September 2006 - Xymon - Xymon mailman web

gmake error..
by pierre.ronnefalk＠relacom.com 28 Sep '06

28 Sep '06

Hi, I´m a newbee at Hobbit and i have problem with gmake install. I recive the error messages below if test ! -d /global/hobbit/client/ext ; then mkdir -p /global/hobbit/client/ext ; fi if test ! -f /global/hobbit/client/etc/localclient.cfg ; then cp localclient.cfg /global/hobbit/client/etc/ ; fi cp -fp runclient.sh /global/hobbit/client cp: runclient.sh and /global/hobbit/client/runclient.sh are identical gmake[1]: *** [install] Error 2 gmake[1]: Leaving directory `/global/hobbit/client' gmake: *** [install-client] Error 2 # Any suggestions ? /Pierre Ronnefalk [#################### RELACOM CORPORATE EMAIL FOOTER ####################] 1. This communication is confidential and is only intended for use of the individual or entity to which it is directed. If you are not the intended recipient of this email, please delete it without forwarding any of it's content. 2. Opinions and thoughts expressed in this email might be personal opinions from the sender and not necessary representing Relacom. 3. For further information please visit: http://security.relacom.com/email/ [############################################################################]

2 2

LOG checks
by c.rehberger＠oclcpica.org 28 Sep '06

28 Sep '06

Hello all, I want to check some log files like "var/spool/messages" and I can see the entries off the file on the webpage, but I cannot test something to change the color of the side. In my test case I want to change the color to red when the string syslogd appears in the /var/log/messages. I do a kill -HUP on the syslogd to generate the needed entry. After the kill command I can see the syslogd entry in the message file on the webside, but nothing happens with the color :-( On the server machine hobbit is running with the following configuration. On the client machine 'galway' I did no changes. client-local.cfg: [galway] log:/var/log/messages:10240 ignore MARK file:/home/sisis/hugo hobbit-clients.cfg: HOST=galway # These are the values for galway.Sisis.de DISK / 95 98 PORT "LOCAL=%([.:]5000)$" state=LISTEN TEXT=ASE TRACK=ase PORT "LOCAL=%([.:]3025)$" state=LISTEN color=yellow TEXT=OPserver TRACK=opserver PORT "LOCAL=%([.:]3045)$" state=LISTEN color=yellow TEXT=CATserver TRACK=catserver PORT "LOCAL=%([.:]8077)$" state=LISTEN color=yellow TEXT=AVserver TRACK=avserver PROC /usr/local/apache2/bin/httpd 5 20 TEXT=HTTP-ContentDM PROC /usr/local/sisis-pap/apache/bin/httpd 5 20 TEXT=HTTP-sisis-pap FILE /home/sisis/hugo MODE=444 yellow LOG /var/log/messages syslogd color=red Any ideas what is wrong? Thanks Chris -- Dipl. Ing. (FH) Christian Rehberger System Consultant · OCLC PICA GmbH Grünwalder Weg 28g · 82041 Oberhaching · Germany t +49-(0)89-61308 333 · f +49-(0)89-61308 399 e c.rehberger at oclcpica.org · w http://www.oclcpica.org

3 3

DOWNTIME tag question
by etmsys＠rit.edu 28 Sep '06

28 Sep '06

I'm just starting to use Hobbit for monitoring. The DOWNTIME tag I have a question with. I had this: 129.21.35.49 sc3oracle02 # ssh oracle:COBDPROD DOWNTIME=*:0244:0546:Backups COMMENT:"<font size=-1>cobddb</font> The Database went down at 2:45am, however things went Red. I see this in the hobbitd.log: 2006-09-28 02:44:33 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:37 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:41 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:41 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:46 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:47 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:49 Invalid timespec - expected 4 digits, got: 'Backups' 2006-09-28 02:44:49 Invalid timespec - expected 4 digits, got: 'Backups' So I thought maybe it was Backups was not quoted, so I changed it to: 129.21.35.49 sc3oracle02 # ssh oracle:COBDPROD DOWNTIME=*:0244:0546:"Backups" COMMENT:"<font size=-1>cobddb</font> I then extended the Endtime and shutdown the DB, I still got this error: 2006-09-28 08:11:32 Invalid timespec - expected 4 digits, got: 'Backups' However this time it appeared that it was blue and disabled. My question is more of a clarification. I have not tried to put in DOWNTIME=oracle:*:0244:0546:"Backups" Can someone clear up what is happening and how it should work? Thanks. ---Eric

1 0

[hobbit] Re: graphing help please
by fduranti＠q8.it 28 Sep '06

28 Sep '06

The data to be graphed can come also in the status message and not only in data messages. The way you send data I think is wrong, you cannot send more messages in one like it could be done with combo messages of bb you've to send one message at a time and to graph cpu the better think you can do is to see exactly what is sended to hobbit by the client cpu module and send exactly the same thing. For example: If you send a status message that contains: Thu Sep 28 12:04:17 2006 up: 9 days, 19:07 CPU Usage= 78% The cpu rrd module will get the CPU Usage and put the number into the rrd. If you know a bit of C you can check the source in hobbitd/rrd to check what the various rrd modules want to get as data. To get data out of data message and into rrd you also need to define what to get from there via ncv for example. Francesco > -----Original Message----- > From: news [mailto:news at sea.gmane.org] On Behalf Of Mike > Sent: Wednesday, September 27, 2006 10:06 PM > To: hobbit at hswn.dk > Subject: [hobbit] Re: graphing help please > > On 2006-09-26, Mike <mikee at mikee.ath.cx> wrote: > > On 2006-09-26, Buchan Milne <bgmilne at staff.telkomsa.net> wrote: > >> --nextPart1939210.s1LOtCzRWx > >> Content-Type: text/plain; > >> charset="iso-8859-6" > >> Content-Transfer-Encoding: quoted-printable > >> Content-Disposition: inline > >> > >> On Monday 25 September 2006 19:45, Mike wrote: > >>> On 2006-09-25, Mike <mikee at mikee.ath.cx> wrote: > >>> > I have hobbit setup and am working on a script to > monitor all my > >>> > platforms (redhat, solaris, irix, tru64, windows, etc). > I have the > >>> > script > >> > >> which script? > > > > I am in a small development site that has one of many different > > platforms. I have written a script in tcl that should/will > run on all > > platforms to gather the monitoring data. The tcl script is what I > > mention above. I'm happy to release my tcl script once it > is complete. > > > >>> > running as a test on my local, windows=20 workstation. > >> > >> Which client are you using ? > > > > I am using the tcl script I mention above. I know the script is > > working as I do get status messages from the tcl client > into hobbitd > > on one of my linux boxes. > > > >>> > The status seems to be reporting properly from=20 the script > >>> > through the bb2.html page on to notifications. What I > want to see > >>> > next is a graph of these values. The current value is the > >>> > simulated one minute load percentage from windows. > >>> > I know this value is being sent to hobbitd since I'm getting > >>> > notifications based on the colors (clear/green/yellow/red) I'm > >>> > sending to hobbitd. > >>> > > >>> > Do I need to cycle hobbitd? > >>> > > >>> > Mike > >>> > > >>> > To unsubscribe from the hobbit list, send an e-mail to > >>> > hobbit-unsubscribe at hswn.dk > >>> > >>> I have found the hobbit-graph.cfg file. > >> > >> You shouldn't need to touch anything here. > > > > I agree, though I do not understand why the graphs are not > showing up. > > Seems the data is not making it to rrd. Is there a log file > somewhere that might show why the data is not parsed or not > making it to rrd? > > Mike > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

1 0

Hobbit demo-site and mailing list outage Thursday Sep. 29
by henrik＠hswn.dk 28 Sep '06

28 Sep '06

My ISP is doing some re-configuration work tomorrow morning (Thursday, around 6 AM UTC), including a change of IP-address for my site. I haven't received the new IP-address yet, so it is quite likely that there will be a period where I drop off the net while the changes take place and I get the IP-changes registered in the DNS setup. Regards, Henrik

3 4

NCV help!
by jonescr＠cisco.com 28 Sep '06

28 Sep '06

I've made an ext script that parses mod_jk.log and computes a 5 minute average. I want this 5 minute average time sent to Hobbit and graphed (just graphed, so I'm using *data* instead of *status*). I have done the following: * Setup the ext script to be launched by the client. * Added "modjk=ncv" to hobbitserver.cfg TEST2RRD section. * Added ,modjk to hobbitserver.cfg GRAPHS section. * Added "NCV_modjk="modjk:GAUGE" to hobbitserver.cfg * Restarted Hobbit * (I still need to do the graph definition, but I'm not bothering to do that yet because I'm not getting any rrd data) I've let the client run the ext script several times, as well as running it by hand via "bbcmd", and I am still not seeing any rrd files show up in /data/rrd/hostname/ here is the tail end of the ext script: MSG=`printf "mod_jk : %2.6f\n" $JKAVG` $BB $BBDISP "data $MACHINE.modjk green `date` $MSG" exit 0 Here is a running of the script, with the last line prefixed with "echo" so that we can see what it's sending: $ /bin/bbcmd ext/hobbit-mod_jk.sh/ 2006-09-27 23:52:52 Using default environment file /users/monitor/local/hobbit/client/etc/hobbitclient.cfg /users/monitor/local/hobbit/client/bin/bb 127.0.0.1 data cna-prod-app-28.modjk green Wed Sep 27 23:53:18 GMT 2006 mod_jk : 0.115922 If anyone can point out what I'm doing wrong, I would appreciate it. This is my first time adding an NCV graph, and have many more to do, so want to be sure I get it right. P.S. The $BBDISP is 127.0.0.1 because I'm using /pulldata/ mode. -Charles

3 7

Hobbitd settings in hobbitserver.cfg
by dunne＠accuweather.com 27 Sep '06

27 Sep '06

Greetings, Earlier today we added a system to our main hobbit server. Upon adding the system we received a hobbitd msg of: Oversize status msg fro xxx. xxxxx:ports truncated (n=294359, limit=262144) When I looked in the hobbitserver.cfg file to increase the maxmsg_status setting I did not see a listing for maxmsg_status. Thinking that I was being smart, I added a ling to hobbitserver.cfg for maxmsg_client. The line added was as followed: MAXMSG_STATUS="768" I restarted hobbit after adding the line and saw the following message in the hobbitlaunch.log: 2006-09-25 11:48:12 Loading hostnames 2006-09-25 11:48:12 Loading saved state 2006-09-25 11:48:12 Setting up network listener on 0.0.0.0:1984 2006-09-25 11:48:12 Setting up signal handlers 2006-09-25 11:48:12 Setting up hobbitd channels 2006-09-25 11:48:12 Could not get shm of size 786432: Cannot allocate memory 2006-09-25 11:48:12 Cannot setup client channel 2006-09-25 11:48:12 Task hobbitd terminated, status 1 I removed the line and restarted hobbit, but hobbitd kept failing. I tried rebooting the system, but hobbitd was still failing. Ultimately I stopped hobbit, deleted the hobbitd.pid file and restarted hobbit. All has been well since, excepting the original oversized status messages. My question is, what did I do wrong? Where exactly should I add the maxmsg_status line (or the maxmsg_client, maxmsg_data, maxmsg_stachg for that matter)? I am running 4.2.0. Thanks in advance for any assistance. Mike Michael Dunne Network Support Specialist AccuWeather, Inc. ~HISTORY, n. An account mostly false, of events mostly unimportant, which are brought about by rulers mostly knaves, and soldiers mostly fools. (Ambrose Bierce, "The Devil's Dictionary")~

2 2

graphing help please
by mikee＠mikee.ath.cx 27 Sep '06

27 Sep '06

I have hobbit setup and am working on a script to monitor all my platforms (redhat, solaris, irix, tru64, windows, etc). I have the script running as a test on my local, windows workstation. The status seems to be reporting properly from the script through the bb2.html page on to notifications. What I want to see next is a graph of these values. The current value is the simulated one minute load percentage from windows. I know this value is being sent to hobbitd since I'm getting notifications based on the colors (clear/green/yellow/red) I'm sending to hobbitd. Do I need to cycle hobbitd? Mike

6 11

Apache stats with dns/resolved ip
by fduranti＠q8.it 27 Sep '06

27 Sep '06

Hi Henrik, I've a problem with ip/name resolution this time with the apache statistics grab. If i don't put the url in the bb-hosts or the ip-address it did not work: This 2 example will work: 0.0.0.0 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache=http://itromclivr01/server-status?auto 10.90.2.67 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache This one will not work or at least it seems to not work because i get no data into the rrd with this: 0.0.0.0 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache I think it try to get data from 0.0.0.0. It's possible to change the behaviour to get the data using the hostname (or the resolved ip address if the ip is 0.0.0.0) just like you did with the pulldata some time ago? Thanks Francesco

1 0

monitoring number of simultaneos connection
by r.tagliaferri＠tosnet.it 27 Sep '06

27 Sep '06

Is there a way to monitor the number of simultaneous open port from the same ip? I need to alert when an (stupid...) attacker send a thing like this tcp 0 0 151.8.36.12:80 206.225.82.32:9654 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:63256 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:11611 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:55544 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:55045 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:949 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:19880 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:13331 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:31280 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:44500 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:11909 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:58313 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:47932 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:15468 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:2060 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:56875 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:45630 SYN_RECV -- Roberto Tagliaferri Responsabile Progettazione & Produzione TosNet s.r.l. - Internet Service Provider r.tagliaferri at tosnet.it www.tosnet.it

3 2