June 2007 - Xymon - Xymon mailman web

[hobbit] Write error while sending message to bbd
by pkc_mls＠yahoo.fr 15 Jun '07

15 Jun '07

Hong James-q19252 a écrit : > Solaris OS log is all normal. > > netstat -a find ten thousand duplicate lines: > > 10.192.200.3.6879 10.192.200.8.56524 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.12.38677 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.13.52591 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.11.52936 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.5.43768 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.8.56525 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.12.38678 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.13.52592 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.11.52937 49640 0 49640 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.5.43769 49640 0 49560 0 TIME_WAIT > 10.192.200.3.6879 10.192.200.8.56526 49640 0 49640 0 TIME_WAIT > > quite strange. this looks like a port scan ... could you check with an lsof which process runs so many connections ?

2 1

Write error while sending message to bbd
by jameshong＠motorola.com 15 Jun '07

15 Jun '07

Please help me. Client server can't sending message to hobbit master server. hobbitclient.log 2007-06-15 14:21:52 Whoops ! bb failed to send message - write error 2007-06-15 14:26:54 Write error while sending message to bbd at 10.192.200.6:1984 2007-06-15 14:26:54 Whoops ! bb failed to send message - write error 2007-06-15 14:31:56 Write error while sending message to bbd at 10.192.200.6:1984

2 2

large system time change freezes hobbit client
by dbourque＠weatherdata.com 14 Jun '07

14 Jun '07

Hi, I noticed that a large clock change tends to stop the hobbit client from sending status messages to the server. For example, if a system boots with the wrong time, I get cpu alerts, I go restart ntpd on it, then I won't get anymore status until I restart hobbit-client on that system... Is clientlaunch trying to keep track of the current time to determine when to launch hobbit-client.sh, instead of just sleeping 5 minutes ( default ) in between each invocations ? Thanks -Dan

4 4

bbproxy and "hobbitdboard"
by frederic.mangeant＠steria.com 14 Jun '07

14 Jun '07

Hi Henrik on one of my servers, I'm running Hobbit 4.1.2p1 configured like this : bbproxy listens on TCP 1984 and forwards to hobbitd, which listens on TCP 1985 on the same server. I'm doing this because without the bbproxy running, I got from times to times "purple" statuses telling me "CAN'T CONNECT TO bbd SERVER @ xx.xx.xx.xx". Everything works fine but the "hobbitdboad" command, which does not reply anything. Is it possible to use this command through a bbproxy, or has it been corrected in Hobbit 4.2.0 ? Many thanks in advance for your answer. -- Frédéric Mangeant Steria EDC Sophia Antipolis

3 4

PORT checks & color
by dbourque＠weatherdata.com 14 Jun '07

14 Jun '07

Hi, On hosta, I monitor many connections, one of them is to hostb. hostb is currently being moved. I can't disable the port check, since all the other connection will no longer be monitored. Since alerts for hosta are only generated for red and yellow statuses, so I tried to use the following : PORT LOCAL=hosta.:30805 REMOTE=%hostb.* STATE=ESTABLISHED "TEXT=hostb connection" COLOR=purple This would keep monitoring all connections, without generating pages about hostb. Unfortunately, the color never goes to purple. I also tried using quotes, but eventually I commented out that line in hobbit-alerts.cfg. Is the color purple not a valid color for the PORT check ? is there a smarter way to do what I'm trying to do ? Thanks -Dan

1 0

Bluecat Networks Adonis Appliance
by Larry.Sherman＠rbsgc.com 14 Jun '07

14 Jun '07

A coworker in the PC Infrastructure team tried to get MOM to monitor the firms new DNS/DHCP appliance. MOM apparently crashed trying to process the MIB. He has asked me if Hobbit can monitor his device. I of course have assured him that it can. I'm thinking Devmon, but the device also offers ssh access to some type of console (I'm getting the manual tomorrow). Has anyone monitored one of these yet, and if so, any suggestions? Thanks, Larry ----------------------------------------- ******************************************************************* * This e-mail is intended only for the addressee named above. As this e-mail may contain confidential or privileged information, if you are not the named addressee, you are not authorized to retain, read, copy or disseminate this message or any part of it. ******************************************************************* *

3 3

cpu graph in hobbit with devmon
by klj＠Beredskabsstyrelsen.dk 14 Jun '07

14 Jun '07

Hey, I'm not sure this is the right list to ask this question. But I will try anyway and I'm sure somebody will tell me if it's the wrong place (-: I have a Hobbit running and watching some servers, with graphs and all I need. But I have now install devmon for some time ago, and I would like to have at graph on the cpu load of my router. The link to the graph is on the site but the browser shows the picture is missing. What have I done worng, please help me. Best regards, Kim Johansen.

1 0

Alerting: TIME format, crossing midnight
by haertig＠avaya.com 14 Jun '07

14 Jun '07

TIME=1:2200:0200 Would the above create one interval of four contiguous hours, "two hours at the end of Monday" immediately followed by "two hours at the start of Tuesday" Or would it create disconnected intervals: "two hours at the start of Monday", followed by 20 hours of no coverage, followed by "two hours at the end of Monday"

1 0

hobbit-alert.cfg: grouping recipients using macros
by haertig＠avaya.com 14 Jun '07

14 Jun '07

In the hobbit-alerts.cfg file, can you group recipients using macros? The help file only has examples for directives that use equal signs (e.g., HOST=%$MYHOSTS). The MAIL and SCRIPT directives have their first parameter defined as "a recipient", which doesn't necessarily imply that they'll accept a comma seperated list of recipients (although I expect they might well do this). Example: $JOHN=john at mycompany.com $FRED=fred at mycompany.com $JANE=jane at mycompany.com $MYGROUP=$JOHN,$FRED,$JANE $OTHERGROUP=$JOHN,$JANE HOST=whatever SERVICE=whatever MAIL $MYGROUP REPEAT=2h HOST=somethingelse SERVICE=somethingelse MAIL $OTHERGROUP REPEAT=2d

2 1

Does Hobbits LOG directive parse line-by-line, or all data?
by jonescr＠cisco.com 13 Jun '07

13 Jun '07

I have setup both types of logfile monitoring. In client-local, I have: log:/some/application/logfile.log:10240 ignore MARK linecount:/some/application/logfile.log timeouts:.*Session.Timeout.* The *log* directive makes the Hobbit client parse a particular application log. The *linecount* directive is being used so that Hobbit graphs the number of "Session Timeout" errors in a particular application log. My hobbit-clients.cfg includes this, for example: LOG /some/application/logfile.log %.*Session.Timeout.* color=yellow LOG /some/application/logfile.log %.*Session.Error.* color=red The above two entries allow me to get Hobbit alerts if there are any session timeouts in the log (yellow alert), or if there are any errors in the log (red alert). Now, what I need, is the ability to set alerts based upon HOW MANY timeouts or errors are in the log. I'm thinking this regex should work (it does according to pcretest): LOG /some/application/logfile.log %(.*Session.Timeout.*){10,} color=red The above *should* set a red condition if there are 10 or more Session Timeouts in the log, or at least in the part of the log that Hobbit received. My question is...does Hobbits logfile parsing perform the multi-line regex or single? If it applies the regex to the entire logfile, my regex should work. If it only tests each line individually, it will not. Other thoughts on Hobbits log monitoring: * I think it makes more sense for the the "linecount" to be in hobbit-clients.cfg instead of client-local.cfg * Its sort of confusing that "linecount" does not require a % in front of a regex, like everything else in Hobbit does (at least according to the man pages) * Why do we need client-local.cfg at all? Couldn't these directives all be done via hobbit-clients.cfg, and any clients that are using local instead of server-side config would then use client-local.cfg? * If Hobbit indeed does parse line-by-line and such my regex would fail, perhaps linecount could have an additional parameters to set an alert if the linecount is exceeded, something like: linecount filename pattern <optional minimum yellow count> <optional minimum red count>

1 0