perform directory- utilitation scannings via the "du" command with root privileges, since an external command is used. It is therefore believed to be safe to install logfetch as suid-root. Note that if you choose to install logfetch with suid-root privileges, then the clientupdate utility will also need suid-root privileges, or these will be lost after an automated update of the client. When installing the new client software, any suid-root permis- sions set for the logfetch(1) utility were lost. The final step is to re-establish the suid-root privileges for the logfetch utility, by running the new clientupdate utility with the "--suid-setup" option. This sets the logfetch utility to suid- root, if possible. SUID-ROOT OPERATION clientupdate will attempt to perform some operations with root privi- leges, as described above. However, if it was not installed as suid- root initially, these operations will fail. This does not prevent clientupdate or the Hobbit client from working - it just means that permissions needed by the Hobbit client will have to be managed manu- ally, eg. you may need to modify permissions for logfiles such that the logfetch(1) utility can read them to check the logs. The Hobbit client is fully capable of running without any special privileges. ---snip--- So, correct me if I am wrong about any of these statements: 1. The ONLY hobbit binary that MUST be SUID root is "hobbitping" (because only root can send ICMP ECHO packets). 2. "logfetch" is SUID root for ease of monitoring root-owned logfiles. It does not need to be SUID if the monitored files are readable by the hobbit user. 3. "clientupdate" is SUID in order to restore the SUID bit of "logfetch", when a client update is rolled out via the automated mechanism. I should be able to convince the security folks to SUID hobbitping. Is there anything special about hobbitping itself, or can "fping" be used as a replacement? The only other comment I have is, since the man page specifically says that logfetch and clientupdate do not need to be SUID, either "make install" should not fail because of the chown errors, or there should be a --no-suid option to tell the installer not to attempt to make those SUID.

2 1

Extra script not firing
by rsmrcina＠wi.rr.com 04 Jun '06

04 Jun '06

It appears that after the 20060423 alfa (I'm currently running 20060601 beta), that the extra script isn't firing. I noticed that a custom graph isn't being populated and in the course of debugging I just added an echo of some text into a file from the beginning of the script. The file never appears. This leads me to believe that the script is not being executed. If more info is needed, let me know. Thanks. -- Rich Smrcina VM Assist, Inc. Main: (262)392-2026 Cell: (414)491-6001 Ans Service: (360)715-2467 rich.smrcina at vmassist.com Catch the WAVV! http://www.wavv.org WAVV 2007 - Green Bay, WI - May 18-22, 2007

3 3

system log and application log monitoring
by olivier＠qalpit.com 04 Jun '06

04 Jun '06

Hi, Up to now i didnt have time to look at hobbit "non-stable"; I started playing with "msgs" log reporting.. henrik's work is remarkable :) (this might have already been discussed on the list) as for me ,system log monitoring should be a default, which is not the case for my network... well.. i was glad to find OS log files definitions in client-local.cfg Could there be basic OS pattern definitions in hobbit-client.cfg's DEFAULT ? next step: application log monitoring let's say i have 100 servers (differents OS of course) running mysql, and i want to follow "ended" in /var/log/mysqld.log ->setting up 100 entries in client-local.cfg doesn't seem great, could there be some kind of grouping in client-local.cfg (PAGE actually..) ? (i guess this would required to processing client-local.cfg before transferring to the clients..) Olivier -- Olivier Beau

3 4

test/tests consolidaiotn
by hobbit＠razorsedge.org 04 Jun '06

04 Jun '06

Henrik, Are there any plans to consolidate the (for example) imap and imaps tests into one column like the http tests are? This would lessen the clutter I seem to have with all my tests. -- -mike

3 4

[hobbit] Skinning BB
by Alun.Watson＠fp.co.nz 03 Jun '06

03 Jun '06

Thanks for the Cisco info Michael I'll get the network guys to have a look for me. Our helpdesk uses the All Non-green web page a lot and are only interested in the errors and have problems when they have to scroll up and down the page to figure out which column is which. hostname con msg hostname2 msg ports hostname23 disk So I wanted to have the all non green out put like this ... no pretty gifs etc and I might be able to fit more on the page. A --nogifs option for bbdisplay in hobbitlaunch.cfg would be an ideal option for me if Henrick would consider it ;o). Alun -----Original Message----- From: Michael Lowery [mailto:mlowery at alliedtechgroup.com <mailto:mlowery at alliedtechgroup.com> ] Sent: Tuesday, 16 May 2006 2:01 To: hobbit at hswn.dk Subject: RE: [hobbit] Skinning BB If speed is the problem, I know that the pages load extremely slow if you are going through a PIX or Cisco router when "fixup protocol http" or "inspect iosfw http" are enabled due to the javascript menu. Turning that off will greatly speed up the loading of the hobbit pages. -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk <mailto:henrik at hswn.dk> ] Sent: Sunday, May 14, 2006 3:17 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Skinning BB On Thu, May 11, 2006 at 05:10:27PM +1200, Alun Watson wrote: > This might be heresy but has anyone changed Hobbit so the web page > layout is different? I'm sure someone has modified it to fit in with their local setups. > Perhaps one that uses less graphics ... replace current and recently changed > gifs with html text etc. "less graphics" ??? The entire "gifs" directory in Hobbit is a whopping 141 KB of data. This is very little by any current web-standard. So if you want to get rid of all the graphics, you have something else in mind. > Is there an easy way to change this by changing templates or do I have to > hack the C code to modify how the client data in the pages are displayed? For a complete elimination of the graphics, you will need to hack the C code - specifically, bbdisplay/pagegen.c and lib/*log.c . And the templates. Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

7 20

hobbitd_alert crashes
by Dominique.Frise＠unil.ch 03 Jun '06

03 Jun '06

Hi, This is snapshot of 01 june running on Solaris 9. [bb at iris tmp]$ gdb ../bin/hobbitd_alert core GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.9"... Core was generated by `hobbitd_alert --checkpoint-file=/soft/pub/BB/hobbit/server/tmp/alert.chk --chec'. Program terminated with signal 6, Aborted. Reading symbols from /usr/local/lib/libpcre.so.0...done. Loaded symbols for /usr/local/lib/libpcre.so.0 Reading symbols from /usr/lib/libresolv.so.2...done. Loaded symbols for /usr/lib/libresolv.so.2 Reading symbols from /usr/lib/libsocket.so.1...done. Loaded symbols for /usr/lib/libsocket.so.1 Reading symbols from /usr/lib/libnsl.so.1...done. Loaded symbols for /usr/lib/libnsl.so.1 Reading symbols from /usr/lib/libc.so.1...done. Loaded symbols for /usr/lib/libc.so.1 Reading symbols from /usr/lib/libdl.so.1...done. Loaded symbols for /usr/lib/libdl.so.1 Reading symbols from /usr/lib/libmp.so.2...done. Loaded symbols for /usr/lib/libmp.so.2 Reading symbols from /usr/platform/SUNW,Sun-Fire-480R/lib/libc_psr.so.1...done. Loaded symbols for /usr/platform/SUNW,Sun-Fire-480R/lib/libc_psr.so.1 #0 0xff1a05c8 in _libc_kill () from /usr/lib/libc.so.1 (gdb) Dominique UNIL - University of Lausanne

2 7