March 2008 - Xymon - Xymon mailman web

[hobbit] Nesting rules in hobbit-alerts.cfg
by gumby3203＠gmail.com 18 Mar '08

18 Mar '08

Is it possible to nest rules in hobbit-alerts.cfg? For example, can I do something like this (indenting provided for readability): PAGE=hostPageA NOTICE RECOVERED HOST=hostA,hostB,hostC MAIL pager at somewhere.com HOST=%(hostD[0-9]) MAIL email at somewhere.com Our alerting rules are starting to get kind of complex, and nesting alert rules as above would make things easier. I know I could do something like: PAGE=hostPageA NOTICE RECOVERED MAIL pager at somewhere.com HOST=hostA,hostB,hostC MAIL email at somewhere.com HOST=%(hostD[0-9]) But some of the HOST= lists are very long (i.e. wrap across multiple lines), so the above 2nd example would look a lot uglier than it does in this post (which was simplified for readability). If nesting rules won't work, I wonder how much effort would be involved in adding this feature.

4 4

[hobbit] Hobbit on Wikipedia
by bewhite＠fellowes.com 17 Mar '08

17 Mar '08

Not sure but here are some ideas. Installation and configuration change ease? Identifies status change in the last 24 hours? Ease of changing how monitored host appears in user interface? Thickness of the client? Built in report generation? Availability reporting? ......Bruce _____ From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Monday, March 17, 2008 3:18 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Hobbit on Wikipedia Ooh, I see. Also, Buchan - you're adding email addresses in your response. All you have to do is retain the subject and reply to hobbit at hswn.dk <mailto:hobbit at hswn.dk> so it will be distributed to everyone =) Does anyone know of additional features that we should be putting on the Wiki page? On 3/17/08, Buchan Milne <bgmilne at staff.telkomsa.net <mailto:bgmilne at staff.telkomsa.net> > wrote: On Monday 17 March 2008 15:50:47 Josh Luthman wrote: > The way I see trends being is a line graph, as those produced by Hobbit. > Does anyone else see things this way? Yes, that is what I understood, which is why I changed trending to Yes. However, I suspect they mean something else by "Charts" (e.g. pie charts etc.). -- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer ---------------------------------------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc. ----------------------------------------------------

2 1

Question about next Hobbit release (NOT "when is it due")
by gumby3203＠gmail.com 17 Mar '08

17 Mar '08

Quick question about the next version of Hobbit... Currently in 4.2.0 (latest patches), the "info" page doesn't correctly show the alert rules when using the GROUP directive. (I believe this was mentioned before on this mailing list). I'm just curious if the feature set for 4.3.0 (or whatever the next version will be numbered) has been frozen, and if this will be fixed. If it's not frozen and not currently in the code, would it be possible to add it to the next version?

6 10

[hobbit] hobbit color-changing issue
by bewhite＠fellowes.com 17 Mar '08

17 Mar '08

At the top of the client-local.cfg file it says: "The Hobbit Client will only report back entries generated in the past 30 minutes..." Are you sure its only 15 minutes and not 30 minutes? I can't find anything in either the client-local.cfg nor the hobbit-clients.cfg which controls the time associated with what messages will be processed. .....Bruce -----Original Message----- From: georgi.lalev at zdv.uni-tuebingen.de [mailto:georgi.lalev at zdv.uni-tuebingen.de] Sent: Monday, March 17, 2008 9:09 AM To: hobbit at hswn.dk Subject: [hobbit] hobbit color-changing issue Hello, I have a small hobbit issue. I want hobbit to go red every time the word "/evicted/" shows up in /var/log/messages on some hosts. So the part in /hobbit-clients.cfg/ is as follows: HOST=%cn4[3-6]*-hp PROC "%syslogd" 1 1 red PROC "%/usr/sbin/nscd" 1 red PROC "%iscsid" 2 2 red LOAD 16.5 20.0 LOG %/var/log/messages %(?-i)evicted|Oops|ALERT|NOTICE COLOR=red LOG %/var/log/messages %(?-i)LustreError|WARNING|FAILED|kernel|failing|ILLEGAL COLOR=yellow The Part in client-local.cfg: [cn44-hp] log:/var/log/messages:10240 ignore MARK trigger ALERT trigger .*(dumping log to)|(evicted).* file:/var/log/messages The Issue: Every time I put the word "/evicted/" manually in the messages file, hobbit will go red for about 15 minutes. That's fine. If I put a second line with the word "/kernel/" in the messages file, a second (yellow) line appears in the mesgs column. That's also fine. Hobbit is still red, but stays that way only for about 15 minutes. After the 15 minutes, it changes to yellow and the "/evicted/" warning is gone. It stays yellow for another 15 minutes, and then it turns green. The messages file is really small (under 10 KByte) and not much is being written in it. That's why hobbit must stay red all the time!?! I searched for the number 900 in server/etc, but nothing matches (exept some proxy configuration). Does anyone have an Idea what or where the problem could be? Greetings Georgi To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ---------------------------------------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc. ----------------------------------------------------

1 0

SCRIPT and MAIL not working
by leam＠reuel.net 17 Mar '08

17 Mar '08

New to Hobbit so I assume my config is off. We're using Hobbit 4.2.0 on Solaris 9 and I'm running into a couple issues. Neither MAIL not SCRIPT are working in the hobbit-alerts.cfg. Our Hobbit server was moved from a Linux host to the Solaris one, and regular mail works on the Solaris box. However, I can't get MAIL or SCRIPT to work to send alerts when I'm using: bbcmd hobbit_alert --debug --test <server> <service> I can see it getting logged, but MAIL and some of the admin scripts seem bash-centric and not Bourne shell compatible. The script I have just sends mail and works if I run it as the hobbit user. Help would be much appreciated! Leam

2 1

hobbit color-changing issue
by georgi.lalev＠zdv.uni-tuebingen.de 17 Mar '08

17 Mar '08

Hello, I have a small hobbit issue. I want hobbit to go red every time the word "/evicted/" shows up in /var/log/messages on some hosts. So the part in /hobbit-clients.cfg/ is as follows: HOST=%cn4[3-6]*-hp PROC "%syslogd" 1 1 red PROC "%/usr/sbin/nscd" 1 red PROC "%iscsid" 2 2 red LOAD 16.5 20.0 LOG %/var/log/messages %(?-i)evicted|Oops|ALERT|NOTICE COLOR=red LOG %/var/log/messages %(?-i)LustreError|WARNING|FAILED|kernel|failing|ILLEGAL COLOR=yellow The Part in client-local.cfg: [cn44-hp] log:/var/log/messages:10240 ignore MARK trigger ALERT trigger .*(dumping log to)|(evicted).* file:/var/log/messages The Issue: Every time I put the word "/evicted/" manually in the messages file, hobbit will go red for about 15 minutes. That's fine. If I put a second line with the word "/kernel/" in the messages file, a second (yellow) line appears in the mesgs column. That's also fine. Hobbit is still red, but stays that way only for about 15 minutes. After the 15 minutes, it changes to yellow and the "/evicted/" warning is gone. It stays yellow for another 15 minutes, and then it turns green. The messages file is really small (under 10 KByte) and not much is being written in it. That's why hobbit must stay red all the time!?! I searched for the number 900 in server/etc, but nothing matches (exept some proxy configuration). Does anyone have an Idea what or where the problem could be? Greetings Georgi

1 1

Problems with CPU thresholds on Hobbit server
by stewartl42＠gmail.com 17 Mar '08

17 Mar '08

I have configured the CPU thresholds on my Hobbit server, but it does not appear to be working... This is my central hobbit server. It appears as though it is using the default thresholds instead of the specific ones for the host. I get alerts about CPU whenever the load is above 5, which is pretty much all the time. In ~hobbit/server/etc//hobbit-clients.cfg I have the following. DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 HOST=server1.localdomain.com LOAD 11.0 25.0 I also have the following in ~hobbit/client/etc/localclient.cfg even though it should not be used. I am not calling hobbitclient.sh with --local. DEFAULT # These are the built-in defaults. UP 1h LOAD 7.5 12.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 -- Stewart The revolution will not be televised. The revolution will be no re-run brothers; The revolution will be live.

2 3

bandwith measure with hobbit ?
by robert＠schetterer.org 16 Mar '08

16 Mar '08

Hi @ll, we have a debian icecast server which is random set down in bandwith by the provider cause of high traffic ( they call it security feature ) has anybody knowledge how to monitor such with hobbit from outside or local hobbit client, so we get alarmed and reset the limiting with the providers http gui. -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

1 0

[hobbit] Securing CGI secure by monitored hosts
by bewhite＠fellowes.com 14 Mar '08

14 Mar '08

Thanks for the info. I gathered this was the case based on my reading, but I just wanted to make sure I didn't miss anything. I really don't want to hack all the scripts to provided this separation. The printer guys just need to know they don't mess with servers. ......Bruce -----Original Message----- From: s_aiello at comcast.net [mailto:s_aiello at comcast.net] Sent: Friday, March 14, 2008 7:11 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Securing CGI secure by monitored hosts On Thursday 13 March 2008, White, Bruce wrote: > Hi all, > > All these questions about securing hobbit has made me think about our > hobbit set-up. Is there a way to secure the actions taken by scripts in > the secure CGI directory to acting on specific listings in the bb-hosts > file? We have one group responsible for printers which is completely > different from the group responsible for servers. We would like to give > the group responsible for printers the ability to put printers in > maintenance mode, but would not want them to have the same access to > servers. We are running a generic hobbit section of the httpd.conf file > with users defined via the htpasswd command. > Out of the box, no Hobbit 4.2.0 does not have that feature. I implemented this function though by grouping devices on different pages. I then added to the cgi .sh scripts an authentication wrapper. Basically it checks a file that maps user name to pages the user has the authority to. So any device on the page, the user can put into maint via the device's info page. Since the Admin Enable/Disable function had more of a global scope, I severely limited it's access to a select few. Hope this helps, ~Steve To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ---------------------------------------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc. ----------------------------------------------------

1 0

Regular Expression problem
by Robert-Manocchia＠IDEXX.com 14 Mar '08

14 Mar '08

I have the following scenario. I want to monitor the creation of core files in the following directories /usr/sap/PRD/D01/work, /usr/sap/PRD/D02/work, usr/sap/PRD/D03/work, /usr/sap/PRD/D04/work, /usr/sap/PRD/D05/work, and /usr/sap/PRD/D06/work. I have the following: 1. In client-local.cfg: [server1] File:`ls -1d /usr/sap/PRD/D0*/work/core` 2. In hobbit-clients.cfg: FILE %/usr/sap/PRD/D0.*/work/core NOEXIST yellow 3. And in hobbit-alerts.cfg: MAIL Me at domain.com COLOR=yellow RECOVERED This is not working. When click on the files for this server I do not see these files being selected. Any help would be appreciated.

2 4