January 2008 - Xymon - Xymon mailman web

Tables in hobbit
by josh.krause＠twcable.com 29 Jan '08

29 Jan '08

I am trying to find out how to get hobbit to display tables in my test column. I have a script I am throwing together and I am trying to find out how I would need to start off building the script to show tables. I would have probably around 8 -10 tables with 4 rows and 4 columns and I didn't know how to put that into my script in order for it to display it in hobbit. Thanks in advance, Josh This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

2 1

newbie [PAGE]
by sabeer.mz＠gmail.com 29 Jan '08

29 Jan '08

Hello dear ones, This is regarding Client configuration reporting to hobbit server. I use "PAGE" on the master configuration (bb-hosts) and under page <abc> I have given all the servers. Recently I did shutdown ftp service from one of the server. So now on hobbit monitoring its show red alert and now how can I eliminate or exclude this client from NOT monitoring ftp service. -- Thanks Sabeer MZ

3 4

Simple question
by Padraig.Lennon＠pioneerinvestments.com 29 Jan '08

29 Jan '08

How do I get the get icons to appear in a customized test page? i.e... I want to do the following <green diamond> Test OK <flashing red icon> Test ERROR <yellow icon> Test WARNING e.g. the output of procs... If someone could point me to some documentation it would be great? Maybe this info could be on the Wiki/Shire? Thanks Padraig Lennon Senior Systems Engineer Production Services Pioneer Global Investments (Dublin) 5th Floor Georges Quay Plaza, Dublin 2 ext: 2081 Direct dial: 00353 1 480 2081

2 2

New Monitors Added
by gjohnson＠trantor.org 29 Jan '08

29 Jan '08

New monitors recently added to The Shire: * urlplus.pl - http://www.trantor.org/theshire/doku.php/monitors:urlplus --- The Shire

2 1

Monitor HP-UX network log
by robert.herron＠gmail.com 28 Jan '08

28 Jan '08

HP-UX stores its network log in a binary file (/var/adm/nettl.LOG000) that you view with the netfmt command. Before I start working on my own, does anyone have an EXT script to monitor it? If so, could I have a copy? Thanks, Robert Herron

2 1

hobbit-client: segfault on several systems
by hobbit＠alexkeller.de 28 Jan '08

28 Jan '08

Hi all, I'm currently testing hobbit und I'm quite satisfied with it. Great monitoring tool! Hobbit will definitely replace our BigBrother installation. But yesterday a somehow strange error occured. About 15 hobbit clients suddenly died (all at the same time! +/- 5min) They all wrote a core file. Some clients reported a segfault: hobbitlaunch[15432]: segfault at 00007fff75d42a48 rip 00000000004047ad rsp 00007fff75d42a50 error 6 I compiled the clients from snapshot version 20071026. The server is already version 20080115. Client-Systems are Debian Linux Sarge/Etch and Solaris. gdb-Output (gdb ./client/bin/hobbitlaunch core) : GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-linux-gnu"...Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". Reading symbols from /lib/tls/i686/cmov/libc.so.6...done. Loaded symbols for /lib/tls/i686/cmov/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Core was generated by `/opt/hobbit/client/bin/hobbitlaunch --config=/opt/hobbit/client/etc/clientlaunc'. Program terminated with signal 11, Segmentation fault. #0 errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 42 errormsg.c: Datei oder Verzeichnis nicht gefunden. in errormsg.c (gdb) (gdb) bt #0 errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 #1 0x08050c8e in getcurrenttime (retparm=0x0) at timefunc.c:55 #2 0x0804c10b in errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 #3 0x08050c8e in getcurrenttime (retparm=0x0) at timefunc.c:55 #4 0x0804c10b in errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 #5 0x08050c8e in getcurrenttime (retparm=0x0) at timefunc.c:55 #6 0x0804c10b in errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 #7 0x08050c8e in getcurrenttime (retparm=0x0) at timefunc.c:55 [cut] #3966 0x0804c10b in errprintf (fmt=0x805507c "Time warp detected: Adjusting returned clock by %d seconds\n") at errormsg.c:42 #3967 0x08050c8e in getcurrenttime (retparm=0x0) at timefunc.c:55 #3968 0x0804ac2d in main (argc=4, argv=0x0) at hobbitlaunch.c:536 Are there any suggestions? Any ideas? Thank you for your help! Regards, Alexander

3 4

Purple results on server's tests
by josh＠imaginenetworksllc.com 28 Jan '08

28 Jan '08

I rebooted the hobbit server for power related reasons and since it came up the following tests are purple on the Hobbit server: bbgen/bbtest/cpu/disk/files/hobbitd/memory/msgs/ports/procs In bb-hosts the server looks like... 74.x.x.x serversname.imaginenetworksllc.com # bbd http://serversname.imaginenetworksllc.com/ The server was powered on at Sun Jan 27 05:17 but the purple reports are saying Mon Jan 28 10:11:15 2008. The time is reporting as... -> date Mon Jan 28 10:32:38 EST 2008 Anyone know how I broke it? =) Thanks in advance! -- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer

3 5

Hobbit DDOS Attack Detection (submission)
by jonescr＠cisco.com 28 Jan '08

28 Jan '08

I had a hobbit-monitored site become the victim of a DDOS syn-flood attack. To help detect this in the futrue and also aid information-gathering, I did the following, which I am sharing: 1. Made the following additions to hobbit-clients.cfg # Detect more than 100 half-open connections (possible syn-flood attack) PORT STATE=SYN_RECV MIN=0 MAX=100 COLOR=red TRACK="SYN" # Detect more than 2000 established connections (possible simple DDOS http get attack) PORT STATE=ESTABLISHED MIN=0 MAX=2000 COLOR=red 2. Made a small modification to hobbit-linux.sh, specifically to the [ports] section. I crammed it all into a single line. echo "[ports]" echo "SYN_REC Quick Stats:";SYNs=`netstat -pant 2>/dev/null | grep SYN | awk -F: '{print $2;}' |awk {'print $2"\t"$1'}| sort | uniq -c |sort -n`;if [ -n "$SYNs" ]; then echo " # Address Port";printf "$SYNs\n";echo =============================;else echo "No SYNs Found";echo =============================;fi # Bug in RedHat's netstat spews annoying error messages. netstat -ant 2>/dev/null #1 allows Hobbit to detect and alert for 2 common DDOS attack signatures (syn floods and plain old http overloading), as well as creating graphs via the "track" feature. #2 prefixes the netstat output you see in the "ports" column with a table of IPs that have half-open connections. It shows the address, IP, and what port they are "attacking". Here is an example (IPs and ports masked of course): SYN_REC Quick Stats: # Address Port 1 289.122.3.20 80 1 213.102.135.60 80 1 200.120.152.6 8080 1 201.192.9.130 443 1 174.231.84.4 443 2 191.136.92.135 80 2 216.122.32.240 8080 ============================= The prefixing of this data in the client message has no effect on the Hobbit server, as it is only looking for the netstat output in the ports section, and so ignores that extra data (but still displays it). So if the site gets a syn flood, you can check the ports column of your web host(s) and easily see the offending IP(s) that are performing the attack. Note that most "floodbots" are coded such that they spoof their IP addresses, so the information you gather may not actually help you determine who is attacking, but is still useful for temporarily firewalling or whatever other steps you need to take to block it. Note: this works on RHEL, so should work on RedHat/CentOS/Fedora. I havn't checked to see if debian/ubuntu has the same netstat parameters I used, so YMMV :) -Charles

3 4

Feature request: OS support for GNU/kFreeBSD
by beckert＠phys.ethz.ch 28 Jan '08

28 Jan '08

Hi, I tried to get hobbit compiling and running on Debian GNU/kFreeBSD[1]. Getting it to compile was quite easy, getting it run, too, but getting it work isn't[2]. [1] http://www.debian.org/ports/kfreebsd-gnu/ [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=458417 Getting the client run needed some more files to exist. Now I've got an ugly but running client sending data to my hobbit server. Unfortunately the server drops it with the message 2008-01-25 22:41:09 No client backend for OS 'gnu/kfreebsd' sent by [...] In noticed that the reason for this is an OS switch() in hobbitd/hobbitd_client.c line 1763 ff. Back to the client: Adding a new OS in general isn't difficult with hobbit on the client side, you just copy some shell script, perhaps edit it and it works. With GNU/kFreeBSD it looks a little bit different: 14/0/0 root at c-metisse:pts/ttyp3 22:49:51 [~] # uname -o GNU/kFreeBSD 15/0/0 root at c-metisse:pts/ttyp3 22:49:54 [~] # There is a slash in the OS name. So all my workarounds are quite ugly since they all involve the creation of directories to allow filenames like hobbitclient-gnu/kfreebsd.sh Not nice, but works. The solution suggested by the GNU/kFreeBSD developers for this problem is to replace all slashes in the output of "uname -o" with underscores (written in Perlish: s(/)(_)g) so that the above example would look like this: hobbitclient-gnu_kfreebsd.sh Hernik: How do you think that problem is solved best from your view as hobbit developer? You probably have more an idea which code may need to be patch. I've lost the overview at the moment, since hobbit seems to use the output of "uname -o" in a lot of places. Do you think, you can generate a patch I can test? If not: with a few pointers to most of the places in the source, I probably also can try to create a patch on my own... Alternatively I should be able to get you an account on a Test machine running Debian GNU/kFreeBSD. (I'm currently testing inside a virtual machine using QEMU/KVM.) P.S.: No, it's not for the job this time, it's for my own boxes and those of friends. :-) Kind regards, Axel Beckert -- Axel Beckert <beckert at phys.ethz.ch> support: +41 44 633 2668 IT Support Group, HPR E 86.1 voice: +41 44 633 4189 Departement Physik, ETH Zurich fax: +41 44 633 1239 CH-8093 Zurich, Switzerland http://nic.phys.ethz.ch/

3 4

[hobbit] Turn off full system logs
by Chris.Morris＠RWEsystemsUK.com 28 Jan '08

28 Jan '08

Henrik, Basically I just want to reduce the amount of data that is displayed on the web page and in email alerts. Detailed log files can be viewed in other ways. Regards, Chris > -----Original Message----- > From: Henrik Stoerner [SMTP:henrik at hswn.dk] > Sent: Monday, January 28, 2008 12:13 PM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Turn off full system logs > > On Mon, Jan 28, 2008 at 12:07:17PM -0000, Morris, Chris (SS-IS) wrote: > > > > Is there a simple way to turn off the full system logs displayed in the > web > > page and sent in email alerts? > > Sorry, no - this isn't possible. > > > I see you can use --no-ps-listing and --no-ports-listing, it would be > useful > > to have a --no-full-msgs-listing as some log files can contain a large > > amount of data, which you could access using the links on the msgs page. > > You can also access it via the "Client data" link on the same page, so > what exactly is it that you want to accomplish ? > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > ********************************************************************** This e-mail including any attachments is provided for general information purposes only and does not constitute advice except to the addressee if expressly stated in this email. For the avoidance of doubt the contents of this email and any attachments are subject to contract and are not intended to and will not constitute a legally binding contract or any part of a legally binding contract. The information contained in this email and any attachments is confidential. It is intended only for the use of the intended recipient at the email address to which it has been addressed. If the reader of this message is not an intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination, distribution or copying of the message or associated attachments is strictly prohibited. If you have received this e-mail in error, please notify postmaster at RWEsystemsUK.com and permanently delete the email and any attachments immediately from your system. You should not retain, copy or use this email or any attachment for any purpose, nor disclose all or any part of the contents to any other person. Thank you for your co-operation. Neither RWE Systems UK Ltd nor any of the other companies in the RWE Group from whom this e-mail originates accept any responsibility for losses or damage as a result of any viruses and it is your responsibility to check attachments (if any) for viruses. RWE Systems UK Ltd Registered office: Mistral, Westlea Campus, Chelmsford Road, Swindon, Wiltshire, SN5 7EZ. Registered in England and Wales: company number 6052966. *******************************************

1 0