September 2007 - Xymon - Xymon mailman web

ifstat and e1000g Ethernet driver
by Dominique.Frise＠unil.ch 06 Sep '07

06 Sep '07

Hi, The solaris regular expression in hobbitd/rrd/do_ifstat.c (Hobbit 4.2.0) does not work for the "e1000g" Ethernet driver found on certain Sparc T2000 system. Output of the command for ifstat: $ /usr/bin/kstat -p -s '[or]bytes64' | sort e1000g0:0:e1000g0/0:obytes64 868907104315 e1000g0:0:e1000g0/0:rbytes64 111199067849 e1000g:0:e1000g0:obytes64 868906791580 e1000g:0:e1000g0:rbytes64 111199060552 e1000g1:0:e1000g1/0:obytes64 0 e1000g1:0:e1000g1/0:rbytes64 0 e1000g2:0:e1000g2/0:obytes64 0 e1000g2:0:e1000g2/0:rbytes64 0 e1000g3:0:e1000g3/0:obytes64 0 e1000g3:0:e1000g3/0:rbytes64 0 Dominique UNIL - University of Lausanne

5 6

custom script
by zeebala＠yahoo.com 05 Sep '07

05 Sep '07

hi all can anyone tell where to put custom script at client side and server side regards Bala --------------------------------- Looking for a deal? Find great prices on flights and hotels with Yahoo! FareChase.

2 1

custom scripts
by balasubramaniann.1＠tcs.com 05 Sep '07

05 Sep '07

Hi all, can anyone guide me how to make a customized scripts in hobbit at present i have made RHEL4 as hobbit server i have not installed from source rather than i installed from rpm provided from razoredge and other client include solairs and hp-ux i had more tha 100 servers the tips and tricks provided in hobbit is not sufficient for me plz tell how to write customized script where to put the script at client side and server side Thanks&Regards Balasubramanian.N Tata Consultancy Services Maker Towers 'E' Block, 11th Floor, Cuffe Parade, Colaba, Mumbai - 400 005,Maharashtra India Cell:- 9967214514 Mailto: balasubramaniann.1 at tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

Graphing number of references to iptables chain
by allan＠zandahar.net 05 Sep '07

05 Sep '07

Hi all, Just wondering if anyone has done or has seen a way of being able to graph the number of references to an iptables chain ? We have a script on our mailserver that scans the logs for IP's in DNSBL's or that issue pregreeting commands and then adds them to the firewall and drops the packets. We end up with a 'flt-smtp' chain that lists all the IP addys it found, if they match it then calls another chain 'spammer' which logs the attempt and drops/rejects the packet. This ends up with a few hundred to a few thousand ip's blocked every month with the # being the number of references to the spammer chain. 'iptables -L spammer' returns currently for example # iptables -L spammer Chain spammer (2269 references) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `Spammer: ' DROP all -- anywhere anywhere Unfortunately I have zero skills when it comes to rrd and the like so I'm looking for something similar I can change to suit or for someone to be really generous and help me out. The script I'm using is over at http://www.impsec.org/~jhardin/antispam/spammer-firewall Cheers Allan

5 6

[hobbit] Possible bug in trace with conn=
by spah＠syntec.co.uk 05 Sep '07

05 Sep '07

Sorry - I'm using Hobbit 4.2.0 with hobbitping. -----Original message----- From: "Sebastian Auriol" spah at syntec.co.uk Date: Wed, 05 Sep 2007 10:13:21 +0100 To: hobbit at hswn.dk Subject: [hobbit] Possible bug in trace with conn= > Hello, > > I have a host where I am using conn=worst and trace in bb-hosts. It seems that if one of the IP addresses is down, hobbit is doing a traceroute to the wrong IP address - I expect a traceroute to the IP address that is down... > > In this example, IPAdress4 is unreachable but hobbit does a traceroute to IPAdress1. > Here is the conn page: > > > Mon Sep 3 18:15:31 2007 conn NOT ok > > Service conn on MyRouter is not OK : Host responds to ping on 4 of 5 IP's > > > System unreachable for 3 poll periods (567 seconds) > > green IPAdress1 is alive (43 ms) > green IPAdress2 is alive (22 ms) > green IPAdress3 is alive (44 ms) > red IPAdress4 is unreachable > green IPAdress5 is alive (1 ms) > Traceroute results: > traceroute to IPAdress1 (IPAdress1), 30 hops max, 38 byte packets > 1 x.x.x.x (x.x.x.x) 0.931 ms 0.840 ms 0.820 ms > 2 y.y.y.y (y.y.y.y) 1.661 ms 2.222 ms 1.795 ms > > > bb-hosts: > IPAdress1 MyRouter # testip conn conn=worst,IPAdress2,IPAdress3,IPAdress4,IPAdress5 trace NET:MyBBNET > > Kind regards, > > Sebastian > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > >

1 0

Possible bug in trace with conn=
by spah＠syntec.co.uk 05 Sep '07

05 Sep '07

Hello, I have a host where I am using conn=worst and trace in bb-hosts. It seems that if one of the IP addresses is down, hobbit is doing a traceroute to the wrong IP address - I expect a traceroute to the IP address that is down... In this example, IPAdress4 is unreachable but hobbit does a traceroute to IPAdress1. Here is the conn page: Mon Sep 3 18:15:31 2007 conn NOT ok Service conn on MyRouter is not OK : Host responds to ping on 4 of 5 IP's System unreachable for 3 poll periods (567 seconds) green IPAdress1 is alive (43 ms) green IPAdress2 is alive (22 ms) green IPAdress3 is alive (44 ms) red IPAdress4 is unreachable green IPAdress5 is alive (1 ms) Traceroute results: traceroute to IPAdress1 (IPAdress1), 30 hops max, 38 byte packets 1 x.x.x.x (x.x.x.x) 0.931 ms 0.840 ms 0.820 ms 2 y.y.y.y (y.y.y.y) 1.661 ms 2.222 ms 1.795 ms bb-hosts: IPAdress1 MyRouter # testip conn conn=worst,IPAdress2,IPAdress3,IPAdress4,IPAdress5 trace NET:MyBBNET Kind regards, Sebastian

1 0

[hobbit] BBcmd and external reports
by deger＠cobercafe.net 05 Sep '07

05 Sep '07

Hello Group, How do I make the bbcmd stay on all session in the system, I get a good 15minutes and all my external script stop running, because the bbcmd bash dosnt give the script a path to execute. Anyone got a good solution ?

1 0

Hobbit Ping Tests
by mprice＠sgt-inc.com 05 Sep '07

05 Sep '07

Hello, I have been using hobbit now for 2 years now and it works great :-) Thanks to everyone who has contributed... I was wondering how to tune the CONN tests, the ping testing. I know I can change the variable for the BB-Net to test every 1 minute -vs- the default of 5 minutes. But that adjusts all the network tests. I would like to just do it for ping testing. Also, what is a CONN failure and how many packets were sent and failed, for instance. Is 3 packets sent, and if 1 fails it alarms. Or does it have to be all 3. How can I fine tune this??? Thanks, michael Michael A. Price EOS/HST Network Security Engineer SGT, Inc. www.sgt-inc.com

1 0

Possible bug in FILE test
by paul＠moonkhan.org 04 Sep '07

04 Sep '07

I'm using Hobbit to monitor a list of files using the FILE test for size, owner, group and mode. However, if a filename contains a literal # then Hobbit reports <No data> on the CGI page for that file. Also, alerting doesn't work if the file tests fail. client-local.cfg: [testserver.foo.com] file:`find /path/to/files/ -type f` hobbit-clients.cfg: HOST=testserver.foo.com FILE %/path/to/files/.* yellow size<8M owner=daemon group=root mode=664 The CGI page shows all of the files in the directory correctly, including files with a '#' in their names, so I believe the 'find' command is working correctly. I don't know if the problem is with my regex glob of %/path/to/files/.* or if it is in the underlying checks that the hobbit client does on the files themselves. Thanks, -Paul Paul Barton http://www.moonkhan.org paul at moonkhan.org "Black holes are where God divided by zero."

1 0

Monitoring file: Permission denied
by andreas.kuntzagk＠mdc-berlin.de 04 Sep '07

04 Sep '07

Hi, I asked that already before but since I got no answer I will try to rephrase it: I try to monitor existance of a file on clients. I put a file:<path-to-file> entry in client-local.cfg and also FILE <path-to-file> in hobbit-clients.cfg It looks like hobbit is also aware of the need to monitor a file. The file column changed from grey to green. If I click on it, my file is shown as green. But when I click on this green icon, I get [file:/home/BIO/DO_NOT_DELETE] ERROR: No such file or directory When I look at the clients this file is readable by the hobbit user. So what can produce this strange error? Why is the file column still green? Where can I look for additional info about what's going on? I already looked at the help pages, man pages, wiki but probably missed the important part. Andreas

1 0