July 2008 - Xymon - Xymon mailman web

LOG file monitoring
by Robert-Manocchia＠IDEXX.com 09 Jul '08

09 Jul '08

Hello. I have a problem using wildcards in logfile monitoring. I need to monitor the following log files for a specific message: /wls_domains/*/servers/*adminServer/logs/*domain.log In my client-local.cfg file I have the following: [server] log:/wls_domains/*/servers/*adminServer/logs/*domain.log:10240 In my hobbit-clients.cfg file I have the following: LOG "%/wls_domains/.*/servers/.*adminServer/logs/.*domain.log" "java.lang.OutOfMemoryError" COLOR=red I check the following file exists. /wls_domains/demo_alsb_domain/servers/demo_alsb_adminServer/logs/demo_al sb_domain.log There must be something I'm missing. Any help would be greatly appreciated. Thanks Bob Manocchia The email message I get from hobbit is that the log file is not accessible.

1 0

DISK IGNORE problem?
by Mike.Wood＠kci1.com 09 Jul '08

09 Jul '08

Hi All, How do I get Hobbit to ignore all of my "kci11i" filesystems with 1 statement? I've tried all of the following: DISK %^/venice/kci11i.*/ IGNORE DISK %^/venice\/kci11i.*/ IGNORE DISK %/kci11i.*/ IGNORE DISK %/kci11i/ IGNORE The only thing that works is an explicit: DISK /venice/kci11ifdev IGNORE - /dev/ven_kci11ifdev 34471936 27215008 7256928 79% /venice/kci11ifdev /dev/ven_kci11ifeoy 34471936 28204840 6267096 82% /venice/kci11ifeoy /dev/ven_kci11ifqc1 34471936 26503220 7968716 77% /venice/kci11ifqc1 /dev/ven_kci11ifrpt 34471936 26106116 8365820 76% /venice/kci11ifrpt /dev/ven_kci11iftrn 34471936 34002784 469152 99% /venice/kci11iftrn /dev/ven_kci11iftst 34471936 26479436 7992500 77% /venice/kci11iftst /dev/ven_kci11ifprj 34471936 30422244 4049692 89% /venice/kci11ifprj - It's Hobbit 4.2.0 no patches, and an AIX client. Thanks! Mike Wood UNIX System Administrator Kinetic Concepts, Inc. 6103 Farinon Drive San Antonio, TX, 78249 E-mail: mike.wood at kci1.com Office: (210) 255-6382 Mobile: (210) 825-5134 ***************************************************************************** "CONFIDENTIALITY NOTICE: This transmission (including any accompanying attachments) is confidential, is intended only for the individual or entity named above, and is likely to contain privileged, proprietary and confidential information that is exempt from disclosure requests under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, use of or reliance upon any of the information contained in this transmission is strictly prohibited. Any inadvertent or unauthorized disclosure shall not compromise or waive the confidentiality of this transmission or any applicable attorney-client privilege. If you have received this transmission in error, please immediately notify us at postmaster at kci1.com." Kinetic Concepts, Inc. ******************************************************************************

11 21

[hobbit] mailack question
by Martin.Ward＠colt.net 09 Jul '08

09 Jul '08

If I understand Allan's original query he wants to set the ACK options in the email body, not in the Subject line. You could use a .forward to forward the email to a script that takes the message body and puts it in the subject line, then throws it all into the mailack program. The only issue with this nice, simple way of doing it is that it will do this for EVERY email sent to the hobbit user. If you can guarantee that Hobbit will only ever get mail acks then I agree, your suggestion of using a .forward will work fine. Procmail simply allows you to route different emails in different directions, some the application x, other to application y, everything else to the default in-box. |\/|artin -- -----Original Message----- From: Phil Wild [mailto:philwild at gmail.com] Sent: 09 July 2008 13:07 To: hobbit at hswn.dk Subject: Re: [hobbit] mailack question You do not need to use procmail. I simply have a .forward configured to pipe to mailack in the hobbit home directory Cheers Phil 2008/7/9 Ward, Martin <Martin.Ward at colt.net>: Ah, it becomes clearer now! With the suggestions from Phil Wild and Josh Luthman (and reading the man page for hobbit-mailack) it seems that you are expected to use procmail to use this program. Phil, what you suggested seems to be just what Hobbit-mailack does, receives the email and runs a program against its data. Instead of using the procmail(1m) recipe suggested in the Hobbit-mailack man page, you would need one like this: ==== DEFAULT=$HOME/Mailbox LOGFILE=$HOME/procmail.log :0 | $HOME/server/bin/hobbit/reformat_mailack ==== Your "reformat_mailack" script would need to rewrite the body text into the subject line, then simply echo the data to the hobbit-mailack command. Writing this linking script shouldn't be that hard (perl would be better than shell, but either could do it). -- > -----Original Message----- > From: Ward, Martin [mailto:Martin.Ward at colt.net] > Sent: 09 July 2008 10:10 > To: hobbit at hswn.dk > Subject: RE: [hobbit] mailack question > > > I can offer a suggestion but this is only an idea I have just > had, it's not been tried, tested or anything. Also bear in > mind that I had no idea that you could acknowledge an alert > via email... This suggestion might bugger that up in some > unforeseen manner. > > Could you install something like procmail? I see it working > like this: 1. An email gets sent to you. 2. You reply to it > with the acknowledgement in the text body as you have stated. > 3. This reply gets picked up by procmail before it reaches > Hobbit (maybe change the Reply-To in the original email to > route it to a different address). 4. Procmail decides that it > should process this email (there are various tests that can > be performed) and calls a script, passing the body of the > email (and the subject?) to it. 5. The script munges the > email so that the Subject line is made from the text in the > body of the email. 6. Script forwards to email on to its > original destination. > > I can immediately see flaws in this. You're replying on > another piece of s/w. You've got to make sure that the > matching format works. If you want to use the say return > address then you need to ensure that email flows from > procmail to the Hobbit receiver. I'm sure there are others. > > Still, it's one solution. > > |\/|artin > -- > > > > > -----Original Message----- > > From: Allan Spencer [mailto:allan at zandahar.net] > > Sent: 09 July 2008 02:02 > > To: hobbit at hswn.dk > > Subject: Re: [hobbit] mailack question > > > > > > Just thought I'd check back on this and surprised nobody had any > > thoughts on it but also notice Henrik hasn't been around either. > > > > Still have had no luck with this although I have not been > > able to spend > > much time on it. > > > > Still have the same problem of not being able to ack an > alert via the > > email body instead of the subject. > > > > Cheers > > Allan > > > > Allan Spencer wrote: > > > HI all > > > > > > A LONG time ago I asked about ack'ing an alert via email (or via > > > sms-to-email) and to be able to do so without a subject. A > > patch was > > > written at the time and it was included into the main codebase but > > > unfortunately I did not get a chance to imeplement what I > wanted to > > > and never ended up testing it. Thats has just changed > > recently and now > > > I am having issues acking an alert via text in the body. > > > > > > If i reply to an email and maintain the subject it works > fine, if I > > > try cut the subject and paste it as the body nothing > > happens. I havent > > > gone as far as testing it via the sms-to-email app yet as I > > cant get > > > it working from a normal email. > > > > > > I still have one other potential problem of me converting > the [] in > > > the alerts to () but thats more outbound sms and I can > deal with it > > > coming back inwards. > > > > > > Any suggestions appreciated > > > > > > Allan > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > > hobbit-unsubscribe at hswn.dk > > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > > > > > > ************************************************************** > *********************** > The message is intended for the named addressee only and may > not be disclosed to or used by anyone else, nor may it be > copied in any way. > > The contents of this message and its attachments are > confidential and may also be subject to legal privilege. If > you are not the named addressee and/or have received this > message in error, please advise us by e-mailing > security at colt.net and delete the message and any attachments > without retaining any copies. > > Internet communications are not secure and COLT does not > accept responsibility for this message, its contents nor > responsibility for any viruses. > > No contracts can be created or varied on behalf of COLT > Telecommunications, its subsidiaries or affiliates ("COLT") > and any other party by email Communications unless expressly > agreed in writing with such other party. > > Please note that incoming emails will be automatically > scanned to eliminate potential viruses and unsolicited > promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900. To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ************************************************************************ ************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900. To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Tel: 0400 466 952 Fax: 0433 123 226 email: philwild AT gmail.com ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

1 0

[hobbit] mailack question
by Martin.Ward＠colt.net 09 Jul '08

09 Jul '08

Ah, it becomes clearer now! With the suggestions from Phil Wild and Josh Luthman (and reading the man page for hobbit-mailack) it seems that you are expected to use procmail to use this program. Phil, what you suggested seems to be just what Hobbit-mailack does, receives the email and runs a program against its data. Instead of using the procmail(1m) recipe suggested in the Hobbit-mailack man page, you would need one like this: ==== DEFAULT=$HOME/Mailbox LOGFILE=$HOME/procmail.log :0 | $HOME/server/bin/hobbit/reformat_mailack ==== Your "reformat_mailack" script would need to rewrite the body text into the subject line, then simply echo the data to the hobbit-mailack command. Writing this linking script shouldn't be that hard (perl would be better than shell, but either could do it). -- > -----Original Message----- > From: Ward, Martin [mailto:Martin.Ward at colt.net] > Sent: 09 July 2008 10:10 > To: hobbit at hswn.dk > Subject: RE: [hobbit] mailack question > > > I can offer a suggestion but this is only an idea I have just > had, it's not been tried, tested or anything. Also bear in > mind that I had no idea that you could acknowledge an alert > via email... This suggestion might bugger that up in some > unforeseen manner. > > Could you install something like procmail? I see it working > like this: 1. An email gets sent to you. 2. You reply to it > with the acknowledgement in the text body as you have stated. > 3. This reply gets picked up by procmail before it reaches > Hobbit (maybe change the Reply-To in the original email to > route it to a different address). 4. Procmail decides that it > should process this email (there are various tests that can > be performed) and calls a script, passing the body of the > email (and the subject?) to it. 5. The script munges the > email so that the Subject line is made from the text in the > body of the email. 6. Script forwards to email on to its > original destination. > > I can immediately see flaws in this. You're replying on > another piece of s/w. You've got to make sure that the > matching format works. If you want to use the say return > address then you need to ensure that email flows from > procmail to the Hobbit receiver. I'm sure there are others. > > Still, it's one solution. > > |\/|artin > -- > > > > > -----Original Message----- > > From: Allan Spencer [mailto:allan at zandahar.net] > > Sent: 09 July 2008 02:02 > > To: hobbit at hswn.dk > > Subject: Re: [hobbit] mailack question > > > > > > Just thought I'd check back on this and surprised nobody had any > > thoughts on it but also notice Henrik hasn't been around either. > > > > Still have had no luck with this although I have not been > > able to spend > > much time on it. > > > > Still have the same problem of not being able to ack an > alert via the > > email body instead of the subject. > > > > Cheers > > Allan > > > > Allan Spencer wrote: > > > HI all > > > > > > A LONG time ago I asked about ack'ing an alert via email (or via > > > sms-to-email) and to be able to do so without a subject. A > > patch was > > > written at the time and it was included into the main codebase but > > > unfortunately I did not get a chance to imeplement what I > wanted to > > > and never ended up testing it. Thats has just changed > > recently and now > > > I am having issues acking an alert via text in the body. > > > > > > If i reply to an email and maintain the subject it works > fine, if I > > > try cut the subject and paste it as the body nothing > > happens. I havent > > > gone as far as testing it via the sms-to-email app yet as I > > cant get > > > it working from a normal email. > > > > > > I still have one other potential problem of me converting > the [] in > > > the alerts to () but thats more outbound sms and I can > deal with it > > > coming back inwards. > > > > > > Any suggestions appreciated > > > > > > Allan > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > > hobbit-unsubscribe at hswn.dk > > > > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > > > > > > ************************************************************** > *********************** > The message is intended for the named addressee only and may > not be disclosed to or used by anyone else, nor may it be > copied in any way. > > The contents of this message and its attachments are > confidential and may also be subject to legal privilege. If > you are not the named addressee and/or have received this > message in error, please advise us by e-mailing > security at colt.net and delete the message and any attachments > without retaining any copies. > > Internet communications are not secure and COLT does not > accept responsibility for this message, its contents nor > responsibility for any viruses. > > No contracts can be created or varied on behalf of COLT > Telecommunications, its subsidiaries or affiliates ("COLT") > and any other party by email Communications unless expressly > agreed in writing with such other party. > > Please note that incoming emails will be automatically > scanned to eliminate potential viruses and unsolicited > promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900. To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

2 1

MS SQL hobbit monitoring
by James.Roberts＠hants.gov.uk 09 Jul '08

09 Jul '08

Has anyone had any success from using hobbit to monitor ms sql server? Thanks

1 0

Hobbit beginner's question
by Jerome.Meyer＠baldata.ch 09 Jul '08

09 Jul '08

Hi All I'm new on the list and am beginner with hobbit! I've installed the product read the some docs about it... but nevertheless the infos about clients are small! On Browser, here are fields from the client : 1.conn (:\) : Wed Jul 9 11:18:28 2008 conn ok : System failure of the ping test Service conn on echobase is OK Hobbit system error 2.info (green) 3.trends (green) I don't understand why is "conn ok" then system failure? How and where should we configure to have more informations about the client (other fields). #+++++++++++++++++++++++++++++++++++ # bb-hosts #+++++++++++++++++++++++++++++++++++ page SYSTEMS LINUX SYSTEMS title proxy systems 10.x.x.10 echobase echobase.data.net title emails systems 10.x.x.12 smtp1 smtp1.data.net #+++++++++++++++++++++++++++++++++++ # hobbit-clients.cfg #+++++++++++++++++++++++++++++++++++ HOST=%echobase.* #processus for squid PROC squid 2 2 red PROC unlinkd 1 1 red Thanks in advance for your help Best regards Jérôme M. Meyer

1 0

[hobbit] mailack question
by Martin.Ward＠colt.net 09 Jul '08

09 Jul '08

I can offer a suggestion but this is only an idea I have just had, it's not been tried, tested or anything. Also bear in mind that I had no idea that you could acknowledge an alert via email... This suggestion might bugger that up in some unforeseen manner. Could you install something like procmail? I see it working like this: 1. An email gets sent to you. 2. You reply to it with the acknowledgement in the text body as you have stated. 3. This reply gets picked up by procmail before it reaches Hobbit (maybe change the Reply-To in the original email to route it to a different address). 4. Procmail decides that it should process this email (there are various tests that can be performed) and calls a script, passing the body of the email (and the subject?) to it. 5. The script munges the email so that the Subject line is made from the text in the body of the email. 6. Script forwards to email on to its original destination. I can immediately see flaws in this. You're replying on another piece of s/w. You've got to make sure that the matching format works. If you want to use the say return address then you need to ensure that email flows from procmail to the Hobbit receiver. I'm sure there are others. Still, it's one solution. |\/|artin -- > -----Original Message----- > From: Allan Spencer [mailto:allan at zandahar.net] > Sent: 09 July 2008 02:02 > To: hobbit at hswn.dk > Subject: Re: [hobbit] mailack question > > > Just thought I'd check back on this and surprised nobody had any > thoughts on it but also notice Henrik hasn't been around either. > > Still have had no luck with this although I have not been > able to spend > much time on it. > > Still have the same problem of not being able to ack an alert via the > email body instead of the subject. > > Cheers > Allan > > Allan Spencer wrote: > > HI all > > > > A LONG time ago I asked about ack'ing an alert via email (or via > > sms-to-email) and to be able to do so without a subject. A > patch was > > written at the time and it was included into the main codebase but > > unfortunately I did not get a chance to imeplement what I wanted to > > and never ended up testing it. Thats has just changed > recently and now > > I am having issues acking an alert via text in the body. > > > > If i reply to an email and maintain the subject it works fine, if I > > try cut the subject and paste it as the body nothing > happens. I havent > > gone as far as testing it via the sms-to-email app yet as I > cant get > > it working from a normal email. > > > > I still have one other potential problem of me converting the [] in > > the alerts to () but thats more outbound sms and I can deal with it > > coming back inwards. > > > > Any suggestions appreciated > > > > Allan > > > > To unsubscribe from the hobbit list, send an e-mail to > > hobbit-unsubscribe at hswn.dk > > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > ************************************************************************************* The message is intended for the named addressee only and may not be disclosed to or used by anyone else, nor may it be copied in any way. The contents of this message and its attachments are confidential and may also be subject to legal privilege. If you are not the named addressee and/or have received this message in error, please advise us by e-mailing security at colt.net and delete the message and any attachments without retaining any copies. Internet communications are not secure and COLT does not accept responsibility for this message, its contents nor responsibility for any viruses. No contracts can be created or varied on behalf of COLT Telecommunications, its subsidiaries or affiliates ("COLT") and any other party by email Communications unless expressly agreed in writing with such other party. Please note that incoming emails will be automatically scanned to eliminate potential viruses and unsolicited promotional emails. For more information refer to www.colt.net or contact us on +44(0)20 7390 3900.

2 1

RECOVERED alerts red->yellow
by asparks＠doublesparks.net 09 Jul '08

09 Jul '08

I have the following settings in my hobbitserver.cfg: ALERTCOLORS="red,yellow,purple" OKCOLORS="green,blue,clear" I have the following rule in my hobbit-alerts.cfg: SERVICE=disk COLOR=red MAIL asparks at photobucket.com RECOVERED I get an alert when disk space goes critical (red). However: * when the status goes from red->green, I get a recovery alert; * when the status goes red->yellow->green, I get NO recovery alert. I've read the sections on ALERTCOLORS and OKCOLORS. It does work better when I remove yellow from the list. But I need to sometimes alert on yellow status, so this is not really an option. What have I done wrong? Thanks in advance. -Alan

2 2

data flood
by tm＠campnerd.com 09 Jul '08

09 Jul '08

Hello, Is there any configuration parameter to change the behavior of the 'data flooding from n.n.n.n, closing connection' feature, or are there any existing patches available to toggle this? (running 4.2 all in one) Just want to accept a couple messages to have a look for debugging and then reset to enable this important feature. I am aware there are a couple of other ways to debug, just curious about this avenue. Regards,

1 0

stange graph errors - please help
by anthony.parackel＠bearingpoint.com 09 Jul '08

09 Jul '08

Hi All, I'm hoping this is a trivial problem. I've installed hobbit 4.2.0 on a box I built using the latest debian etch distro. All my clients are running Solaris 8 -> 10 and getting all of them to communicate with the hobbit server was pretty smooth. However, I'm experiencing some strange graph behavior. Basically, I don't see any graphs generated whenever I click on a client's memory or disk column. All I see is a little a magnifying glass(or zoom) icon which takes me to a blank page. The cpu and trends columns always give me the right graph info though. What's really weird is that whenever I install a brand new client I'm able to initially see graph data for every field. After 24 hours elapses, the memory and disk fields start drawing blanks. I don't see any errors in the apache logs and I've rebuilt the server a few times. Has anyone ever encountered this type of behavior before? Many thanks in advance. anthony *************************************************************************************************** The information in this email is confidential and may be legally privileged. Access to this email by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please reply to or forward a copy of this message to the sender and delete the message, any attachments, and any copies thereof from your system. ***************************************************************************************************

2 1