September 2009 - Xymon - Xymon mailman web

FIXED: Fix for XYMON graphs missing (rrdtool)
by d.tom.schmitt＠L-3com.com 23 Sep '09

23 Sep '09

Last week I placed a message that the graphs at the bottom of the screens were not available. Working with one of my co-workers, he found the message was from rrdtool in the system log file. This is running on CentOS 5.x: I do an automatic 'yum' update each night and the librrd file was updated but the rrdtool system was looking for an older version. This is a company requirement to stay current on patching. He linked the older filenames to the newer filenames and the graphs are now working. Thanks, Tom Schmitt Senior IT Staff - R&D Phone (801) 594-3030

1 0

DNS Test - No Record Lookup
by MFisher＠hra.com 23 Sep '09

23 Sep '09

Hi, I have configured one of my DNS servers to run the dns test native to xymon. I have the directive "dns" specified in the bb-hosts file and the test shows up as a column however the test does NOT perform a lookup of the servers dns A record as it should. All i get is the "Service DNS on SERVER.DOMAIN.COM is OK (up) and then a graph immediately below. I have also tired using the dns=a:server.domain.com with no luck either. I have posted a screen shot on PhotoBucket - http://i761.photobucket.com/albums/xx256/mfisher_xymon/dns.jpg Does anybody have any insight as to why the dns lookups are not being ran?

3 4

[hobbit] DNS Test - No Record Lookup
by Craig.Cook＠carquest.com 23 Sep '09

23 Sep '09

Can you post your bb-hosts line? What happens when you do something like this: dig @dns_server_in_question.example.com dns_server_in_question.example.com Craig

2 1

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 23 Sep '09

23 Sep '09

Sorry I was off yesterday... Here it goes, I tested first for string "session opened for user root" and here is how the log entry looks like in the hobbit-clients.cfg for one of client servers LOG /var/log/messages %failure*|failed*|error*|Warning*|session\s+opened\s+for\s+user\s+root*| Out\s+of\s+Memory* COLOR=red GROUP=admin Thanks, Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Monday, September 21, 2009 4:08 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Could you post your working config, please? Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Mon, Sep 21, 2009 at 3:00 PM, Camelia Anghel <canghel at cjh.org> wrote: Greg, That worked!!! Thanks a lot! Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 3:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log. When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long." Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples. If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space. I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it. GLH On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

1 0

FW: [hobbit] Yellow on hobbitd on XYMON
by novosirj＠umdnj.edu 22 Sep '09

22 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please keep replies on the list. There are no logs at all, or just nothing relevant in them? Ghost clients are clients that are sending data to the server but the server doesn't know who they are (eg. they don't match bb-hosts). You can get a "Ghost Client Report" under the reports menu on the website. d.tom.schmitt at L-3com.com wrote: > No log files on server: data/logs and client/logs > > What are ghost clients? > > Thanks > Tom > (801) 594-3030 > > -----Original Message----- > From: Ryan Novosielski [mailto:novosirj at umdnj.edu] > Sent: Monday, September 21, 2009 11:13 AM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Yellow on hobbitd on XYMON > > * PGP Signed by an unknown key > > Anything in the logs directory about any of this? Any "ghost" clients? > > d.tom.schmitt at L-3com.com wrote: > > <snip> > >> Hostname 'SLTST03' in tree, but no host-info >> >> >> >> Also, for some reason, I am not getting the graphs anymore: >> >> Box with an X and the message “hobbitgraph hobbit” >> >> >> >> Here is the line in bb-hosts: >> >> 128.170.28.134 sltst03.csw.L-3com.com >> # conn >> >> >> >> What does it mean ‘ but no host-info’? >> >> >> >> Is it triggering that the graphs are not working? Not sure how to fix >> this but I definitely need to get the graphs back. >> >> Restarting and rebooting do not do it. >> > > > -- > ---- _ _ _ _ ___ _ _ _ > |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 > > * Unknown Key > * 0xD11CB1BE(L) > > > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.409 / Virus Database: 270.13.110/2385 - Release Date: 09/21/09 05:51:00 - -- ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkq3yx0ACgkQmb+gadEcsb7dbQCfYpgWEcIQ5wq/ssZxfvpo9OqY /nUAn0hMxv86lx/oQ8cIxegzfVKvwAXt =dQ7h -----END PGP SIGNATURE-----

3 4

Hobbit dependencies and/or route statement???
by d.tom.schmitt＠L-3com.com 21 Sep '09

21 Sep '09

I have been trying to setup dependencies: I want to have only one alert from the 116 switch if all 3 go down - simulation of losing a router/link: I don't want alerts from the 117 and 118 switches unless they go down independently. FIRST try using 'depends': I have three old Linksys switches setup on a smaller switch attached to the network. I created the following bb-hosts entries: 128.170.41.116 Linksys-116 # conn 128.170.41.117 Linksys-117 # depends=(conn:Linksys-116/conn) 128.170.41.118 Linksys-118 # depends=(conn:Linksys-116/conn) RESULT: If I disconnect all switches, all turn RED and all alert If one goes down it shows RED and alerts SECOND try using 'route'" 128.170.41.116 Linksys-116 # conn 128.170.41.117 Linksys-117 # route:128.170.41.116 128.170.41.118 Linksys-118 # route:128.170.41.116 RESULT: Same as depends, no difference These are the entries in the hobbit-alerts.cfg file: HOST=Linksys-116 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com HOST=Linksys-117 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com HOST=Linksys-118 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com I must not be understanding how to make a dependency structure work? I am running XYMON 4.3.0-0.beta2. Thanks, Tom Schmitt Senior IT Staff - R&D Phone (801) 594-3030

3 2

Bertrand ORCIBAL/EXT/TLSE/GPA/CHEM/Corp est absent(e).
by bertrand.orcibal＠gpn.fr 21 Sep '09

21 Sep '09

Je serai absent(e) du 21/09/2009 au 24/09/2009. Veuillez contacter : L'Equipe Exploitation http://pac/ ou 135 ou 05.34.50.21.00 Exploit-DSI.Toulouse at gpn.fr

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Greg, That worked!!! Thanks a lot! Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 3:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log. When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long." Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples. If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space. I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it. GLH On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

3 3

[hobbit] bb-prtdiag.sh - Sun SPARC Enterprise M9000 Server
by Craig.Cook＠carquest.com 21 Sep '09

21 Sep '09

What happens when you do something like this? $HOBBIT/client/bin/bbcmd --env=$HOBBIT/client/etc/hobbitclient.cfg ./bb-prtdiag.sh ./v120 UltraAX-i2 Where "v120" is the contents of /usr/sbin/lom -pfvt Also, what does " uname -i " produce? Craig

1 0

how to increase status update rate for xymon clients and server so as to accurate current status
by pankaj.dorlikar＠gmail.com 21 Sep '09

21 Sep '09

how to increase status update rate for xymon clients and server so as to accurate current status.i have xymon 4.2.2 and clients are over 200 -- Pankaj V. Dorlikar

2 1