June 2007 - Xymon - Xymon mailman web

rule matching order
by dbourque＠weatherdata.com 06 Jun '07

06 Jun '07

Hi, let's say hobbit-alerts.cfg I have : HOST=blah mail foo SERVICE=http mail bar If an http alert comes in for host "blah", will both foo and bar get an email , or both? if both , can I say: HOST=blah mail foo SERVICE=http mail bar SERVICE="!http" ? Thanks -- Daniel Bourque Systems/Network Administrator Weather Data Inc Office (316) 266-8013 Office (316) 265-9127 ext. 3013 Mobile (316) 640-1024

2 1

4.2+.x feature suggestion
by gumby3203＠gmail.com 06 Jun '07

06 Jun '07

One suggestion I would have for the next version of Hobbit beyond 4.2.0 is the ability to see all of the "clone roots" that machines are clones of in the "edit critical systems" page. Or more generally, to see any/all of the hosts in the hobbit-nkview.cfg file, without having to manually view the file itself. If the preferred method for editing the Critical Systems configuration file is to do it through the web interface, it would be nice to be able to more from within that interface.

1 0

How to send alert via script ?
by casedj＠21cn.com 06 Jun '07

06 Jun '07

I put the commands in a script alert.sh and call that script in hobbit-alerts.cfg: HOST=my_linux SERVICE=disk SCRIPT alert.sh my_linux But still failed, no alert messages sent while disk state went to warning level, color was changed. alert.sh: #!/bin/sh echo "$RCPT disk went to warning state" |smbclient -M cici echo "$BBHOSTNAME disk reached warning state" |write hobbit This test script works well in terminal mode. [hobbit at my_linux etc]$ ../bin/bbcmd hobbitd_alert --test my_linux disk 2007-05-31 06:04:23 Using default environment file /home/hobbit/server/etc/hobbitserver.cfg 00005798 2007-05-31 06:04:23 send_alert my_linux:disk state Paging 00005798 2007-05-31 06:04:23 Matching host:service:page 'my_linux:disk:' against rule line 120 00005798 2007-05-31 06:04:23 *** Match with 'HOST=my_linux SERVICE=disk' *** 00005798 2007-05-31 06:04:23 Matching host:service:page 'my_linux:disk:' against rule line 120 00005798 2007-05-31 06:04:23 *** Match with 'HOST=my_linux SERVICE=disk' *** 00005798 2007-05-31 06:04:23 Script alert with command 'alert.sh' and recipient my_linux The call looked like invalid, any other detail debug mechanism available? Thanks again. Case

5 4

Enabling vmstat[0-9] or netstat[0-9] graphs in trends page
by giovanni＠redix.com.br 06 Jun '07

06 Jun '07

Hi everyone Has anyone made the vmstat/netstat graphs to work ? At the time, just [vmstat] graph appears in trends page... but if i select the graph manually, it appears correctly... Any idea why ? Maybe i need to do something in hobbitserver.cfg besides just add GRAPHS="...,vmstat2,vmstat3,netstat3,..." Any help ? Thank you ! Best Regards, Giovanni

4 5

DISK test: only monitor specific filesystems
by haertig＠avaya.com 06 Jun '07

06 Jun '07

I want to only monitor three specific filesystem on a host, and ignore the rest. I tried this in hobbit-clients.cfg: HOST=wcscbe5 DISK * IGNORE DISK /expsys 90 95 DISK /expert 90 95 DISK /inadsb 90 95 The above didn't list any filesystems in the textual df listing, but showed a single graph line for the root filesystem. The three filesystems I actually wanted were not there. Next I tried: HOST=wcscbe5 DISK /expsys 90 95 DISK /expert 90 95 DISK /inadsb 90 95 The above didn't appear to do anything different from the original default, which was "DISK * 90 95". All filesystems were shown in the textual df listing, and all filesystems were graphed. I did not try IGNORE'ing individual filesystems one-by-one, although my guess is that this might work. But that would get quite messy to maintain with most of the computers I'm monitoring, each having dozens of mounted filesystems (many unique to the specific computer). And new filesystems are added fairly regularly, each new filesystem would require me going back and modifying hobbit-clients.cfg. It would be nice if hobbit-client.cfg could interpret subsequent lines to override previous lines, as I attempted to configure in my first test. Maybe it does do this, and I just missed out on the correct syntax somehow. Any hints on how to do this? Thanks!

3 2

[hobbit] LOG alert not showing yellow
by Robert-Manocchia＠IDEXX.com 06 Jun '07

06 Jun '07

I tried the following syntax: LOG /var/log/messages %authentication\sfailure color=yellow The messages appears as an alert but the color remains green. Is this syntax correct? Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com -----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Wednesday, June 06, 2007 8:48 AM To: hobbit at hswn.dk Subject: Re: [hobbit] LOG alert not showing yellow Try using this syntax (changing space with \s + pcre) LOG /var/log/messages %authentication\sfailure color=yellow Giovanni M. Frainer - Gestor Sello Tlabela (SD) wrote: Hi Manocchia, It could be access rights, if you are running hobbit using the init script it will run as user hobbit and make sure that hobbit user can read /var/log/messages Regards Sello Tlabela _____ From: Manocchia, Robert [mailto:Robert-Manocchia at IDEXX.com <mailto:Robert-Manocchia at IDEXX.com> ] Sent: 05 June 2007 21:38 To: 'hobbit at hswn.dk <mailto:hobbit at hswn.dk> ' Subject: [hobbit] LOG alert not showing yellow I have a small problem. I've set up monitoring of the /var/log/messages logfile to search for the string "authentication failure" and alert with a yellow button in the MSG column. I can see the error displayed when I click on the button below the Msg column header but it does not turn yellow. Below is the entry in the clients-local.cfg file: [batman] log:/var/log/messages:10240 ignore MARK This is the entry in the hobbit-clients.cfg file: HOST=batman LOG /var/log/messages authentication failure color=yellow Why doesn't this give me a yellow alert. Thanks Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com <mailto:Robert-Manocchia at idexx.com> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF <http://www.telkom.co.za/TelkomEMailLegalNotice.PDF> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

LOG alert not showing yellow
by Robert-Manocchia＠IDEXX.com 06 Jun '07

06 Jun '07

I have a small problem. I've set up monitoring of the /var/log/messages logfile to search for the string "authentication failure" and alert with a yellow button in the MSG column. I can see the error displayed when I click on the button below the Msg column header but it does not turn yellow. Below is the entry in the clients-local.cfg file: [batman] log:/var/log/messages:10240 ignore MARK This is the entry in the hobbit-clients.cfg file: HOST=batman LOG /var/log/messages authentication failure color=yellow Why doesn't this give me a yellow alert. Thanks Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com

3 2

[hobbit] LOG alert not showing yellow
by Robert-Manocchia＠IDEXX.com 06 Jun '07

06 Jun '07

The /var/log/messages file has rw-r-r-- access rights so the hobbit user can read the file. Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com -----Original Message----- From: Sello Tlabela (SD) [mailto:TlabelSD at telkom.co.za] Sent: Wednesday, June 06, 2007 1:37 AM To: hobbit at hswn.dk Subject: RE: [hobbit] LOG alert not showing yellow Hi Manocchia, It could be access rights, if you are running hobbit using the init script it will run as user hobbit and make sure that hobbit user can read /var/log/messages Regards Sello Tlabela _____ From: Manocchia, Robert [mailto:Robert-Manocchia at IDEXX.com] Sent: 05 June 2007 21:38 To: 'hobbit at hswn.dk' Subject: [hobbit] LOG alert not showing yellow I have a small problem. I've set up monitoring of the /var/log/messages logfile to search for the string "authentication failure" and alert with a yellow button in the MSG column. I can see the error displayed when I click on the button below the Msg column header but it does not turn yellow. Below is the entry in the clients-local.cfg file: [batman] log:/var/log/messages:10240 ignore MARK This is the entry in the hobbit-clients.cfg file: HOST=batman LOG /var/log/messages authentication failure color=yellow Why doesn't this give me a yellow alert. Thanks Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

[hobbit] Serious hobbit problem, client data truncated by server
by david.gore＠verizonbusiness.com 06 Jun '07

06 Jun '07

I have a very serious hobbit problem. Our hobbit has been working very well for more than a year. I have rolled back some config files, bb-hosts, client-local.cfg, and hobbit-clients.cfg, on the hopes one of them may have a typo causing hobbit to act erratically. Unfortunately, no luck. So what is the problem? The client sends, msg.<host>.txt, as some of you may know, and you can see this file on the server or web page via the 'Client data' link. Unfortunately, the hobbit server is truncating the '[ps]' listing which means you lose all the other entries after '[ps]' and now you are also going to start alarming on missing processes. Alarming and paging out the on-call on missing processes in the middle of the night and creating bogus tickets is very bad. There isn't too much in the logs, but we do have something. Starting on June 02 we got this in bb-display.log: 2007-06-04 12:21:07 Whoops ! bb failed to send message - timeout 2007-06-04 12:21:07 hobbitd status-board not available 2007-06-04 14:21:47 Whoops ! bb failed to send message - timeout 2007-06-04 14:21:47 hobbitd status-board not available 2007-06-04 15:02:02 Whoops ! bb failed to send message - timeout 2007-06-04 15:02:02 hobbitd status-board not available Any ideas? Henrik? Oh and of course the message size is more than adequate to handle the data. We have many hosts that send 2-3 times more data on average and nothing has changed on the client. David

2 2

[hobbit] Ability to follow 302 redirects
by charles.goyard＠orange-ftgroup.com 06 Jun '07

06 Jun '07

Charles Jones wrote : > I'm trying to do a content check of a URL that 302's (because an auth > token is being passed in the URL). The problem I am having is Hobbit > reports "No output received from server". Hi, it is planned to add scenario-style support for all network checks. But not for soon. In the old days, bbgen/bbtest-net (addon to bigbrother) used to link to libcurl. As of 3.x, libcurl has been dropped, and redirect-follow disapeared. So I use a stripped-down version of the legacy bbtest-net, and a patched version of hobbit's bbtest-net that add a --nohttp option, so I can put my http/cont into the standard bb-hosts. My setup goes like this: - standard hobbit bbtest-net that does every network test except http - http-only network tester You can fine the patch and the old bbnet tool at my site : http://charles.goyard.free.fr/hobbit/ Regards, -- Charles Goyard - charles.goyard at orange-ftgroup.com - (+33) 1 45 38 01 31

1 0