October 2010 - Xymon - Xymon mailman web

hobbit-alerts.cfg question
by colin.coe＠gmail.com 08 Oct '10

08 Oct '10

Hi all The alerting is starting to take shape but I've a question regarding how the alerting works. If I have a stanza similar to the following, how is it evaluated? Once for all hosts, or for one host at a time? --- HOST=%.* # Proliant tests MAIL sms at somecompany.com SERVICE=proliant FORMAT=SMS REPEAT=1440m MAIL sms at somecompany.com SERVICE=proliant FORMAT=SMS RECOVERED # conn where status is RED MAIL sms at somecompany.com COLOR=red SERVICE=conn EXPAGE=dev REPEAT=1440m MAIL sms at somecompany.com COLOR=red SERVICE=conn EXPAGE=dev RECOVERED # conn where status is RED (dev/test) MAIL email at somecompany.com COLOR=red SERVICE=conn PAGE=dev REPEAT=1440m MAIL email at somecompany.com COLOR=red SERVICE=conn PAGE=dev RECOVERED # cpu,disk,memory where status is RED MAIL sms at somecompany.com COLOR=red SERVICE=cpu,disk,memory EXPAGE=dev REPEAT=1440m MAIL sms at somecompany.com COLOR=red SERVICE=cpu,disk,memory EXPAGE=dev RECOVERED # Dev servers MAIL email at somecompany.com COLOR=red SERVICE=cpu,disk,memory PAGE=dev REPEAT=1440m MAIL email at somecompany.com COLOR=red SERVICE=cpu,disk,memory PAGE=dev RECOVERED # Non-dev status YELLOW MAIL email at somecompany.com COLOR=yellow SERVICE=cpu,disk,memory REPEAT=1440m DURATION>30m MAIL email at somecompany.com COLOR=yellow SERVICE=cpu,disk,memory RECOVERED --- Also, I've noticed that when a fault occurs I get two emails (or sms') and another when the fault is rectified. I'm thinking this is because of the 'RECOVERED' line but i thought this would only trigger when the fault goes. Have I misunderstood? Thanks CC -- RHCE#805007969328369

3 3

how to configure "disk" alerts to only a specific partition?
by tsztur＠gmail.com 08 Oct '10

08 Oct '10

So we have a few partitions on one of our systems. One particular partition goes up to 99-100% at times which is normal. We do not want to get alerts for this partition. We are only concerned about the others. How can I set xymon/hobbit to ignore certain partitions from being checked and/or alerted on? TIA. tom.

4 3

Problem with disk monitoring
by shailesh.paudyal＠gmail.com 07 Oct '10

07 Oct '10

All, Please see below, there is a problem with disk monitoring on one of the server. Can some one tell me if I did something wrong? W]d Jul 28 10:34:31 EDT 2010 - Filesystems NOT ok 7% / (8816628% used) has reached the PANIC level (95%) 38% /u01 (90371708% used) has reached the PANIC level (95%) 2% /tmp (9254468% used) has reached the PANIC level (95%) 34% /usr (6261556% used) has reached the PANIC level (95%) 18% /opt (7775588% used) has reached the PANIC level (95%) 4% /var (13653064% used) has reached the PANIC level (95%) 3% /home (27514896% used) has reached the PANIC level (95%) 30% /boot (67864% used) has reached the PANIC level (95%) 14% /u02 (1697518148% used) has reached the PANIC level (95%) 94% /u03 (136865636% used) has reached the PANIC level (95%) Filesystem 10 4-b]ocks Used Available Capacity Mounted on /dev/sda9 9920592 591896 8816628 7% / /dev/sda10 152435112 54195172 90371708 38% /u01 /dev/sda8 9920592 154056 9254468 2% /tmp /dev/sda7 9920592 3146968 6261556 34% /usr /dev/sda6 9920592 1632936 7775588 18% /opt /dev/sda5 14877060 456092 13653064 4% /var /dev/sda3 29753588 702880 27514896 3% /home /dev/sda1 101086 28003 67864 30% /boot /dev/mapper/VolGroup02-u02 2064204960 261831260 1697518148 14% /u02 /dev/mapper/VolGroup03-u03 2064204960 1822483772 136865636 94% /u03 -- Shailesh K. Paudyal shailesh.paudyal at gmail.com

5 13

Where is development going on in SVN?
by cade.robinson＠gmail.com 07 Oct '10

07 Oct '10

I have been using xymon compiled from about 6+ months ago. I have used the old "hobbitmon" project. I found some issues with the 4.2 version and tried branches/4.3.0 and branches/4.4.0. It looked like 4.3 and 4.4 were mostly the same so I went with 4.4.0. I found that I needed to patch quite a few files to get things working right. This was all prior to the hobbit->xymon changes. Now I was asked to setup another monitoring server and thought I would try out the new project. I was looking at the SVN to see if anything I had to patch was fixed but I am confused as to where to look for the latest revisions. Looking at the last few commits it looks like they have been going into "trunk". Looking at revisions it looks like branches/4.4.0 is newer than trunk. So what is the development area? "trunk" or "branches"? I want to also see if the patches I created are still needed and if so then would like to somehow get them into the repo. Thanks

5 9

maxdelay option
by Daniel.Nordquist＠orlandohealth.com 06 Oct '10

06 Oct '10

Hello all, I've been trying to find a way to set my uptime reporting option globally but I can't find a way. I know I can do it individually with each monitored servers bbwin.cfg file and setting a maxdelay, but does anyone know of a way to do it globally? I know I can eliminate the column, but we do want to see recent reboots while we don't want to see servers that have been up "too long" on the bb2 page. Much appreciated! Dan This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.

2 1

sort hosts in group
by vadud3＠gmail.com 06 Oct '10

06 Oct '10

It would be nice if the hosts within the group can be displayed in alphanumerically sorted. bbgen has a option to sort the test names using `--sort-group-only-items'. Would be nice if there is a switch for hosts as well. So no matter how you entered the hosts in bb-hosts file, the display will always show them in sorted. -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

5 6

Odd Avail numbers in Disk report
by Munsch＠phillycarshare.org 06 Oct '10

06 Oct '10

Hello, The Summary under disk keeps reporting a strange result. What’s especially odd is some days it’s correct, and some days it does something like this: Filesystem 1K-blocks Used Avail Capacity Mounted Summary(Total\Avail) C 12586924 8292776 4294148 65% /FIXED/C 12.03gb\4.97gb The erroneous Avail isn’t always the same number, either. And sometimes it’s correct. I’m worried this is more indicative of something wrong with the partition itself, rather than Xymon. Has anyone seen this before? The monitored system is a Windows Server 2003 box (with bbwin running), and the only similar thread I could find was from May, about Solaris. Unlike that one, this only seems to be affecting the one partition on the box: the D partition, which is on the same array, is reported correctly always, as is the E: drive, which is a different array. I’m confuzzled. ------------------------ Rob Munsch IT Administrator PhillyCarShare 215-495-1040 x131 www.phillycarshare.org Our Vision: A Philadelphia in which non-profit car sharing exceeds the convenience, flexibility, and affordability of car ownership.

1 0

Ignoring strings in event logs
by colin.coe＠gmail.com 06 Oct '10

06 Oct '10

Hi all I have the following in my hobbit-clients.cfg on the Xymon server --- CLASS=win32 LOAD 80 90 # Load threholds are in % PORT "LOCAL=%([.:]20000)$" TEXT=RemotelyAnywhere LOG %.* %error -.* COLOR=yellow LOG eventlog:Security %failure.* COLOR=yellow LOG eventlog:Application %warning.* COLOR=yellow IGNORE="%(Warning: IIS log failed to write entry|Many client computers have not reported back|Unsuccessful logon attempt from IP address .* Secure (SSL) Connection).*" LOG eventlog:System %error.* COLOR=yellow --- I'm finding that I'm still getting warnings coming up from the WSUS server regarding the clients that have not checked. Could someone advise what I'm doing wrong here? Thanks CC -- RHCE#805007969328369

4 10

sslcert test problem
by doctor＠makelofine.org 05 Oct '10

05 Oct '10

Hi guys ! I discovered a strange trouble on my xymon. I'm running server and clients version 4.2.3. My server is monitored by xymon and host several services with SSL. So, xymon do test the ssl certificates using integrate sslcert test. All is OK. The strange part is that another host, a simple client -let's call him "client", is SSL monitored too, but when I check the SSL certificates that are reported, they are the ones hosted on the xymon server. So, i have false positives when sslcert reports something wrong on the server, and I don't get monitoring for the SLL certificates on the client... The 2 hosts are linux debian, and all other tests are OK (i tried to stop services on client, and the alert is OK, i tried to stop services on server, and the alert is OK too) and independants from each other. They are not on the same subnet, there names aren't similar, and I didn't register aliases or anything like this. I tried to "bb drop client sslcert" and "bb drop server sslcert", but nothing changed, after getting new statuses, the sslcert on client just reports SSL certificates on server :/ Anyone has an idea ?

1 0

Multiple regex on PAGE line of hobbit-alerts.cfg?
by cade.robinson＠gmail.com 05 Oct '10

05 Oct '10

Is it possible to use multiple regex on a PAGE= line of hobbit-alerts.cfg? EG bb-hosts page prodlinux Linux Servers ... subpage criticalprodlinux Critical Prod Linux Servers ... subpage noncriticalprodlinux Non-Critical Prod Linux Servers ... page prodwin Windows Servers ... subpage criticalprodwin Critical Prod Windows Servers ... subpage noncriticalprodwin Non-Critical Prod Windows Servers ... So what I have is my "prod" servers and then a subpage of critical ones that I want to get sms text pages on and then non-critical prod servers that I don't really need a page at 3am on. In my hobbit-alerts.cfg I want an email if any prodlinux or prodwin goes yellow and a page if the critical ones go red So in hobbit-alerts something like this: PAGE=%prodlinux/.*,%prodwin/.*,someotherpage ... COLOR=yellow ... PAGE=prodlinux/criticalprodlinux,prodwin/criticalprodwin,someotherpage ... COLOR=red ... The red part works but the yellow doesn't. Presumably because I am trying to do two regex in the PAGE line? Thanks Cade

2 2