July 2007 - Xymon - Xymon mailman web

Not getting alerts for log entries on Solaris 10 Update 3 (SPARC)
by kbourn＠adpt-tech.com 27 Jul '07

27 Jul '07

I am having issues with getting Hobbit to report log entries from client log files. The server is getting the log data but, despite a valid string entry in the log file, no alerts are generated. Here is an excerpt from my client-local.cfg file: [hosta-z1] log:/var/adm/messages:10240 And a corresponding entry from the hobbit-clients.cfg file: HOST=hosta-z1 LOG /var/adm/messages sshd COLOR=red The status never changes for this host despite sshd entries existing in the /var/adm/messages file. I used "sshd" because I KNOW that there are current entries in /var/adm/messages since everytime hobbit runs an ssh check on the server an sshd message is generated. I have chosen this string just to troubleshoot this problem... Clicking on "msgs" for this host, there is a message "No entries in /var/adm/messages". But if I click on the "/var/adm/messages" link it shows recent entries with the sshd string in the log file as the following shows: [msgs:/var/adm/messages] Jul 25 16:59:34 hosta-z1 sshd[4164]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:04:37 hosta-z1 sshd[4507]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:09:39 hosta-z1 sshd[4857]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:14:41 hosta-z1 sshd[5192]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:19:41 hosta-z1 sshd[5534]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:24:40 hosta-z1 sshd[5884]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Jul 25 17:29:45 hosta-z1 sshd[6222]: [ID 800047 auth.info] Connection closed by 10.0.0.68 Does anyone know what the problem may be? Is there possibly any known issues with Hobbit logging under Solaris 10 Update 3 for SPARC? I have tried almost everything I can think of to get this to work and I am getting no where. Thanks in advance for any help. -Ken

3 5

Feature requests; filter out MVFS
by michael.nemeth＠lmco.com 26 Jul '07

26 Jul '07

Forgot the most important and easiest ! Please filter out the mvfs FS. This is the clearcase versioning tool pseudo FS. It acts either as a lofs or nfs FS. -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | _p_ Mike Nemeth | ___| |_____ email(w) michael.nemeth at lmco.com Work: 856 359-1425 |><___________) | Home Page:http://www.geocities.com/mjnemeth/ | Work Page:http://scorpion/~nemethm/ | Work Page:http://phlccase/SWUNIX/mnemeth/ |++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

5 4

Alerts color filtering
by Daniel.Hartmeier＠pax.ch 26 Jul '07

26 Jul '07

To resolve the issue I'd like to suggest the following patch: --- hobbitd/hobbitd_alert.c.orig Thu Jul 26 20:38:33 2007 +++ hobbitd/hobbitd_alert.c Thu Jul 26 20:39:12 2007 @@ -636,9 +636,10 @@ /* * Send one "recovered" message out now, then go to A_DEAD. * Dont update the color here - we want recoveries to go out - * only if the alert color triggered an alert + * only if the alert maxcolor triggered an alert */ awalk->state = A_RECOVERED; + awalk->color = awalk->maxcolor; } if (oldalertstatus != newalertstatus) { This makes sure that when filtering recovery messages, we don't compare the current (most recent) color of the alert, but the worst color the alert has gone through. So when you have a filter like MAIL foo at bar.com COLOR=red RECOVERED and the service goes through the sequence green -> red -> yellow -> green you not only get a critical mail on red, but also a recovery mail on green. Or is the existing behaviour (without the patch) really intentional, and some people actually prefer to get only the critical mail without any recovery mail in this and similar cases? If so, why? Daniel

1 0

Feature request for 4.3.0 (depends)
by trent.melcher＠sitel.com 26 Jul '07

26 Jul '07

Henrik Do you have a timetable when you plan on moving the depends function out from under bbnet? A feature request I have is to be able to use the depends tag to link a specific ports test to a procs test. Example: port 22 is being checked PORT LOCAL=%[.:]22$ STATE=LISTEN "TEXT=SSH listener" also process sshd is being watched PROC sshd TRACK=sshd TEXT=ssh If PROC sshd dies go red, it would be nice if the ports test goes clear instead of red. Thanks Trent Melcher

4 7

Strange rrd problem
by tk＠westend.com 26 Jul '07

26 Jul '07

Hi, I've set up a hobbit server to monitor a couple of systems. However the network test graphs from exactly one system are looking quite strange: http://www.westend.com/pop3-1.png http://www.westend.com/pop3-2.png (zoomed in view) According to this graph pop3 is answering always within zero seconds (I can't imagine this). And the response time of pop3s is alternating in such specific way that rrd draws triangles. I've already deleted the rrd files, but the effect remains the same. The system is running Debian 4.0 (librrd2 version 1.2.15-0.3). Has anybody seen such strange effects before? All other systems and even other services on the same system are looking reasonable. Ciao, Thomas -- Thomas Kähn WESTEND GmbH | Internet-Business-Provider Technik CISCO Systems Partner - Authorized Reseller Im Süsterfeld 6 Tel 0241/701333-18 tk at westend.com D-52072 Aachen Fax 0241/911879 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Die Gesellschaft ist eingetragen im Handelsregister Aachen unter HRB 7608 Geschäftsführer: Thomas Neugebauer, Thomas Heller, Michael Kolb

4 7

Is "cause" in maintenance mode logged ?
by tj_yang＠hotmail.com 26 Jul '07

26 Jul '07

I can't seem to find the reason/cause string been logged in hobbit server's log files. My goal is to have availability report show the bule color and with its reasons for maintenance. T.J. Yang _________________________________________________________________ http://im.live.com/messenger/im/home/?source=hmtextlinkjuly07

3 2

bug report: hobbit client for solaris can't report zombie process
by tj_yang＠hotmail.com 26 Jul '07

26 Jul '07

The existing ps command in hobbit-client-sunos.sh won't report zombie processes. I changed the long ps -A command to just "ps -eaf" and it can report the zombie now. Question is will "ps -eaf" break anything on hobbit server side ? root at login3> diff hobbitclient-sunos.sh hobbitclient-sunos.orig 55,56c55,56 < #ps -A -o pid,ppid,user,stime,s,pri,pcpu,time,pmem,rss,vsz,args < ps -eaf --- >ps -A -o pid,ppid,user,stime,s,pri,pcpu,time,pmem,rss,vsz,args > root at login3> T.J. Yang _________________________________________________________________ http://newlivehotmail.com

2 1

Centralize a few bb message from a group of hobbit servers
by tj_yang＠hotmail.com 26 Jul '07

26 Jul '07

What is the good way to centralize some bb messages/columns from a group of standalone hb servers ? I looked at bbproxy but it doesn't work for my case because remote sites are running hb servers in full scale. I read about summary, my understanding is that is only reporting the summary status of a remote server. Is there a way to configure remote hb servers to send only "conn" message to a centralize hb server ? T.J. Yang _________________________________________________________________ http://liveearth.msn.com

1 0

utility for hobbit-client.cfg
by s_aiello＠comcast.net 26 Jul '07

26 Jul '07

When writing custom server side scripts to feed off client data, is there a tool/utility like bbhostgrep for the hobbit-client.cfg file ? I would like to try to move toward all my custom script thresholds into hobbit-client.cfg. To do this, some tool where given the hostname will return all thresholds for whatever that hostname matches (host=, class=, time=, page=). ~Steve

1 0

[feature request] Client-side connectivity check
by charles.goyard＠orange-ftgroup.com 26 Jul '07

26 Jul '07

Hi, my company has an heavily firewalled network. A rule that says "host1 can reach host2 on port 670" somehow vanish (ie human error), and your service stops working. Most of the time, you'll be aware of it, because you check at the service level, or the customers phones you. However, for some applications, such as backups, you'll know some hours, or days later. So I come up with a suggestion: be able to check if a specific port is reachable for the client standpoint. Socket connection can be done via the bb utility. [picky servers like mysql would be handled differently]. This is kind of easy to do, but the important thing is to have it standard into hobbit. Henrik, does this appeal to you ? -- Charles Goyard - charles.goyard at orange-ftgroup.com - (+33) 1 45 38 01 31 Orange Business Services - online multimedia // ingénierie

3 3