September 2006 - Xymon - Xymon mailman web

Hobbit demo-site and mailing list outage Thursday Sep. 29
by henrik＠hswn.dk 28 Sep '06

28 Sep '06

My ISP is doing some re-configuration work tomorrow morning (Thursday, around 6 AM UTC), including a change of IP-address for my site. I haven't received the new IP-address yet, so it is quite likely that there will be a period where I drop off the net while the changes take place and I get the IP-changes registered in the DNS setup. Regards, Henrik

3 4

NCV help!
by jonescr＠cisco.com 28 Sep '06

28 Sep '06

I've made an ext script that parses mod_jk.log and computes a 5 minute average. I want this 5 minute average time sent to Hobbit and graphed (just graphed, so I'm using *data* instead of *status*). I have done the following: * Setup the ext script to be launched by the client. * Added "modjk=ncv" to hobbitserver.cfg TEST2RRD section. * Added ,modjk to hobbitserver.cfg GRAPHS section. * Added "NCV_modjk="modjk:GAUGE" to hobbitserver.cfg * Restarted Hobbit * (I still need to do the graph definition, but I'm not bothering to do that yet because I'm not getting any rrd data) I've let the client run the ext script several times, as well as running it by hand via "bbcmd", and I am still not seeing any rrd files show up in /data/rrd/hostname/ here is the tail end of the ext script: MSG=`printf "mod_jk : %2.6f\n" $JKAVG` $BB $BBDISP "data $MACHINE.modjk green `date` $MSG" exit 0 Here is a running of the script, with the last line prefixed with "echo" so that we can see what it's sending: $ /bin/bbcmd ext/hobbit-mod_jk.sh/ 2006-09-27 23:52:52 Using default environment file /users/monitor/local/hobbit/client/etc/hobbitclient.cfg /users/monitor/local/hobbit/client/bin/bb 127.0.0.1 data cna-prod-app-28.modjk green Wed Sep 27 23:53:18 GMT 2006 mod_jk : 0.115922 If anyone can point out what I'm doing wrong, I would appreciate it. This is my first time adding an NCV graph, and have many more to do, so want to be sure I get it right. P.S. The $BBDISP is 127.0.0.1 because I'm using /pulldata/ mode. -Charles

3 7

Hobbitd settings in hobbitserver.cfg
by dunne＠accuweather.com 27 Sep '06

27 Sep '06

Greetings, Earlier today we added a system to our main hobbit server. Upon adding the system we received a hobbitd msg of: Oversize status msg fro xxx. xxxxx:ports truncated (n=294359, limit=262144) When I looked in the hobbitserver.cfg file to increase the maxmsg_status setting I did not see a listing for maxmsg_status. Thinking that I was being smart, I added a ling to hobbitserver.cfg for maxmsg_client. The line added was as followed: MAXMSG_STATUS="768" I restarted hobbit after adding the line and saw the following message in the hobbitlaunch.log: 2006-09-25 11:48:12 Loading hostnames 2006-09-25 11:48:12 Loading saved state 2006-09-25 11:48:12 Setting up network listener on 0.0.0.0:1984 2006-09-25 11:48:12 Setting up signal handlers 2006-09-25 11:48:12 Setting up hobbitd channels 2006-09-25 11:48:12 Could not get shm of size 786432: Cannot allocate memory 2006-09-25 11:48:12 Cannot setup client channel 2006-09-25 11:48:12 Task hobbitd terminated, status 1 I removed the line and restarted hobbit, but hobbitd kept failing. I tried rebooting the system, but hobbitd was still failing. Ultimately I stopped hobbit, deleted the hobbitd.pid file and restarted hobbit. All has been well since, excepting the original oversized status messages. My question is, what did I do wrong? Where exactly should I add the maxmsg_status line (or the maxmsg_client, maxmsg_data, maxmsg_stachg for that matter)? I am running 4.2.0. Thanks in advance for any assistance. Mike Michael Dunne Network Support Specialist AccuWeather, Inc. ~HISTORY, n. An account mostly false, of events mostly unimportant, which are brought about by rulers mostly knaves, and soldiers mostly fools. (Ambrose Bierce, "The Devil's Dictionary")~

2 2

graphing help please
by mikee＠mikee.ath.cx 27 Sep '06

27 Sep '06

I have hobbit setup and am working on a script to monitor all my platforms (redhat, solaris, irix, tru64, windows, etc). I have the script running as a test on my local, windows workstation. The status seems to be reporting properly from the script through the bb2.html page on to notifications. What I want to see next is a graph of these values. The current value is the simulated one minute load percentage from windows. I know this value is being sent to hobbitd since I'm getting notifications based on the colors (clear/green/yellow/red) I'm sending to hobbitd. Do I need to cycle hobbitd? Mike

6 11

Apache stats with dns/resolved ip
by fduranti＠q8.it 27 Sep '06

27 Sep '06

Hi Henrik, I've a problem with ip/name resolution this time with the apache statistics grab. If i don't put the url in the bb-hosts or the ip-address it did not work: This 2 example will work: 0.0.0.0 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache=http://itromclivr01/server-status?auto 10.90.2.67 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache This one will not work or at least it seems to not work because i get no data into the rrd with this: 0.0.0.0 itromclivr01 # cont=IVRnode;http://itromclivr01/clusternode;"Cluster[[:space:]]Node" apache I think it try to get data from 0.0.0.0. It's possible to change the behaviour to get the data using the hostname (or the resolved ip address if the ip is 0.0.0.0) just like you did with the pulldata some time ago? Thanks Francesco

1 0

monitoring number of simultaneos connection
by r.tagliaferri＠tosnet.it 27 Sep '06

27 Sep '06

Is there a way to monitor the number of simultaneous open port from the same ip? I need to alert when an (stupid...) attacker send a thing like this tcp 0 0 151.8.36.12:80 206.225.82.32:9654 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:63256 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:11611 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:55544 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:55045 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:949 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:19880 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:13331 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:31280 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:44500 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:11909 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:58313 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:47932 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:15468 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:2060 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:56875 SYN_RECV tcp 0 0 151.8.36.12:80 206.225.82.32:45630 SYN_RECV -- Roberto Tagliaferri Responsabile Progettazione & Produzione TosNet s.r.l. - Internet Service Provider r.tagliaferri at tosnet.it www.tosnet.it

3 2

[hobbit] semi-OT -- anyone using hobbit-mailack with ms-exchange 2003 as the MTA?
by KauffmanT＠nibco.com 26 Sep '06

26 Sep '06

Yup -- I am indeed trying to use a subdomain, and it doesn't seem to be working. We have tried following the example you pointed us to, and we're getting delivery failures with a ststus of 5.4.6 (too many hops). It *looks* like the exchange system is looping internally; there seems to be a step missing somewhere. (It doesn't help that the article indicates this should work for subdomain mail, but shows examples only for cross-domain adressing). We've got a couple more ideas to thrash out; I'll let you know if we ever get it working. Tom -----Original Message----- From: David Gilmore [mailto:david at stenhouseconsulting.com] Sent: Monday, September 25, 2006 4:04 PM To: hobbit at hswn.dk Subject: RE: [hobbit] semi-OT -- anyone using hobbit-mailack with ms-exchange 2003 as the MTA? Tom, It sounds like you are attempting to use a subdomain for your hobbit server, while your Exchange server is handling your domain mail. I found this article which might help you out. In fact I may give it a try as well since I have the same scenario. http://www.msexchange.org/tutorials/Forwarding_Mail_to_an_External_Recip ient _Part_II.html Dave > -----Original Message----- > From: > hobbit-return-9749-david=stenhouseconsulting.com at hswn.dk > [mailto:hobbit-return-9749-david=stenhouseconsulting.com at hswn. > dk] On Behalf Of Kauffman, Tom > Sent: Monday, September 25, 2006 3:38 PM > To: hobbit at hswn.dk > Subject: [hobbit] semi-OT -- anyone using hobbit-mailack with > ms-exchange 2003 as the MTA? > > My exchange guys are having trouble with this. > > I'm trying to send mail to a cell phone from > hobbit@<server.domain>, return address hobbit@<domain> -- and > need to get the result forwarded to hobbit@<server.domain> > (our hobbit server is not accessable from the outside world, > so I'm specifying a return address on our exchange email > server). The email is getting back to exchange, we just can't > seem to figure out how to get it back to the hobbit server. > > The alternative would be to build a box to sit in the dmz and > set it up to receive the email and forward it -- I thought it > would be easier to just get exchange to handle the forwarding. > > MS-Exchange 2003 on MS Advanced Server 2003. > > Everything I find via google seems to be Exchange 5.0/5.5, or > involve two different domains. > > TIA > > Tom Kauffman > NIBCO, Inc. > CONFIDENTIALITY NOTICE: This email and any attachments are > for the exclusive and confidential use of the intended > recipient. If you are not the intended recipient, please do > not read, distribute or take action in reliance upon this > message. If you have received this in error, please notify us > immediately by return email and promptly delete this message > and its attachments from your computer system. We do not > waive attorney-client or work product privilege by the > transmission of this message. > > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

2 1

Is there a way to "quietly" disable hosts that have NOTICE set?
by jonescr＠cisco.com 26 Sep '06

26 Sep '06

I have the NOTICE flag set for all of my production hosts - I want pages to go out if someone disables or enables any of them. However, when backups are done, the oracle databases are brought down, which triggers an alert. If they are manually disabled, the NOTICE message goes out which also wakes people up for no reason. If I use DOWNTIME in bb-hosts, then I have to specify a window which is guaranteed to be longer than the possible time it could take to backup the databases (which is a dynamic thing which will surely be wrong from time to time). So what ends up happening is for example, I would specify an hour of DOWNTIME, but the backups sometimes only take 30 minutes. That means there is a 30 minute window where a real alert would be masked, which is unacceptable in a production environment. I guess what I'm looking for, is a way that I can send a commands to Hobbit via a shellscript (called from the db backup script), that would put a host/services in maint mode (disabled - blue dot), and NOT send a NOTICE page. -Charles

3 2

[hobbit] [dbcheck] feature request: regexp-based config
by fduranti＠q8.it 26 Sep '06

26 Sep '06

Hi Gildas, at this moment it's not possible to do, I'll think on how to do it for a future release (I'm currently working on a custom query check engine and some more informix check). For now I was thinking of making the [default] section work also for mysql as it does for oracle and informix databases without defining a sid. You will be able to use the "default" behaviour of dbcheck.pl: If dbcheck find a hosts flagged with dbcheck in the bb-hosts file it will try to get the information for it from the dbcheck.ini file. If no section are defined for it it will get the default parameters from the [default] section. This work quite well for oracle because if no sid is defined it will assume the sid is equal to the hostname and it will check with default parameters the database. For mysql database it will not work because it will need to use a hostname and port to connect. At this moment (if you want to try) you can change line 696-697 from: /mysql/ && do { if ($port) { To /mysql/ && do { $dbhost=$hostname if (!$dbhost); if ($port) { And it should let you check mysql servers without defining any parameters if they have: 1) same port 2) same username/password You just have to add dbtype, port, username and password to the default section just like: [default] dbtype = mysql Port = 3306 username = usertest password = pw1234 This will work if all the database have a common user/pw to connect and if you have most of the database that are mysql databases. Let me know if this solved your problem. Francesco > > (even though this is related to dbcheck and not to hobbit > per-se I send > this email here, as I guess it may be of interest for other > agent-writers-to-be) > > Hi, > > I have an important number of mysql server to monitor using > dbcheck. On > some of them, I have created a monitoring account, on others I use an > already existing account. > > Interestingly enough, servers with a similar configuration have a > similar name, so I would be interested in using regexp-based > configuration but as far as I know, dbcheck.ini must have an > entry for > each database to monitor. > > Francesco, would it be feasible? > > Cheers, > Gildas > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

2 1

Monitoring old hardware
by robert.herron＠gmail.com 25 Sep '06

25 Sep '06

I don't have one but this may help: Per info in this doc ( http://www.hp.com/products1/evolution/e3000/download/mpeix70.pd) a C compiler should be available. How can you run Apache, Samba, BIND, etc without a C compiler. Other potential useful sites: MPE/iX and HP e3000 Technical Documentation http://docs.hp.com/en/mpeixall.html HP MPE/iX software http://www.hp.com/products1/evolution/e3000/mpeix/index.html Perl for HP e3000 MPE http://www.bixby.org/mark/perlix.html On 21 Sep 2006 21:16:36 -0500, "Ralph Mitchell" <ralphmitchell at gmail.com> wrote: > > Does anyone have one of these?? > > HP 989 running MPE/ix version 7 > > If so, how are you monitoring it, if at all?? > > I guess it's an HP box running some kind of *nix. That's all I know. > Don't even know if there's a C compiler or other tools on it. Blasted > thing crashed a couple of times recently and irritated a customer, so > I have to get *something* working for it... > > Thanks, > > Ralph Mitchell > > > -- Robert Herron robert.herron at gmail.com

2 1