September 2009 - Xymon - Xymon mailman web

FW: [hobbit] Yellow on hobbitd on XYMON
by novosirj＠umdnj.edu 22 Sep '09

22 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please keep replies on the list. There are no logs at all, or just nothing relevant in them? Ghost clients are clients that are sending data to the server but the server doesn't know who they are (eg. they don't match bb-hosts). You can get a "Ghost Client Report" under the reports menu on the website. d.tom.schmitt at L-3com.com wrote: > No log files on server: data/logs and client/logs > > What are ghost clients? > > Thanks > Tom > (801) 594-3030 > > -----Original Message----- > From: Ryan Novosielski [mailto:novosirj at umdnj.edu] > Sent: Monday, September 21, 2009 11:13 AM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Yellow on hobbitd on XYMON > > * PGP Signed by an unknown key > > Anything in the logs directory about any of this? Any "ghost" clients? > > d.tom.schmitt at L-3com.com wrote: > > <snip> > >> Hostname 'SLTST03' in tree, but no host-info >> >> >> >> Also, for some reason, I am not getting the graphs anymore: >> >> Box with an X and the message “hobbitgraph hobbit” >> >> >> >> Here is the line in bb-hosts: >> >> 128.170.28.134 sltst03.csw.L-3com.com >> # conn >> >> >> >> What does it mean ‘ but no host-info’? >> >> >> >> Is it triggering that the graphs are not working? Not sure how to fix >> this but I definitely need to get the graphs back. >> >> Restarting and rebooting do not do it. >> > > > -- > ---- _ _ _ _ ___ _ _ _ > |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 > > * Unknown Key > * 0xD11CB1BE(L) > > > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.409 / Virus Database: 270.13.110/2385 - Release Date: 09/21/09 05:51:00 - -- ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkq3yx0ACgkQmb+gadEcsb7dbQCfYpgWEcIQ5wq/ssZxfvpo9OqY /nUAn0hMxv86lx/oQ8cIxegzfVKvwAXt =dQ7h -----END PGP SIGNATURE-----

3 4

Hobbit dependencies and/or route statement???
by d.tom.schmitt＠L-3com.com 21 Sep '09

21 Sep '09

I have been trying to setup dependencies: I want to have only one alert from the 116 switch if all 3 go down - simulation of losing a router/link: I don't want alerts from the 117 and 118 switches unless they go down independently. FIRST try using 'depends': I have three old Linksys switches setup on a smaller switch attached to the network. I created the following bb-hosts entries: 128.170.41.116 Linksys-116 # conn 128.170.41.117 Linksys-117 # depends=(conn:Linksys-116/conn) 128.170.41.118 Linksys-118 # depends=(conn:Linksys-116/conn) RESULT: If I disconnect all switches, all turn RED and all alert If one goes down it shows RED and alerts SECOND try using 'route'" 128.170.41.116 Linksys-116 # conn 128.170.41.117 Linksys-117 # route:128.170.41.116 128.170.41.118 Linksys-118 # route:128.170.41.116 RESULT: Same as depends, no difference These are the entries in the hobbit-alerts.cfg file: HOST=Linksys-116 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com HOST=Linksys-117 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com HOST=Linksys-118 SERVICE=conn REPEAT=4d RECOVERED MAIL D.Tom.Schmitt at L-3Com.com I must not be understanding how to make a dependency structure work? I am running XYMON 4.3.0-0.beta2. Thanks, Tom Schmitt Senior IT Staff - R&D Phone (801) 594-3030

3 2

Bertrand ORCIBAL/EXT/TLSE/GPA/CHEM/Corp est absent(e).
by bertrand.orcibal＠gpn.fr 21 Sep '09

21 Sep '09

Je serai absent(e) du 21/09/2009 au 24/09/2009. Veuillez contacter : L'Equipe Exploitation http://pac/ ou 135 ou 05.34.50.21.00 Exploit-DSI.Toulouse at gpn.fr

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Greg, That worked!!! Thanks a lot! Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 3:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log. When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long." Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples. If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space. I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it. GLH On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

3 3

[hobbit] bb-prtdiag.sh - Sun SPARC Enterprise M9000 Server
by Craig.Cook＠carquest.com 21 Sep '09

21 Sep '09

What happens when you do something like this? $HOBBIT/client/bin/bbcmd --env=$HOBBIT/client/etc/hobbitclient.cfg ./bb-prtdiag.sh ./v120 UltraAX-i2 Where "v120" is the contents of /usr/sbin/lom -pfvt Also, what does " uname -i " produce? Craig

1 0

how to increase status update rate for xymon clients and server so as to accurate current status
by pankaj.dorlikar＠gmail.com 21 Sep '09

21 Sep '09

how to increase status update rate for xymon clients and server so as to accurate current status.i have xymon 4.2.2 and clients are over 200 -- Pankaj V. Dorlikar

2 1

Yellow on hobbitd on XYMON
by d.tom.schmitt＠L-3com.com 21 Sep '09

21 Sep '09

I have checked the exclamation mark on the XYMON server under the 'hobbitd' service. It shows HISTORY: Uptime Message counts Etc. Then at the end it shows: Latest error messages: Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Also, for some reason, I am not getting the graphs anymore: Box with an X and the message "hobbitgraph hobbit" Here is the line in bb-hosts: 128.170.28.134 sltst03.csw.L-3com.com # conn What does it mean ' but no host-info'? Is it triggering that the graphs are not working? Not sure how to fix this but I definitely need to get the graphs back. Restarting and rebooting do not do it. Thanks, Tom Schmitt Senior IT Staff - R&D L-3 Communication Systems West 640 North 2200 West P.O. Box 16850 Salt Lake City, UT 84116 Phone (801) 594-3030 Cell (801) 231-7230 eFax (413) 480-6873 D.Tom.Schmitt at L-3Com.com I can explain it for you, but I can't understand it for you. Anonymous Think Green! Please print only what is necessary!

2 1

Paging Question
by novosirj＠umdnj.edu 21 Sep '09

21 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does anyone know on what host the hobbit-alert.cfg should exist? Should it be the same host as the machine that has "bbpage" running on it or "bbdisplay" or both (in my case, these are not the same server)? I notice that my configuration does not display the alerts on the "info" test of a server that I've configured to have alerts. Maybe it needs to be in both places? - -- ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqz9i4ACgkQmb+gadEcsb5mlwCgzNhq+54x/d19XF2L3dPdUK0g bWQAn2nMl9Zmk+ZIXf52bfQyQAjQ0ZM9 =CUb+ -----END PGP SIGNATURE-----

3 4

RSS display disabled hosts
by stella＠rider.edu 21 Sep '09

21 Sep '09

Hello, Trying to create some rss pages that I wish to display offline status. I added --rsslimit=blue however the status displayed on the rss file is the actual status of the test. For example if I have a test that would display red, but I disabled the host completely, the rss status shows the red condition. Also, If the host is green, but I disabled the host, the rss status shows green (no critical alerts). Any ideas on how to go around this? TIA.

2 2

Xymon flooding itself
by wshart＠hormel.com 21 Sep '09

21 Sep '09

I've done some searching and I haven't figured out what is going on here. I worked on the server a bit getting bb-xsnmp working on our old APCs again and a little work with DevMon on Friday. Machine ran fine through the middle of the day yesterday. I've turned off DevMon now to see if that helps, but it doesn't seem to be helping. I checked the logs and nothing is jumping out at me there. I did find some malformed downtime definitions and cleared those up, but again I don't think that's related. This is a VM running CentOS. Here's the hobbitd page : Statistics for Hobbit daemon Up since 21-Sep-2009 09:50:49 (0 days, 00:50:01) Incoming messages : 55178 - status : 41342 - combo : 3424 - page : 0 - summary : 0 - data : 6964 - client : 3298 - notes : 0 - enable : 0 - disable : 0 - ack : 0 - config : 0 - query : 40 - hobbitdboard : 60 - hobbitdlog : 39 - drop : 1 - rename : 0 - dummy : 10 - ping : 0 - notify : 0 - schedule : 0 - download : 0 - Bogus/Timeouts : 0 Incoming messages/sec : 18 (average last 300 seconds) status channel messages: 41372 (1 readers) stachg channel messages: 4301 (1 readers) page channel messages: 560 (1 readers) data channel messages: 6965 (1 readers) notes channel messages: 0 (0 readers) enadis channel messages: 0 (0 readers) client channel messages: 3295 (1 readers) clichg channel messages: 12 (1 readers) Latest errormessages: Data flooding from 172.16.40.194, closing connection If anyone has any pointers on where to look for this I'd really appreciate it. Thanks, Bill Hart Technical Services Associate Systems Programmer Notice: This communication is an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. � 2510. Its disclosure is strictly limited to the recipient(s) intended by the sender of this message. This transmission and any attachments may contain proprietary, confidential, attorney-client privileged information and/or attorney work product. If you are not the intended recipient, any disclosure, copying, distribution, reliance on, or use of any of the information contained herein is STRICTLY PROHIBITED. Please destroy the original transmission and its attachments without reading or saving in any matter and confirm by return email.

1 0