September 2009 - Xymon - Xymon mailman web

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Yes, that's a start. Thanks, camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 3:56 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Wouldn't that work for you at least at this point? On 9/18/09, Ryan Novosielski <novosirj at umdnj.edu> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > "." is a single character. > > Josh Luthman wrote: >> I thought it was a dot from the example from help. >> >> Josh Luthman >> Office: 937-552-2340 >> Direct: 937-552-2343 >> 1100 Wayne St >> Suite 1337 >> Troy, OH 45373 >> >> "When you have eliminated the impossible, that which remains, however >> improbable, must be the truth." >> --- Sir Arthur Conan Doyle >> >> >> On Fri, Sep 18, 2009 at 3:08 PM, Greg Hubbard <glh.forums at gmail.com >> <mailto:glh.forums at gmail.com>> wrote: >> >> Yes -- you only need one % at the beginning of your string to tell >> Xymon you are going to use a regular expression. You do not need >> the other % unless they are expected to appear in the log. >> >> When using a regular expression, the | character means "or". So if >> your example will "fire" if any message contains and of those >> words. Also you seem to be using * by itself, which means "match >> the preceding 0 or more times". Normally we use "dot star" ".*" to >> mean "match anything no matter how long." >> >> Regular expressions are a bit of a mystery, but are very powerful. >> Xymon uses Perl-compatible regular expressons (PCRE) so you might be >> able to Google some examples. >> >> If you are searching for "Out of memory" in a log file, you can use >> "%Out of memory" as your regex string. I do not remember how you >> deal with spaces in the string and the Xymon help is not helpful. >> One way to do it would be to change your spaces into \s+ so it would >> be %Out\s+of\s+memory which removes the embedded spaces (so the >> Xymon parser does not think part of your regex is some other token >> on the commend) and also means that you will match of the is at >> least one whitespace character between each word -- slightly more >> robust than using a single space. >> >> I know the above is a jumble, but if you will post the exact string >> you want to match we can help you create the matching expression to >> help you get the hang of it. >> >> GLH >> >> On 9/18/09, *Camelia Anghel* <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> Right now looks like this: >> >> >> >> LOG /var/log/messages >> %failure*|%failed*|%error*|%Warning*|%memory* Color=Red >> >> >> >> But if I type >> >> LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out >> of memory* Color=Red >> >> >> >> I'm getting all the messages that have one of these words: out >> or of or memory somewhere in their string. >> >> >> >> Camelia >> >> -----Original Message----- >> *From:* Greg Hubbard [mailto:glh.forums at gmail.com >> <mailto:glh.forums at gmail.com>] >> *Sent**:* Friday, September 18, 2009 1:25 PM >> *To:* hobbit at hswn.dk <mailto:hobbit at hswn.dk> >> *Subject:* Re: [hobbit] how to search for exact word patterns >> >> >> >> Try making it a regex (with % prefix) instead of "simple" >> expression. >> >> On 9/18/09, *Camelia Anghel* <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> Did that but it look for all messages that have one of the 3 words >> >> Thanks anyway >> >> Camelia >> >> >> >> -----Original Message----- >> *From:* Josh Luthman [mailto:josh at imaginenetworksllc.com >> <mailto:josh at imaginenetworksllc.com>] >> *Sent:* Friday, September 18, 2009 11:22 AM >> *To:* hobbit at hswn.dk <mailto:hobbit at hswn.dk> >> *Subject:* Re: [hobbit] how to search for exact word patterns >> >> >> >> I think it's: >> >> HOST=my.host.com <http://my.host.com/> >> LOG /var/log/messages "out of memory" COLOR=red >> >> Not tested. >> >> Josh Luthman >> Office: 937-552-2340 >> Direct: 937-552-2343 >> 1100 Wayne St >> Suite 1337 >> Troy, OH 45373 >> >> "When you have eliminated the impossible, that which remains, >> however improbable, must be the truth." >> --- Sir Arthur Conan Doyle >> >> On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org >> <mailto:canghel at cjh.org>> wrote: >> >> >> Hello all, >> I am trying to set up an alert to search for exact word patterns >> in >> /var/log/messages. For example: "Out of Memory" >> >> Any help would be appreciated. >> >> Thanks, >> Camelia >> >> To unsubscribe from the hobbit list, send an e-mail to >> hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk> >> >> >> >> >> >> >> -- >> Disclaimer: 1) all opinions are my own, 2) I may be completely >> wrong, 3) my advice is worth at least as much as what you are >> paying for it, or your money cheerfully refunded. >> >> >> >> >> -- >> Disclaimer: 1) all opinions are my own, 2) I may be completely >> wrong, 3) my advice is worth at least as much as what you are paying >> for it, or your money cheerfully refunded. >> >> > > > - -- > ---- _ _ _ _ ___ _ _ _ > |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II > |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) > \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.9 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iEYEARECAAYFAkqz5OQACgkQmb+gadEcsb6/AQCeMHINp1FT58/yxJhGDV9jjDYf > 2UQAoJOd++iahFVlFX1RNwrgarLQ03lT > =0XEa > -----END PGP SIGNATURE----- > > > -- Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 21 Sep '09

21 Sep '09

Hello Greg, I did not have too much exposure to Pearl, but I'll learn. I'll start testing and let you know if I need more help. Thank you, Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 3:09 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log. When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long." Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples. If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space. I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it. GLH On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

1 0

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 18 Sep '09

18 Sep '09

Right now looks like this: LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory* Color=Red But if I type LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red I'm getting all the messages that have one of these words: out or of or memory somewhere in their string. Camelia -----Original Message----- From: Greg Hubbard [mailto:glh.forums at gmail.com] Sent: Friday, September 18, 2009 1:25 PM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns Try making it a regex (with % prefix) instead of "simple" expression. On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com <http://my.host.com/> LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

4 4

[hobbit] how to search for exact word patterns
by canghel＠cjh.org 18 Sep '09

18 Sep '09

Did that but it look for all messages that have one of the 3 words Thanks anyway Camelia -----Original Message----- From: Josh Luthman [mailto:josh at imaginenetworksllc.com] Sent: Friday, September 18, 2009 11:22 AM To: hobbit at hswn.dk Subject: Re: [hobbit] how to search for exact word patterns I think it's: HOST=my.host.com LOG /var/log/messages "out of memory" COLOR=red Not tested. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 "When you have eliminated the impossible, that which remains, however improbable, must be the truth." --- Sir Arthur Conan Doyle On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote: Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 2

compellent SAN monitoring
by P.vanEldijk＠uci.ru.nl 18 Sep '09

18 Sep '09

Does anybody have an example/working script for monitoring compellents SAN system? regards, Paul

3 6

[hobbit] Questions about migrating from BB
by bgmilne＠staff.telkomsa.net 18 Sep '09

18 Sep '09

----- "Ryan Novosielski" <novosirj at umdnj.edu> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Greg Hubbard wrote: > > The CLIENT tag is used to tell the Xymon server how the incoming > client > > data will be tagged. You use this when your Xymon agent and the > Xymon > > server do not agree on which name to use -- usually because one of > the > > entries has FQDN and the other does not. This is the "cheap fix" > for > > "ghost" clients -- see the ghost report. > > That's what I figured. On Solaris, it seems I run into this on all of > the hosts. uname -n always seems to return a short name. In fact, it > does not appear as if Solaris has much of a concept of a domain name, bgmilne at merga.ourdomain.com > uname -n merga.ourdomain.com bgmilne at merga.ourdomain.com > hostname merga.telkomsa.net bgmilne at merga.ourdomain.com > uname -a SunOS merga.ourdomain.com 5.9 Generic_117171-07 sun4u sparc SUNW,Sun-Fire-V210 (Of course, don't try 'hostname -d'). > and I can't figure if I'm supposed to keep the full name as the > hostname > or not. Hasn't seemed to matter. > > > Some of the columns you are talking about (bbgen, hobbitd, etc.) > are > > implicit tests that are run no matter what on the Xymon server. > Xymon > > inherits a lot of the BB communications architecture but extends it > in > > many ways. The BBDISPLAY machine(s) will have "bbgen" tests -- this > is > > what creates the Web pages. The Xymon server will have the > "hobbitd" > > test -- this is what processes incoming data from Xymon clients. > BBNET > > machines will have the "bbtest" column -- this shows how network > tests > > are working. > > They were missing, but apparently what happened is that at least the > "bbgen" tests were going into the bit running with a misspelled name, > so > at least I know what is going on with them now. I guess these are > "client" tests on a Xymon server. > > > On a simple environment (the only kind I know) you will have all > three > > of these on your Xymon server and not on anything else. My *guess* > is > > that if you know how to break up BBDISPLY and BBNET you might see > > different tests associated with each host. > > Apparently not, and in my opinion, this is somewhat broken, unless > I'm > misconfiguring something. Xymon appears to only have one notion of a > "server." If you're running a network test machine, it asks you for > your > server name (example pasted): > > BBSERVERHOSTNAME="xymon.umdnj.edu" # The hostname of > your > server > BBSERVERIP="130.219.34.102" # The IP-address of > your > server. Use the real one, not 127.0.0.1 . > BBSERVEROS="sunos" # The operating system of > your > server. linux,freebsd,solaris,hpux,aix,osf > > The "bbtest" test, with a solely "BBNET" machine configured this way, > appears as if it comes from the "BBNET" machine (status message > received > from IP is the "BBNET" machine), but the test shows up under whatever > server name is defined in those above variables in hobbitserver.cfg. You only set *one* of those, BBSERVERHOSTNAME, which it uses in the status message, which it sends to BBSERVERIP. See e.g. line 2321 of bbnet/bbtest-net.c sprintf(msgline, "status %s.%s %s %s\n\n", xgetenv("MACHINE"), egocolumn, colorname(color), timestamp); (In lib/environ.c, MACHINE is created from MACHINEDOTS if MACHINE does not exist, and by default MACHINEDOTS=$BBSERVERHOSTNAME in hobbitserver.cfg). I guess the descriptions of BBSERVERHOSTNAME and BBSERVERIP could be improved in hobbitserver.cfg and hobbitserver.cfg(5), and BBSERVERHOSTNAME could possibly default to the machine's hostname instead ... BBSERVERHOSTNAME is the name of the host running that instance of xymon as you would like it to be displayed in any messages about the xymon processes, and BBSEVERIP is the IP of the Xymon server (hobbitd or bbproxy) to which all status messages should be sent. I might be able to fix some of these issues in future. > If > you set that server name to the name of the BBNET machine, as I > expected > I was supposed to do initially, you get "connection refused" errors, > as > it tries to connect to itself and cannot as it's not running the > server > component that listens on the port. > > I'm starting to believe that while you CAN separate the BBNET and > BBDISPLAY nodes with Xymon, no one is really doing it and it doesn't > work that cleanly. I've been doing it since hobbit-4.1.0, and I have had no problems (with more complex setups including bbproxy to have a staged migration from bb). Regards, Buchan

3 2

how to search for exact word patterns
by canghel＠cjh.org 18 Sep '09

18 Sep '09

Hello all, I am trying to set up an alert to search for exact word patterns in /var/log/messages. For example: "Out of Memory" Any help would be appreciated. Thanks, Camelia

2 1

Questions about migrating from BB
by novosirj＠umdnj.edu 17 Sep '09

17 Sep '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Good afternoon, I am new to this list and probably will be new to xymon shortly. I have currently installed it and am testing it out. My current BB system consists of a BBDISPLAY machine, and two BBNET machines. The two BBNET machines are on either sides of a firewall and are housed on two different Solaris 10 zones. I /think/ I know how to set this up, but there are some aspects of it that look like they might be irritating if there's no good answer for them: First off, my BBDISPLAY does no network monitoring. This looks as simple as setting DISABLE on the appropriate part of hobbitlaunch.cfg, so this seems pretty easy. Next, my network machines. I don't really want to have to install RRDTool on it. Is that really necessary? Isn't it only used for display, or is it also needed by a machine that only does network testing? It looks like then as far as splitting up which tests run from where, I can use BBLOCATION and NET:$BBLOCATION, but it appears as if this is by host, not by test. Any recommendations? Lastly, is there any concept of escalation in xymon as there is in BB? I wouldn't necessarily miss it, but I do currently use it. (Escalation is that no one can acknowledge a page in such a way that will keep it from reaching the escalated party, except that person). - -- ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Systems Programmer II |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/CST - NJMS Medical Science Bldg - C630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqxQ1kACgkQmb+gadEcsb7yIgCgz2wjg4Vgee7WM2Od8JLiXi2h IHQAoIXgx39Av0DEdcV6Y0lOLs7DPvio =h4MW -----END PGP SIGNATURE-----

3 11

Ack codes
by lebarber＠gmail.com 17 Sep '09

17 Sep '09

Is there a limit to how long Xymon/Hobbit will remember an ackcode? I had a situation this morning where a server, which had a disk test that had been alternating between yellow and red for months (I know, but I'm not in a position to force other adminstrators to be responsible) refuse an acknowledgement because "Cookie 611393 not found, dropping ack". If there is a limit to how long Hobbit will remember an ackcode, does anybody out there know what it is. Do they survive a Hobbit restart? Thanks, Larry Barber

2 1

[hobbit] UPS monitoring using devmon
by bgmilne＠staff.telkomsa.net 17 Sep '09

17 Sep '09

----- "David Baldwin" <david.baldwin at ausport.gov.au> wrote: > thorsten.erdmann at daimler.com wrote: > > 3. message test is yellow: "primary OID upsAlarmDescrTxt in table > is > > a non-repeater", I don't know how to solve that > Rest assured, when there IS an alarm, you will see them - I had 2 this > > morning. > > At the moment devmon doesn't handle empty repeaters well. I had some > discussions with Buchan a while ago. If this is the usual "many tests go clear when one test uses OIDs not available" issue, I think this patch should be an adequate fix. At least, it allows me to use the linux-netsnmp template (in svn) against my laptop, for which I haven't configured lmsensors, and get data for the working tests without disabling the 'temp' test. I would appreciate it if someone else could test this change as well, I haven't currently got access to that many affected devices. If it works for someone else, I will commit in svn. It might also be worthwhile logging an issue on the SF tracker. Regards, Buchan (I would also prefer to keep devmon topics on the devmon list ...) Index: modules/dm_snmp.pm =================================================================== --- modules/dm_snmp.pm (revision 150) +++ modules/dm_snmp.pm (working copy) @@ -554,10 +554,12 @@ my $snmp_err; do_log("DEBUG SNMP: $SNMP_Session::errmsg",0) if $g{'debug'}; ($snmp_err = $SNMP_Session::errmsg) =~ s/\n.*//s; - my $error_str = - "Error walking $oid for $dev ($snmp_err)"; - $data_out{'error'}{$error_str} = 0; - ++$failed_query; + if ($snmp_err ne '') { + my $error_str = + "Error walking $oid for $dev ($snmp_err)"; + $data_out{'error'}{$error_str} = 0; + ++$failed_query; + } } else { # Record our maxrep value for our next poll cycle

1 0