January 2010 - Xymon - Xymon mailman web

False Process Down Alerts
by chris.naude.0＠gmail.com 19 Jan '10

19 Jan '10

I'm run into a strange problem with my Xymon server. I noticed today that I'm receiving random false alerts for processes being down. When I look at the process list output in the alert it looks as if the data coming from the clients isn't correct. Here is an example. Has anyone seen anything like this? 9613 1944 root Jan 11 S 154 0.00 00:00:00 6128 cmclconfd -c 10389 1944 root Jan 11 S 154 0.00 00:00:00 6128 cmclconfd -c 9794 1 oracle 10:55:57 S 154 0.00 00:00:0 217600]oracleTEST (LOCAL=NO) 1592 1 oracle Jan 11 S 154 0.00 00:00:11 217136 ora_mman_TEST 12751 1944 root Jan 11 S 154 0.00 00:00:00 6128 cmclconfd -c 8965 1944 root Jan 11 S 154 0.00 00:00:00 6128 cmclconfd -c 11819 1 oracle Jan 12 S 154 0.00 00:00:07 217280 ora_j015_TEST 2711 1 roo ]ec 4 S 120 0.04 00:02:16 868 /usr/sbin/xntpd 3547 1 xymon Dec 4 S 168 0.00 00:00:43 268 /opt/xymon/client/bin/hobbitlaunch --config=/opt/xymon/client/etc/clientlaunch.cfg --log=/opt/xymon/client/logs/clientlaunch.log --pidfile=/opt/xymon/client/logs/clientlaunch.101.example.com.pid 3728 1 root Dec 4 R 152 0.00 00:00:37 4208 /usr/sbin/stm/uut/bin/tools/monitor/WbemWrapperMonitor Xymon version: 4.3.0-0.beta2 Xymon server: CentOS 5.4 32 bit Client: HP-UX 11.31 Itanium -- Chris Naude

6 10

Buffer client data until fetched / periodic synch
by steinarms＠gmail.com 18 Jan '10

18 Jan '10

Hi, I'm monitoring a few clients that are located with our hosting partner, and I'm pondering on how I can add to my monitoring customers that do their own hosting ( of our software ). The thing is they are behind a firewall that requires a manual routine to connect, so doing it automatically is out of the question so it rules out bbfetch/hobbitfetch. But I was wondering if I can setup a monitoring solution remotly in their data-senter, that I would be able to synch my local xymon server with and doing so get all the trends and messages that has been gathered since last synch ( not for alerts, just for historical reference ). So if I need to debug anything on their end, I can synch the monitoring and see when things started and how it escelated etc. Any one have anyrthing similar setup for them ? I'm currently running my clients/servers on version 4.2.3 Best Regards, Steinar M.

2 2

Oversize data/client problem
by gleonard＠progrexion.com 18 Jan '10

18 Jan '10

Hey all, I have a server that keeps growing on its msg's, every time I bump the thresholds for client data it takes a couple weeks but it's at the threshold again. Is there any obvious causes of this that I am missing? The server is a MySQL db server and has not been changed in the last couple months at all. -Gavin Gavin Leonard [cid:image001.gif at 01CA984F.0328E310] Director, Systems-Network Engineering T 801-828-1735 F 801-828-1704 E gleonard at progrexion.com<mailto:gleonard at progrexion.com> Research | Marketing | Sales Generation www.progrexion.com<http://www.progrexion.com/> This email and its contents are confidential. If you are not the intended recipient, delete this email and do not use or disclose the information within this email or its attachments. Thank you.

2 1

top-changes report
by rower.master＠gmail.com 18 Jan '10

18 Jan '10

Hi All, I'm using xymon 4.2.3 version and I would like to use the topchanges report from the 4.3.0 version without upgrade to this version. Has anyone know which files I have to copy after compile the 4.3.0 without install? It's possible to do this? Thanks in advance, Mario.

1 0

Working Remote Desktop (3389) bb-services connection check
by chrisw＠supranet.net 15 Jan '10

15 Jan '10

Hello, This morning a coworker and I did some work to add a "real" remote desktop connection check to Xymon. There are mailing list entries in the past that just connect to 3389 but generally this isn't sufficient. The test is simple, here's what goes into bb-services (the send line may wrap, it should be on one line and there is a space between "Cookie:" and "mstshash": [rdp] port 3389 send "\x03\x00\x00\x1e\x19\xe0\x00\x00\x00\x00\x00Cookie: mstshash=\r\n" expect "\x03\x00\x00\x0b\x06\xd0" I'd love it if anyone could test this out and confirm it works for them- we tested on Win2000, WinXP, Win2003, Win2008 and it worked in all cases. Now the tech details if anyone is curious. We sniffed and analyzed packets using an actual remote desktop client as well as this Nagios test: http://troels.arvin.dk/code/nagios/check_x224 There is more after the xd0 in the response packet but that appears to be the "Connection Confirm" response from remote desktop according to that script and to Wireshark. Also the packet length is hard coded in the send and receive above (x19 in send, x0b in receive) but this did not appear to cause any issues. Please integrate this into the Xymon code if everyone tests it as working! Thanks, Chris

2 3

Problem with graph zoom on Network times
by bewhite＠fellowes.com 15 Jan '10

15 Jan '10

Hi all, I just noticed an issue with zooming into graphs of my ping time. When I zoom in, it loses the y-axis value of milliseconds and presents the data in just seconds. So what was a set of valleys and peaks becomes a straight line. I did a couple of searches of the archive, but have not found anyone reporting this issue. I am running Xymon 4.3.0-0.beta2 on a RedHat AS 5.2 server running 1.2.23 of the rrdtool. I am attaching png files of the graph before (conntime) and after the zoom (connzoom). It seems to be a problem with any of the graphs where the y-axiz is in milliseconds (TCP connection Time, bbgen run time, etc.). Has anyone else seen this issue? Thanks, Bruce Bruce White Senior Enterprise Systems Engineer | Phone: 630-671-5169 | Fax: 630-893-1648 | bewhite at fellowes.com | http://www.fellowes.com/ Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc.

7 12

SMS not sending
by lars＠baad-jensen.dk 15 Jan '10

15 Jan '10

Hi I'm trying to get Hobbit 4.3 to send me a test sms. I run the following script, to send a sms ./bin/bbcmd hobbitd_alert --test cpu but i newer recieve a sms. If i run sendsms 45xxxxxxxx test i get a sms. I have set all the log directories to hobbit:hobbit and sendsms is also owned by hobbit:hobbit there is no queue in /usr/share/sms/outgoing What am i doing wrong. Thanks in advance Lars Denmark

2 1

[hobbit] Citrix Monitoring Anyone?
by fredbo＠club-internet.fr 14 Jan '10

14 Jan '10

Hi, Did you try deadcat 's script bb-citrix.pl ? As you I could be very interested if someone had already done a citrix script. Regards, Fred. Greetings All! I am designing my Xymon setup, and in reading some of the material I've discovered that Xymon is capable of a limited view of Citrix, that limit being the ability to see only the number of users connected. Has anyone been able to also add the ability to see who is logged on, the date/time of their login as well? Of course, any other info too would be great to have. Thank you! .vadim To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 3

No "Ports" or "Procs" for Darwin (MacOSX) Client
by jbhoren＠alaska.edu 14 Jan '10

14 Jan '10

Yes, I correctly configured hobbit-clients.cfg on the Xymon server (Linux host), 'cuz it works fine on the cluster's head-node, but not on any of the compute nodes. And it's not a "cluster" thing, 'cuz cpu, disk, memory, and messages all work fine on the compute nodes. "Ports" says "No port checks defined", and "Procs" says "No process checks defined"; but, here are the entries for the first compute node: HOST=node13.cluster.private PROC hobbitlaunch PROC sge_execd PORT "LOCAL=%([.:]22)$" state=LISTEN color=yellow TRACK=sshd "TEXT=SSHD Server" However, clicking on the blinking white "Ports" LED displays the following: Thu Jan 14 09:38:57 AKST 2010 - Ports NOT ok No port checks defined tcp4 0 0 192.168.2.113.55604 192.168.2.100.2049 ESTABLISHED tcp4 0 0 192.168.2.113.55602 199.165.76.54.2049 ESTABLISHED tcp4 0 0 192.168.2.113.50066 199.165.76.54.6444 ESTABLISHED tcp4 0 0 *.8649 *.* LISTEN tcp4 0 0 *.6445 *.* LISTEN tcp4 0 0 *.311 *.* LISTEN tcp46 0 0 *.5900 *.* LISTEN tcp4 0 0 *.88 *.* LISTEN tcp6 0 0 *.88 *.* LISTEN tcp4 0 0 *.22 *.* LISTEN tcp6 0 0 *.22 *.* LISTEN tcp4 0 0 *.625 *.* LISTEN tcp4 0 0 127.0.0.1.631 *.* LISTEN tcp6 0 0 ::1.631 *.* LISTEN So we see that port 22 is being LISTENed on. And, clicking on the blinking white "Ports" LED displays the following: Thu Jan 14 09:43:57 AKST 2010 - Processes NOT ok [image: clear] No process checks defined PID PPID USER STARTED STAT PRI %CPU TIME %MEM RSS VSZ COMMAND 1 0 root Mon08AM Ss 31 0.0 0:46.13 0.0 588 76512 /sbin/launchd 25 1 root Mon08AM Ss 31 0.0 0:01.31 0.0 1292 75944 /usr/libexec/kextd 26 1 root Mon08AM Ss 31 1.8 32:04.05 0.1 5036 80040 /usr/sbin/DirectoryService 27 1 root Mon08AM Ss 31 0.0 0:04.26 0.0 484 75920 /usr/sbin/notifyd 28 1 root Mon08AM Ss 31 0.0 0:48.60 0.0 484 77012 /usr/sbin/syslogd 29 1 root Mon08AM Ss 31 0.0 6:40.76 0.0 1796 77508 /usr/sbin/configd 30 1 daemon Mon08AM Ss 31 0.0 0:03.21 0.0 656 75324 /usr/sbin/distnoted 31 1 _mdnsresponder Mon08AM Ss 31 0.0 0:01.01 0.0 1296 77360 /usr/sbin/mDNSResponder -launchd 35 1 root Mon08AM Ss 31 0.0 0:00.99 0.0 1704 77088 /usr/sbin/securityd -i 39 1 root Mon08AM Ss 31 0.0 0:04.95 0.0 752 76484 master 40 1 root Mon08AM Ss 31 0.0 0:15.51 0.0 856 75888 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift 41 1 _amavisd Mon08AM Ss 31 0.0 0:08.86 0.4 37516 114284 clamd 42 1 root Mon08AM Ss 31 0.0 0:00.01 0.0 320 75320 getty serial.57600 tty.serial 43 1 root Mon08AM Ss 63 0.0 0:01.99 0.0 652 75576 watchdogtimerd 44 1 213 Mon08AM Ss 31 0.0 0:00.04 0.0 1028 77308 /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd -launchd 45 1 root Mon08AM Ss 31 0.0 0:46.29 0.0 292 75300 /usr/sbin/update 46 1 root Mon08AM Ss 31 0.0 0:00.02 0.0 684 75344 /sbin/SystemStarter 49 1 root Mon08AM Ss 31 0.0 4:54.83 0.1 8892 99552 servermgrd -x 51 1 root Mon08AM Ss 31 0.0 0:00.02 0.0 1064 76368 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/RFBRegisterMDNS 52 1 root Mon08AM Ss 50 0.0 0:35.73 0.1 5668 119164 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds 53 1 root Mon08AM Ss 48 0.0 0:03.22 0.0 3844 99900 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console 54 1 root Mon08AM Ss 31 0.0 0:00.04 0.0 652 75420 /usr/sbin/KernelEventAgent 56 1 root Mon08AM Ss 31 0.0 18:55.08 0.0 1840 75932 hwmond 57 1 root Mon08AM Ss 31 0.0 0:00.67 0.0 600 75864 /usr/libexec/hidd 59 1 root Mon08AM Ss 50 0.0 0:06.90 0.0 1176 80024 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Support/fseventsd 61 1 root Mon08AM Ss 31 0.0 1:58.65 0.0 1816 85404 /sbin/emond 62 1 root Mon08AM Ss 63 0.0 0:00.01 0.0 700 75348 /sbin/dynamic_pager -F /private/var/vm/swapfile 65 1 root Mon08AM Ss 31 0.0 0:00.24 0.0 940 75432 /usr/sbin/diskarbitrationd 69 1 root Mon08AM Ss 31 0.0 0:00.02 0.0 676 75360 autofsd 79 1 root Mon08AM Ss 31 0.0 0:14.39 0.0 996 75468 /usr/sbin/kdcmond -n -a 82 1 root Mon08AM Ss 31 0.0 0:00.79 0.0 2108 78684 /System/Library/CoreServices/coreservicesd 84 1 _windowserver Mon08AM Ss 63 0.0 3:01.21 0.2 16928 114260 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphics.framework/Resources/WindowServer -daemon 87 79 root Mon08AM S 31 0.0 0:00.04 0.0 1208 75772 /usr/sbin/krb5kdc -n -r LKDC:SHA1.A84C8C2567E3A97141E7B5B705DB050E8D8F8D0E 90 39 _postfix Mon08AM S 31 0.0 0:00.60 0.0 836 75524 qmgr -l -t fifo -u 102 1 _atsserver Mon08AM Ss 31 0.0 0:00.25 0.0 1744 112100 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framework/Support/ATSServer 108 1 nobody Mon08AM Ss 97 0.0 0:00.07 0.0 1872 86948 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent 109 1 root Mon08AM Ss 31 0.0 0:00.02 0.0 872 75336 /usr/sbin/UserEventAgent -l LoginWindow 111 53 root Mon08AM Ss 31 0.0 0:05.27 0.0 3912 99100 /System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient -s 112 108 nobody Mon08AM S 31 0.0 0:00.05 0.0 1716 85020 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServer 113 35 root Mon08AM S 31 0.0 0:00.11 0.0 1536 86656 /System/Library/CoreServices/SecurityAgent.app/Contents/Resources/authorizationhost 115 35 _securityagent Mon08AM S 47 0.7 50:36.10 0.1 11336 154704 /System/Library/CoreServices/SecurityAgent.app/Contents/MacOS/SecurityAgent 220 1 3000 Mon08AM S 31 0.0 0:34.61 0.0 912 76648 /usr/local/sge/bin/darwin/sge_execd 231 1 nobody Mon08AM Ss 31 0.0 0:40.63 0.0 2684 76092 /usr/sbin/gmond 346 1 root Mon09AM Ss 31 0.0 0:16.81 0.0 840 76676 /usr/sbin/serialnumberd 8374 1 _update_sharing 1:37PM Ss 31 0.0 0:00.01 0.0 300 67120 /System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/bin/updateSharingD 25291 39 _postfix 8:23AM S 31 0.0 0:00.02 0.0 760 75468 pickup -l -t fifo -u -o content_filter 26058 1 root 9:08AM Ss 31 0.0 0:00.03 0.0 276 76400 /usr/local/xymon/client/bin/hobbitlaunch --config=/usr/local/xymon/client/etc/clientlaunch.cfg --log=/usr/local/xymon/client/logs/clientlaunch.log --pidfile=/usr/local/xymon/client/logs/clientlaunch.node13.cluster.private.pid 26558 1 root 9:43AM Ss 31 0.0 0:00.01 0.0 788 75440 /usr/libexec/samba/synchronize-preferences --linger 26563 26058 root 9:43AM S 31 3.0 0:00.01 0.0 728 75944 /bin/sh /usr/local/xymon/client/bin/hobbitclient.sh 26567 26563 root 9:43AM R 30 5.3 0:00.02 0.0 684 75944 /bin/sh /usr/local/xymon/client/bin/hobbitclient-darwin.sh 26583 26567 root 9:43AM R 31 0.0 0:00.00 0.0 360 75352 ps -ax -ww -o pid So we see that both the hobbitlaunch and sge_execd processes are present. Thoughts? Suggestions? -- JONATHAN B. HOREN Systems Administrator UAF Life Science Informatics Center for Research Services jbhoren at alaska.edu http://biotech.inbre.alaska.edu

2 1

IP Change
by d.tom.schmitt＠L-3com.com 14 Jan '10

14 Jan '10

I will be building a new (replacement) Dell R-series server to replace the Dell PC that is currently running the xymon services. The new server is 64-bit. I run Cent-OS 32-bit on the PC and need to move the PC info to the R-series server. Should I just rebuild xymon and move over the bb-hosts, hobbit-alerts.cfg and www/notes files? And just let the server begin to gather data or is it easy to get the history information from the PC to the new server? I am and will be running 4.3.0-0.beta2. I will need to change the IP address after I have built the new server to the PC's IP Address as everyone is using this server. Thanks, Tom Schmitt Senior IT Staff - R&D Salt Lake City, UT 84116 Phone (801) 594-3030 Cell (801) 231-7230 eFax (413) 480-6873 D.Tom.Schmitt at L-3Com.com \\\\||//// \ ~ ~ / | @ @ | --oOo---(_)---oOo--

3 4