April 2009 - Xymon - Xymon mailman web

clear status for files,ports and procs columns for xymon-4.2.2
by pankaj.dorlikar＠gmail.com 17 Apr '09

17 Apr '09

hello, i am getting clear status for files,ports and procs colums for the host being monitored. files-No files checked.clear ports-ports not ok;no port checks defined procs-process not ok;no process checks defined. How to configure all this ?why clear staus? what to do to change it to green? help... -- Pankaj V. Dorlikar

2 1

ssh status on all clients and server for xymon-4.2.2
by pankaj.dorlikar＠gmail.com 17 Apr '09

17 Apr '09

hello, i want to configure ssh test in all clients and server sa we have in big brother wt to do? -- Pankaj V. Dorlikar

1 0

depends statement returning wrong result
by SKreien＠la-z-boy.com 17 Apr '09

17 Apr '09

Hi everyone, I had an issue with a depends statement last night. Here's the line in question from my bb-hosts: 0.0.0.0 mdav6022.mdmza.dmz.hq # http://mdav6022.mdmza.dmz.hq/lazboy/Main/login.do CLIENT:MDAV6022 COMMENT:"web4" depends=(http:retv6002.na.hq/http) DOWNTIME=*:0125:0415 If I pull up the history for mdav6022 it shows the http test constantly going up and down for about 6 hours last night. Most of the time the test went white due to the http test failing on retv6002, which is what it's supposed to do. The problem is that when I went to look at retv6002, the http test there shows green the entire night except for about 2 minutes of planned downtime. I also haven't gotten any calls this morning about mdav6022 being down, so I don't think it was actually down. Maybe we had a network issue with communication to mdav6022 or something; I don't know, I'll worry about that later. What worries me with the depends statement though is why did the http test go white and claim that the http test it depends on also failed, when in reality it didn't? Thanks, Scot Kreienkamp La-Z-Boy Inc. skreien at la-z-boy.com 734-242-1444 ext 6379

1 0

alert storm / intelligent extra mailscript
by martin.flemming＠desy.de 17 Apr '09

17 Apr '09

Hi ! I've got an problem with my colleagues and the alert-storm if a hole batchfarm will be rebooted for kernel-upgrade etc. .. and the person, who did it, doesn't deactivate them or make an Acknowledge-Downtime, don't ask me why ... he hate web-guis, want to make only one command on the console ... I know, i asked something similiar before http://www.hswn.dk/hobbiton/2009/01/msg00398.html Re: [hobbit] remote/commandline Acknowledge Alerts and Henrik answered quite right like anytime :-) but this works only, if i know the id of the event, in our situation i needed it before the event(s) started .. :-( they don't want to got 5 or more mails for only one machine ( by ca. 50 or more machines) ... So, we've played somthing around with Duration,Recovered .. Now i've got two mails for Conn ( RED & Recovered) and one for cpu ( Yellow for reboot) ... we can reduce them to only two mails of course ( deactivate the Recovered for Conn or make an higher Duration for the cpu-reboot-mail) ... My Question is, if there still exist an intelligent extra mailscript or something else which look at the conn-condition and if it's bad, it doesn't send any alarm for all other services only for conn .... Thanks & cheers Martin

2 4

At a glance trends
by josh＠imaginenetworksllc.com 17 Apr '09

17 Apr '09

Does anyone use a summary page of graphs for multiple servers to combine all of the graphs of all of their servers to have a quick at-a-glance for everything? I am interested in seeing any examples or ideas if they are out there. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 Those who don't understand UNIX are condemned to reinvent it, poorly. --- Henry Spencer

4 4

Hobbit testing for VMWare ESX system
by rdeal＠jcvi.org 16 Apr '09

16 Apr '09

Has anyone worked up a nice test for VMWare ESX server. I would like to get stats on the physical host. I have been testing and porting a script from deadcat : http://www.deadcat.net/viewfile.php?fileid=1048 I have it putting the memory and disk info into a format that Xymon will graph and it lists the VMs running. But no cpu info is given. Is everyone just using hobbit client locally on the ESX server configured to use esxtop?

4 3

xymon-4.2.2 and rrdtoolrpm problem
by pankaj.dorlikar＠gmail.com 16 Apr '09

16 Apr '09

i am installing xymon-4.2.2 server .while running ./configure,it says fallowing - Checking for RRDtool ... RRDtool include- or library-files not found. These are REQUIRED for hobbitd RRDtool can be found at http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/ If you have RRDtool installed, use the "--rrdinclude DIR" and "--rrdlib DIR" options to configure to specify where they are. but i have rpm 0f rrdtool 1.2.3 installed by using rpm -ivh "rpmname".. rpm -qil gives /usr/bin/rrdcgi /usr/bin/rrdtool /usr/bin/rrdupdate /usr/lib/librrd.so.2 /usr/lib/librrd.so.2.0.10 /usr/lib/librrd_th.so.2 /usr/lib/librrd_th.so.2.0.8 /usr/lib/perl5 /usr/lib/perl5/vendor_perl /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.8/RRDp.pm /usr/lib64/perl5 /usr/lib64/perl5/5.8.8 /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl /usr/lib64/perl5/vendor_perl/5.8.8 /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/RRDs.pm /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDp /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDs /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDs/RRDs.so ... help me.. -- Pankaj V. Dorlikar

5 4

More Rhel5 issues
by bcatlin＠gmail.com 16 Apr '09

16 Apr '09

As some may remember from my ldap question (never worked btw - reverted back to htaccess until I can get more time to work on it) I have a RHEL 5.2 server with Xymon 4.3.2 server/client installed. The server has openssh v 4.3p2 (part of the security app, not separate install). The problem is the ssh test - when run - it causes a log entry in /var/log/messages on exit: sshd[#####]: Connection closed by unknown Did some playing around with the services conf and adding --DNS="IP" in the hobbitserver.conf for the bbtest-net call Ran the test strings by hand via telnet FQN 22. Pasted the send string in and it sent back all the encryption it can support As this is testing the ssh, why not specify that the hobbit account should have ssh set up to each client and the server, then test with an actual ssh call: ssh <server> cat <some known file> Or just send an ssh -V and parse the string for what you need. (this is known as an ssh exec in the security world) Seems to me that if a server responds to an ssh request properly, then the sshd is running. You could even send ps -ef | grep sshd to see if its running. To test this way ensures that the protocol is actually usable, not just running. (A really HUGE difference!!!) Lastly, and best of all - this won't create weird error messages. In the meantime - any ideas on how to get rid of this error when running the ssh test? Thanks Brian lurch at inorbit.com

1 0

BBWin Messages | Filter Security
by MFisher＠hra.com 14 Apr '09

14 Apr '09

Hi For the life of me i cant figure out how to block certain 529 windows security failure errors for specific users. In the documentation it states to use the "USER" attribute but this only works if the user is mentioned in the user field of the error log. If it mentions "NT AUTHORITY\SYSTEM", is it not possible to restrict it based on the user? Example: security: failure - 2009/04/13 17:40:55 - Security (529) - NT AUTHORITY\SYSTEM "Logon Failure: Reason: Unknown user name or bad password User Name: John1234 Domain: CONTOSO Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: \\123.45.67.89 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited The username is "NT AUTHORITY\SYSTEM" but the actualy user is "John1234".. Anybody have and ideas? I dont want to block "NT AUTHORITY\SYSTEM".

1 1

[hobbit] RE: Troubleshooting Alerts -- Having Problems
by jkwade＠futurefrontiers.com 14 Apr '09

14 Apr '09

So, I tried this in hobbit-alerts.cfg MAIL os-primary-pager FORMAT=sms REPEAT=15 COLOR=RED DURATION>5m DURATION<35 RECOVERED The notifications log said it was sent to the phone. (os-primary-pager is in the mail aliases file) However, the phone never received the messages. Prior to putting in the FORMAT=sms, it sent pages fine. Thanks...James

1 0