June 2008 - Xymon - Xymon mailman web

[hobbit] Service SMTP on xxxxxx is not OK : Unexpected servic e response
by bewhite＠fellowes.com 26 Jun '08

26 Jun '08

We had a similar problem with our exchange server until I changed the bb-services file to be: [smtp] send "helo\r\nquit\r\n" expect "220" options banner port 25 Now the exchange response to smtp is much more stable, but my linux sendmail servers complain more often. I guess I need to make a smtpex with the above and restore the original smtp definition, which seemed to work better with Linux. Why can't MS just do things to standards? ......Bruce _____ From: Geoff Hallford [mailto:geoff.hallford at gmail.com] Sent: Wednesday, June 25, 2008 11:53 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Service smtp on xxxxxx is not OK : Unexpected service response I have also seen this happen when the response is slow from the mail server to show the 220 message. It does show it but is slow for some reason. I create a new service called smtp-slow by adding the following and then configure the bb-hosts entry with 'smtp-slow' instead of smtp. Just a thought. This way it doesn't require a 220 response but if it gets a valid "connection" it is okay. If it can't open a connection, it goes red. It does limit the amount of app validation but it is the only thing that worked in my case. [smtp-slow] send "mail\r\nquit\r\n" options banner port 25 On Wed, Jun 25, 2008 at 12:31 PM, Andrew Clarke <andrew at bccit.co.uk <mailto:andrew at bccit.co.uk> > wrote: As it happens, there are PIXs between the hobbit server & all the Exchange servers. However, they've all been there for ages (years in some cases). I'll have a chat with our resident Cisco guru & see if he made any changes at our end around 6th June, when things stopped working. Andrew Clarke Support and Technical Development Officer BCC IT Solutions DDI: 0871 288 2036 Tel: +44 (0)1239 710823 http://www.bccit.co.uk/ <http://www.bccit.co.uk/> Providers of business to business IT Solutions & Services Back-up - Anti Virus - Security - Servers - Wireless Networks - VPN - Remote Monitoring - Project Consultation Hardware Provision Servers & Workstations - Disaster Recovery - Proactive Diagnostics - System Migration - Fibre CAT5e Server Administration - Forensics - Grant Appraisal - Network Management - System Appraisals - Support Contracts ... For full e-mail terms & conditions of use, please follow the link to the bcc web site http://www.bccitsolutions.co.uk/index.php?option=com_content <http://www.bccitsolutions.co.uk/index.php?option=com_content&task=view& amp;id=24&Itemid=1> &task=view&id=24&Itemid=1 BCC IT Solutions is a trading name of European Computer Units Limited, Registered in Cardiff, Company Registration No. 2651835 Registered Office: Unit B Station Road, Newcastle Emlyn, Carmarthenshire, Wales, SA38 9BX -----Original Message----- From: Rob MacGregor [mailto:rob.macgregor at gmail.com <mailto:rob.macgregor at gmail.com> ] You wouldn't happen to have a Cisco PIX/ASA between the hobbit host and the mail server, with it configured to do "fixup"? Those are known for breaking things ;) Rob MacGregor To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk> -- 'If my answers frighten you then you should cease asking scary questions.' --Sam Jackson ---------------------------------------------------- Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc. ----------------------------------------------------

4 4

[hobbit] Testing Hobbit alerts
by Martin.Ward＠colt.net 26 Jun '08

26 Jun '08

> Anything logged in the page.log file ? Is hobbitd_alert running at all ? No, page.log hasn't been written to in months although the last entries in it were: 2007-09-27 22:44:29 Cannot open configuration file /opt/hobbit/server/etc/hobbit-alerts.cfg: No such file or directory 2007-09-27 22:50:38 Worker process died with exit code 0, terminating Which seems to show that while I was setting Hobbit up last year I didn't have this file. Hobbitd_alert isn't running and this is part of what is causing me issues as I can't find how it is started (this is where my ignorance shows through). > As a last resort, run hobbitd_alert with the "--debug" option > and let me see what it says. 2008-06-26 08:52:15 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbytes=0, bufleft=266239 2008-06-26 08:53:15 No files modified, skipping reload of /opt/hobbit/server/etc/hobbit-alerts.cfg 2008-06-26 08:53:15 0 alerts to go 2008-06-26 08:53:15 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbytes=0, bufleft=266239 2008-06-26 08:54:15 No files modified, skipping reload of /opt/hobbit/server/etc/hobbit-alerts.cfg 2008-06-26 08:54:15 0 alerts to go 2008-06-26 08:54:15 Bad data in channel, skipping it 2008-06-26 08:54:15 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbytes=0, bufleft=266239 2008-06-26 08:55:15 No files modified, skipping reload of /opt/hobbit/server/etc/hobbit-alerts.cfg 2008-06-26 08:55:15 0 alerts to go 2008-06-26 08:55:15 Bad data in channel, skipping it 2008-06-26 08:55:15 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbytes=0, bufleft=266239 2008-06-26 08:56:15 No files modified, skipping reload of /opt/hobbit/server/etc/hobbit-alerts.cfg 2008-06-26 08:56:15 0 alerts to go I started this run with the one possible alert set to green (so no alert was going to occur). At 08:54:00 I initiated the error event. This generates an extra debug entry: 2008-06-26 08:54:15 Bad data in channel, skipping it But I have no idea what this means... :-( |\/|artin ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

1 0

help with snapshot 6-25-2008
by Andy.Farrior＠victoriacollege.edu 26 Jun '08

26 Jun '08

I think I've left out a step, but can't seem to figure out what. I compiled and installed the snapshot from 6-25-2008 (same problem with snapshot from 6-12-2008). After watching the hobbitlaunch.log file, I saw that Hobbit wants a "hobbitserver.cert" and "hobbitserver.key" file. I followed the instructions to create the "cert" and "key" files that were referenced here: http://www.hswn.dk/hobbiton/2008/04/msg00093.html Now Hobbit runs, but I'm having some wierdness with the "info" column. Hobbit receives and displays network side tests and client side tests just fine (conn/cpu/disk/http/...). If I click on the "info" status for a host that's running a Big Brother client (*nix/NT) or BBWin client in local mode, the bb-hostsvc.sh CGI script displays the info page just fine. However, if the client is running BBWin in central mode, Hobbit client, or the client on the Hobbit server itself, bb-hostsvc.sh generates an error in the Apache log: [Wed Jun 25 21:34:11 2008] [error] [client 74.192.56.211] Premature end of script headers: bb-hostsvc.sh, referer: <snip> Having the error occur with the "info" column for the Hobbit server seemed odd. Is this related to the development work for SSL-encrypted connections or did I miss a step somewhere? Thanks, Andy

1 0

[hobbit] Testing Hobbit alerts
by Martin.Ward＠colt.net 25 Jun '08

25 Jun '08

> Always use the "bbcmd" utility to setup the environment for > ... > So your command should be > bbcmd hobbitd_alert --test tac0.lon.ws.colt.net proc > Thanks Henrik, with that command I get: 00014153 2008-06-25 14:49:28 Matching host:service:page 'tac0.lon.ws.colt.net:proc:Netops' against rule line 128 00014153 2008-06-25 14:49:28 *** Match with 'HOST=tac0.lon.ws.colt.net' *** 00014153 2008-06-25 14:49:28 Matching host:service:page 'tac0.lon.ws.colt.net:proc:Netops' against rule line 128 00014153 2008-06-25 14:49:28 *** Match with 'HOST=tac0.lon.ws.colt.net' *** 00014153 2008-06-25 14:49:28 Mail alert with command '/bin/mailx -s "Hobbit [12345] tac0.lon.ws.colt.net:proc CRITICAL (RED)" martin.ward at colt.net' And I can confirm that running the mailx command specified DOES send an email, so the mail system itself is working correctly. Unfortunately Hobbit itself is not generating anything. My hobbit-alerts.cfg file looks like this: HOST=tac0.lon.ws.colt.net MAIL martin.ward at colt.net repeat=5m So any alert should email me. I have a simple test set up so that if I am not editing a specific file a process in not found and the "procs" column goes red, but no emails are forthcoming. I've even tried changing the "mailx" command to a simple script that logs whatever is output from Hobbit to a log file, but nothing comes out. It looks like the alerting functionality is not working or has been disabled somehow, but that makes no sense. Can you give me some more pointers as to where to look? |\/| -- > -----Original Message----- > From: Henrik Stoerner [mailto:henrik at hswn.dk] > Sent: 24 June 2008 22:39 > To: hobbit at hswn.dk > Subject: Re: [hobbit] Testing Hobbit alerts > > > On Tue, Jun 24, 2008 at 04:22:05PM +0100, Ward, Martin wrote: > > Also, in my hobbitserver.cfg I have this: > > MAILC="/bin/mailx" > > MAIL="$MAILC -s" > > > > So the theory goes that when an alert occurs the /bin/mailx > command is > > executed with various different parameters. > > > > The problem is, when I try and test it I get the following: > > > > hobbit at hbt0:/opt/hobbit/server/etc>hobbitd_alert --test > tac0.lon.ws.colt.net proc > > Always use the "bbcmd" utility to setup the environment for > your tests. That's the only way you can make sure > hobbitd_alert inherits the settings from your > hobbitserver.cfg - if you don't use bbcmd, then it will use > the built-in (compile-time) defaults. > > So your command should be > bbcmd hobbitd_alert --test tac0.lon.ws.colt.net proc > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

2 1

hobbitd_channel: enadis
by s_aiello＠comcast.net 25 Jun '08

25 Jun '08

I am trying to monitor and process communication on the enadis channel. I have been looking at messages comin in on this channel and see the following: @@enadis#6|1213126417.873757|127.0.0.1|HobbitServer|http|1213126657 @@ Which looking at the code I see the fields are: /* @@enadis|timestamp|sender|hostname|testname|expiretime */ Questions: 1. 1st field: comes in as enadis#1, enadis#2, enadis#3, etc. that #number seems to get reset whenever the hobbit daemon is reset. Any extrnal purpose for this incrementing # ? 2. The timestamp field has EPOC.Other#. What is the Other# after the period ? 3. expiretime, just looking for confirmation on possible values. EPOC for expiration time, Zero for enabling, and -1 means Until Ok ? 4. Where is the blurbage about the maint,"Disabled by:" & "Reason" ? I am running 4.2.0 With All-in-One patch. Any help would be appreciated. ~Steve

2 2

problems installing netapp.pl
by eositis＠ois.lv 25 Jun '08

25 Jun '08

Cheers- I have been struggling for the past few days to get netapppl to work on my hobbit server without luck. I have installed the sw as per the instructions and edited the relevant files. When I try to run netapp.pl manually it errors stating that the relevant netapp is not listed in the bbhost file. The server is listed servername ipaddr # netapp The usual tests run and results are shown on the webpage for conn, http, info, sslcer, trends. However none of the disk etc. info is shown. Hobbit has been upgraded to 4.2.0 and the latest allinone patch has been added. Perl has been updated to 5.8.8. The system is suse 9.3. At the moment I am not sure how to proceed and assistance would be appreciated. Sincerely, Elmars -- -------------------------------------------------------- Elmārs Osītis Valdes loceklis "OIS", sia Dubultu Prospekts 77, Jūrmala LV-2008 tel: +371 67767673 fax: +731 67767674 mailto:eositis at ois.lv http://www.ois.lv

3 5

I would like to share a Hobbit extension
by linuxmasterjedi＠free.fr 25 Jun '08

25 Jun '08

Hi, I would like to know what is the best way to share a new Hobbit extension? It's a tiny Bash script with a README (3KB) to check some SAP remote system. In the first place, I've put my work there : http://code.google.com/p/checkmysap/ Thanks by advance.

6 11

curves went to zero but didn't have a report?
by Andrew.Chen＠ehealth-china.com 25 Jun '08

25 Jun '08

Let's take a look at the CPU and Memory charts for this machine: At around 01:00pm, the curves went to zero. Above, the cpu and memory used 0, but I didn't recevie a RED Alert report and email. (if there is some mothed to check this problem). Hobbit-client configured file UP 1h 22w LOAD 5.0 15.0 DISK / 80 90 DISK /boot 80 90 DISK /var 80 90 DISK /data 80 90 MEMSWAP 40 60 MEMACT 80 90 MEMPHYS 101 101 This configuration only reported when the cpu and memory reach 5.0(cpu) and 80(memory), then they will send a alert report and email. But I can't find about cpu and memory used 0, then send an alert report and email. Can you teach me how to do it? Thanks.

4 6

Testing Hobbit alerts
by Martin.Ward＠colt.net 24 Jun '08

24 Jun '08

Hi all, I am looking in to setting up Hobbit alerts but I am having problems verifying and testing the configs. In my hobbit-alerts.cfg file I have the following entry: HOST=tac0.lon.ws.colt.net MAIL martin.ward at colt.net Also, in my hobbitserver.cfg I have this: MAILC="/bin/mailx" # Command used to send an e-mail with no subject MAIL="$MAILC -s" # Command used to send an e-mail with a subject So the theory goes that when an alert occurs the /bin/mailx command is executed with various different parameters. The problem is, when I try and test it I get the following: hobbit at hbt0:/opt/hobbit/server/etc>hobbitd_alert --test tac0.lon.ws.colt.net proc 00000935 2008-06-24 15:19:56 send_alert tac0.lon.ws.colt.net:proc state Paging 00000935 2008-06-24 15:19:56 Matching host:service:page 'tac0.lon.ws.colt.net:proc:Netops' against rule line 128 00000935 2008-06-24 15:19:56 *** Match with 'HOST=tac0.lon.ws.colt.net' *** 00000935 2008-06-24 15:19:56 Matching host:service:page 'tac0.lon.ws.colt.net:proc:Netops' against rule line 128 00000935 2008-06-24 15:19:56 *** Match with 'HOST=tac0.lon.ws.colt.net' *** 00000935 2008-06-24 15:19:56 Mail alert with command '/var/mail/hobbit "Hobbit [12345] tac0.lon.ws.colt.net:proc CRITICAL (RED)" martin.ward at colt.net' As you can see the mail alert command is completely wrong. Running this command under different user IDs simply changes the user ID in the "/var/mail/..." text above. I can't get Hobbit to actually run the mailx command. Any suggestions as to what I am missing? |\/|artin -- Martin Ward Network Systems Operations Specialist DDI: +44 (0) 20 7863 5218 Fax: +44 (0) 20 7863 5610 Mob: +44 (0) 7971 97 77 21 www.colt.net Data | Voice | Managed Services Help reduce your carbon footprint | Think before you print COLT Telecommunications, Beaufort House, 15 St Botolph Street, London, EC3A 7QN UK Registered in England and Wales, registered number 02452736, VAT number GB 645 4205 50 ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

2 1

Can hobbit server comprehense COMBO keywords like BB server
by Myra.Haubrich＠ec.gc.ca 24 Jun '08

24 Jun '08

I am wondering if hobbit server can understand the keywork "combo" at the beginning of a combo report file like bb server does? Eg: combo status server1,xx,xx,xx,xx.cpu green Tue Jun 24 19:59:34 UTC 2008 up: 5 days, 2 users, 119 procs, load=17 LOAD AVG on server1,xx,xx,xx,xx is 17 status server1,xx,xx,xx,xx.disk green Tue Jun 24 19:59:34 UTC 2008 - Disk partitions on server1,xx,xx,xx,xx OK /dev/cciss/c0d1p1 100790004 9644576 86025516 11% /home /dev/cciss/c0d0p3 5036316 44476 4736008 1% /tmp /dev/cciss/c0d0p1 101086 19502 76365 21% /boot /dev/cciss/c0d0p6 40670524 2182592 36421976 6% / /dev/cciss/c0d0p2 20161204 988424 18148640 6% /var status server1,xx,xx,xx,xx .procs green Tue Jun 24 19:59:34 UTC 2008 All processes are OK &green cron >=1 - 1 instance running &green bbrun >=1 - 2 instances running ... Activity of Telvent HTTPIN Log @ 2008-06-24 19:59:36: GREEN Log file last updated on 2008-06-24 19:55:03. Contents of Telvent HTTPIN Log @ 2008-06-24 19:59:36: GREEN No errors found.

2 1