September 2009 - Xymon - Xymon mailman web

Yellow on hobbitd on XYMON
by d.tom.schmitt＠L-3com.com 21 Sep '09

21 Sep '09

I have checked the exclamation mark on the XYMON server under the 'hobbitd' service. It shows HISTORY: Uptime Message counts Etc. Then at the end it shows: Latest error messages: Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Hostname 'SLTST03' in tree, but no host-info Also, for some reason, I am not getting the graphs anymore: Box with an X and the message "hobbitgraph hobbit" Here is the line in bb-hosts: 128.170.28.134 sltst03.csw.L-3com.com # conn What does it mean ' but no host-info'? Is it triggering that the graphs are not working? Not sure how to fix this but I definitely need to get the graphs back. Restarting and rebooting do not do it. Thanks, Tom Schmitt Senior IT Staff - R&D L-3 Communication Systems West 640 North 2200 West P.O. Box 16850 Salt Lake City, UT 84116 Phone (801) 594-3030 Cell (801) 231-7230 eFax (413) 480-6873 D.Tom.Schmitt at L-3Com.com I can explain it for you, but I can't understand it for you. Anonymous Think Green! Please print only what is necessary!

2 1

Paging Question
by novosirj＠umdnj.edu 21 Sep '09

21 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does anyone know on what host the hobbit-alert.cfg should exist? Should it be the same host as the machine that has "bbpage" running on it or "bbdisplay" or both (in my case, these are not the same server)? I notice that my configuration does not display the alerts on the "info" test of a server that I've configured to have alerts. Maybe it needs to be in both places? - -- ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqz9i4ACgkQmb+gadEcsb5mlwCgzNhq+54x/d19XF2L3dPdUK0g bWQAn2nMl9Zmk+ZIXf52bfQyQAjQ0ZM9 =CUb+ -----END PGP SIGNATURE-----

3 4

RSS display disabled hosts
by stella＠rider.edu 21 Sep '09

21 Sep '09

Hello, Trying to create some rss pages that I wish to display offline status. I added --rsslimit=blue however the status displayed on the rss file is the actual status of the test. For example if I have a test that would display red, but I disabled the host completely, the rss status shows the red condition. Also, If the host is green, but I disabled the host, the rss status shows green (no critical alerts). Any ideas on how to go around this? TIA.

2 2

Xymon flooding itself
by wshart＠hormel.com 21 Sep '09

21 Sep '09

I've done some searching and I haven't figured out what is going on here. I worked on the server a bit getting bb-xsnmp working on our old APCs again and a little work with DevMon on Friday. Machine ran fine through the middle of the day yesterday. I've turned off DevMon now to see if that helps, but it doesn't seem to be helping. I checked the logs and nothing is jumping out at me there. I did find some malformed downtime definitions and cleared those up, but again I don't think that's related. This is a VM running CentOS. Here's the hobbitd page : Statistics for Hobbit daemon Up since 21-Sep-2009 09:50:49 (0 days, 00:50:01) Incoming messages : 55178 - status : 41342 - combo : 3424 - page : 0 - summary : 0 - data : 6964 - client : 3298 - notes : 0 - enable : 0 - disable : 0 - ack : 0 - config : 0 - query : 40 - hobbitdboard : 60 - hobbitdlog : 39 - drop : 1 - rename : 0 - dummy : 10 - ping : 0 - notify : 0 - schedule : 0 - download : 0 - Bogus/Timeouts : 0 Incoming messages/sec : 18 (average last 300 seconds) status channel messages: 41372 (1 readers) stachg channel messages: 4301 (1 readers) page channel messages: 560 (1 readers) data channel messages: 6965 (1 readers) notes channel messages: 0 (0 readers) enadis channel messages: 0 (0 readers) client channel messages: 3295 (1 readers) clichg channel messages: 12 (1 readers) Latest errormessages: Data flooding from 172.16.40.194, closing connection If anyone has any pointers on where to look for this I'd really appreciate it. Thanks, Bill Hart Technical Services Associate Systems Programmer Notice: This communication is an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. � 2510. Its disclosure is strictly limited to the recipient(s) intended by the sender of this message. This transmission and any attachments may contain proprietary, confidential, attorney-client privileged information and/or attorney work product. If you are not the intended recipient, any disclosure, copying, distribution, reliance on, or use of any of the information contained herein is STRICTLY PROHIBITED. Please destroy the original transmission and its attachments without reading or saving in any matter and confirm by return email.

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Yes, that's a start. Thanks, camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 3:56 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Wouldn't that work for you at least at this point? On 9/18/09, Ryan Novosielski <novosirj at umdnj.edu> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > "." is a single character. > > Josh Luthman wrote: >> I thought it was a dot from the example from help. >> >> Josh Luthman >> Office: 937-552-2340 >> Direct: 937-552-2343 >> 1100 Wayne St >> Suite 1337 >> Troy, OH 45373 >> >> "When you have eliminated the impossible, that which remains, however >> improbable, must be the truth." >> --- Sir Arthur Conan Doyle >> >> >> On Fri, Sep 18, 2009 at 3:08 PM, Greg Hubbard <glh.forums at gmail.com >> <mailto:glh.forums at gmail.com>> wrote: >> >> Yes -- you only need one % at the beginning of your string to tell >> Xymon you are going to use a regular expression. You do not need >> the other % unless they are expected to appear in the log. >> >> When using a regular expression, the | character means "or". So if >> your example will "fire" if any message contains and of those >> words. Also you seem to be using * by itself, which means "match >> the preceding 0 or more times". Normally we use "dot star" ".*" to >> mean "match anything no matter how long." >> >> Regular expressions are a bit of a mystery, but are very powerful. >> Xymon uses Perl-compatible regular expressons (PCRE) so you might be >> able to Google some examples. >> >> If you are searching for "Out of memory" in a log file, you can use >> "%Out of memory" as your regex string. I do not remember how you >> deal with spaces in the string and the Xymon help is not helpful. >> One way to do it would be to change your spaces into \s+ so it would >> be %Out\s+of\s+memory which removes the embedded spaces (so the >> Xymon parser does not think part of your regex is some other token >> on the commend) and also means that you will match of the is at >> least one whitespace character between each word -- slightly more >> robust than using a single space. >> >> I know the above is a jumble, but if you will post the exact string >> you want to match we can help you create the matching expression to >> help you get the hang of it. >> >> GLH >> >> On 9/18/09, *Camelia Anghel* <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> Right now looks like this: >> >> >> >> LOG /var/log/messages >> %failure*|%failed*|%error*|%Warning*|%memory* Color=Red >> >> >> >> But if I type >> >> LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out >> of memory* Color=Red >> >> >> >> I'm getting all the messages that have one of these words: out >> or of or memory somewhere in their string. >> >> >> >> Camelia >> >> -----Original Message----- >> *From:* Greg Hubbard [mailto:glh.forums at gmail.com >> <mailto:glh.forums at gmail.com>] >> *Sent**:* Friday, September 18, 2009 1:25 PM >> *To:* hobbit at hswn.dk <mailto:hobbit at hswn.dk> >> *Subject:* Re: [hobbit] how to search for exact word patterns >> >> >> >> Try making it a regex (with % prefix) instead of "simple" >> expression. >> >> On 9/18/09, *Camelia Anghel* <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> Did that but it look for all messages that have one of the 3 words >> >> Thanks anyway >> >> Camelia >> >> >> >> -----Original Message----- >> *From:* Josh Luthman [mailto:josh at imaginenetworksllc.com >> <mailto:josh at imaginenetworksllc.com>] >> *Sent:* Friday, September 18, 2009 11:22 AM >> *To:* hobbit at hswn.dk <mailto:hobbit at hswn.dk> >> *Subject:* Re: [hobbit] how to search for exact word patterns >> >> >> >> I think it's: >> >> HOST=my.host.com <http://my.host.com/> >> LOG /var/log/messages "out of memory" COLOR=red >> >> Not tested. >> >> Josh Luthman >> Office: 937-552-2340 >> Direct: 937-552-2343 >> 1100 Wayne St >> Suite 1337 >> Troy, OH 45373 >> >> "When you have eliminated the impossible, that which remains, >> however improbable, must be the truth." >> --- Sir Arthur Conan Doyle >> >> On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> >> Hello all, >> I am trying to set up an alert to search for exact word patterns >> in >> /var/log/messages. For example: "Out of Memory" >> >> Any help would be appreciated. >> >> Thanks, >> Camelia >> >> To unsubscribe from the hobbit list, send an e-mail to >> hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk> >> >> >> >> >> >> >> -- >> Disclaimer: 1) all opinions are my own, 2) I may be completely >> wrong, 3) my advice is worth at least as much as what you are >> paying for it, or your money cheerfully refunded. >> >> >> >> >> -- >> Disclaimer: 1) all opinions are my own, 2) I may be completely >> wrong, 3) my advice is worth at least as much as what you are paying >> for it, or your money cheerfully refunded. >> >> > > > - -- > ---- _ _ _ _ ___ _ _ _ > |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II > |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) > \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.9 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iEYEARECAAYFAkqz5OQACgkQmb+gadEcsb6/AQCeMHINp1FT58/yxJhGDV9jjDYf > 2UQAoJOd++iahFVlFX1RNwrgarLQ03lT > =0XEa > -----END PGP SIGNATURE----- > > > -- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Hello Greg, I did not have too much exposure to Pearl, but I'll learn. I'll start testing and let you know if I need more help. Thank you, Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 3:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log. When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long." Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples. If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space. I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it. GLH On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 18 Sep '09

18 Sep '09

Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

4 4

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 18 Sep '09

18 Sep '09

Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 2

compellent SAN monitoring
by P.vanEldijk＠uci.ru.nl 18 Sep '09

18 Sep '09

Does anybody have an example/working script for monitoring compellents SAN system? regards, Paul

3 6

[hobbit] Questions about migrating from BB
by bgmilne＠staff.telkomsa.net 18 Sep '09

18 Sep '09

----- "Ryan Novosielski" <novosirj at umdnj.edu> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Greg Hubbard wrote: > > The CLIENT tag is used to tell the Xymon server how the incoming > client > > data will be tagged. You use this when your Xymon agent and the > Xymon > > server do not agree on which name to use -- usually because one of > the > > entries has FQDN and the other does not. This is the "cheap fix" > for > > "ghost" clients -- see the ghost report. > > That's what I figured. On Solaris, it seems I run into this on all of > the hosts. uname -n always seems to return a short name. In fact, it > does not appear as if Solaris has much of a concept of a domain name, bgmilne at merga.ourdomain.com > uname -n merga.ourdomain.com bgmilne at merga.ourdomain.com > hostname merga.telkomsa.net bgmilne at merga.ourdomain.com > uname -a SunOS merga.ourdomain.com 5.9 Generic_117171-07 sun4u sparc SUNW,Sun-Fire-V210 (Of course, don't try 'hostname -d'). > and I can't figure if I'm supposed to keep the full name as the > hostname > or not. Hasn't seemed to matter. > > > Some of the columns you are talking about (bbgen, hobbitd, etc.) > are > > implicit tests that are run no matter what on the Xymon server. > Xymon > > inherits a lot of the BB communications architecture but extends it > in > > many ways. The BBDISPLAY machine(s) will have "bbgen" tests -- this > is > > what creates the Web pages. The Xymon server will have the > "hobbitd" > > test -- this is what processes incoming data from Xymon clients. > BBNET > > machines will have the "bbtest" column -- this shows how network > tests > > are working. > > They were missing, but apparently what happened is that at least the > "bbgen" tests were going into the bit running with a misspelled name, > so > at least I know what is going on with them now. I guess these are > "client" tests on a Xymon server. > > > On a simple environment (the only kind I know) you will have all > three > > of these on your Xymon server and not on anything else. My *guess* > is > > that if you know how to break up BBDISPLY and BBNET you might see > > different tests associated with each host. > > Apparently not, and in my opinion, this is somewhat broken, unless > I'm > misconfiguring something. Xymon appears to only have one notion of a > "server." If you're running a network test machine, it asks you for > your > server name (example pasted): > > BBSERVERHOSTNAME="xymon.umdnj.edu" # The hostname of > your > server > BBSERVERIP="130.219.34.102" # The IP-address of > your > server. Use the real one, not 127.0.0.1 . > BBSERVEROS="sunos" # The operating system of > your > server. linux,freebsd,solaris,hpux,aix,osf > > The "bbtest" test, with a solely "BBNET" machine configured this way, > appears as if it comes from the "BBNET" machine (status message > received > from IP is the "BBNET" machine), but the test shows up under whatever > server name is defined in those above variables in hobbitserver.cfg. You only set *one* of those, BBSERVERHOSTNAME, which it uses in the status message, which it sends to BBSERVERIP. See e.g. line 2321 of bbnet/bbtest-net.c sprintf(msgline, "status %s.%s %s %s\n\n", xgetenv("MACHINE"), egocolumn, colorname(color), timestamp); (In lib/environ.c, MACHINE is created from MACHINEDOTS if MACHINE does not exist, and by default MACHINEDOTS=$BBSERVERHOSTNAME in hobbitserver.cfg). I guess the descriptions of BBSERVERHOSTNAME and BBSERVERIP could be improved in hobbitserver.cfg and hobbitserver.cfg(5), and BBSERVERHOSTNAME could possibly default to the machine's hostname instead ... BBSERVERHOSTNAME is the name of the host running that instance of xymon as you would like it to be displayed in any messages about the xymon processes, and BBSEVERIP is the IP of the Xymon server (hobbitd or bbproxy) to which all status messages should be sent. I might be able to fix some of these issues in future. > If > you set that server name to the name of the BBNET machine, as I > expected > I was supposed to do initially, you get "connection refused" errors, > as > it tries to connect to itself and cannot as it's not running the > server > component that listens on the port. > > I'm starting to believe that while you CAN separate the BBNET and > BBDISPLAY nodes with Xymon, no one is really doing it and it doesn't > work that cleanly. I've been doing it since hobbit-4.1.0, and I have had no problems (with more complex setups including bbproxy to have a staged migration from bb). Regards, Buchan

3 2