November 2010 - Xymon - Xymon mailman web

Nodisp for a Page?
by mike＠terrapintesting.com 09 Nov '10

09 Nov '10

Are there any options for the bb-host file to not display an entire page without having to comment everything under the page definition? As remote sites are re-located, I would like to stop monitoring the entire site and not have it show up in the Webpage. Then, when it is back online, resume monitoring. Currently, the only way I can see to do this is to comment the entire section of the bb-host file. It would be nice to have a nodisp type option to add or precede the "page" option to remove the entire page from the system. Thanks, Mike

2 2

Getting Xymon alerts to the desktop
by Rense＠multiscan.nl 08 Nov '10

08 Nov '10

Thanx! Already lovin' it :) -----Oorspronkelijk bericht----- Van: netz-haut - stephan seitz [mailto:s.seitz at netz-haut.de] Verzonden: zondag 7 november 2010 14:51 Aan: xymon at xymon.com Onderwerp: [xymon] Getting Xymon alerts to the desktop Hi there, we've got wall monitors showing different xymon status pages, email and pim notification configured. But, often when it comes to failures, no one notices this instantly because of doing work and having the focus on it. For this reason, I decided to write a desktop notifier. A small icon at the system tray shows the current color of the configured xymon page, if the color changes, a balloon message pops up and virtually any command can be triggered. As this might be useful for someone else, I've published it at freshmeat: http://freshmeat.net/projects/xymon-alert Well, It's licensed under the GPLv2 and available for free, so hopefully this mail doesn't count as advertising. Mit freundlichen Gruessen -- Stephan Seitz Senior System Administrator netz-haut GmbH multimediale kommunikation Zweierweg 22 97074 Würzburg Telefon: 0931 2876247 Telefax: 0931 2876248 Web: www.netz-haut.de Amtsgericht Würzburg - HRB 10764 Geschäftsführer: Michael Daut, Kai Neugebauer To unsubscribe from the xymon list, send an e-mail to xymon-unsubscribe at xymon.com

1 0

Antwort: [xymon] Getting Xymon alerts to the desktop
by s.seitz＠netz-haut.de 08 Nov '10

08 Nov '10

Hi, thank you for your response, but let’s follow this topic off-list. I assume the users of the xymon list are not very happy with third-party project discussions. I’ve compiled the windows binary on Windows7. It successfully runs on Windows2003 (SBS), Windows XP, Vista and Windows7. I do not have access to older Versions of Windows, but I’m going to ask some people. Maybe I’ll find some ancient installation. Anyway, I do not expect the FreePascal/Lazarus IDE to run successful on W2k. Mit freundlichen Gruessen -- Stephan Seitz Senior System Administrator netz-haut GmbH multimediale kommunikation Zweierweg 22 97074 Würzburg Telefon: 0931 2876247 Telefax: 0931 2876248 Web: www.netz-haut.de Amtsgericht Würzburg – HRB 10764 Geschäftsführer: Michael Daut, Kai Neugebauer From: Hermann-Josef Beckers [mailto:hj.beckers at kreis-steinfurt.de] Sent: Monday, November 08, 2010 10:24 AM To: xymon at xymon.com Cc: xymon at xymon.com Subject: [xymon] Antwort: [xymon] Getting Xymon alerts to the desktop "netz-haut - stephan seitz" <s.seitz at netz-haut.de> schrieb am 07.11.2010 14:51:16: Hi Stephan, ... > > As this might be useful for someone else, I've published it at freshmeat: > http://freshmeat.net/projects/xymon-alert <http://freshmeat.net/projects/xymon-alert> > > Well, It's licensed under the GPLv2 and available for free, so > hopefully this mail doesn't count as advertising. > Under Windows 2000 I have two errors: error popup "Die Ordnungszahl 2821 wurde in der LIBEAY32.dll nicht gefunden." and it can't write the configuration. The field for the configuration file is greyed out. It points to "D:cygwin/home\ha.ini" and can't be changed. I'm using Cygwin und $HOME points to the above path. Yours hjb

1 0

Client data corruption
by colin.coe＠gmail.com 08 Nov '10

08 Nov '10

Hi all I'm seeing occasional corruption in the data being sent from clients to Xymon server. For example: --- red Mon Nov 8 08:00:08 WST 2010 - Filesystems NOT ok &red 281121212 29% / (112686548% used) has reached the PANIC level (95%) &red 55500 43% /boot (40367% used) has reached the PANIC level (95%) Filesystem 1024-blocks Us d A]ailable Capacity Mounted on /dev/mapper/VolGroup00-LogVol00 414880744 112686548 281121212 29% / /dev/cciss/c0d0p1 101086 40367 55500 43% /boot --- I've also seen this happen with the 'services' data from Windows clients. I'm using 'Xymon 4.3.0-0.beta2'. Has anyone else seen this? If more info is required please let me know what is needed. Thanks CC -- RHCE#805007969328369

3 4

help setting up SNMP traps to Xymon
by nskyrca＠syr.edu 05 Nov '10

05 Nov '10

Thanks Andy. I thought that the severity of the trap came from what is defined in the /etc/snmp/snmptt.conf.oracle file? The cerebro.victoriacollege.edu website has a section saying: I've noticed that the APC and Dell MIB files have a SEVERITY definition in them. SNMPTT uses that to establish the severity for each trap (Normal|INFORMATIONAL|SEVERE|WARNING|...). However, I've noticed that Cisco and Canoga Perkins don't have those definitions; so, every trap event is considered Normal. You'll need to change the severity for the various traps as desired in the snmptt.conf file. Does the snmptt.conf.oracle file have to be changed in order to deal with the different severity codes that it receives from the snmptrap? It seems like the way my snmptt.conf.oracle file is configured right now, it would always have a severity of "Normal", so Xymon would never change colors. I'm just learning SNMP and don't completely understand it yet, so maybe I'm missing something. I'll have to check with my DBA's again to find out if they can send their traps directly from the database server, rather than thru the Grid server. Thanks, Nicole From: FARRIOR, Andy [mailto:Andy.Farrior at victoriacollege.edu] Sent: Friday, October 15, 2010 12:48 PM To: xymon at xymon.com Subject: [xymon] RE: help setting up SNMP traps to Xymon 1 - clearing the trap. Unfortunately, the only way the SNMP trap status changes on Xymon is when it receives a new SNMP trap from the device. If the device would send an "all clear" type of trap when it was happy, that'd change the status back to green. If there's a way to create an event on the device that generates a "Normal" event, you could use that as a mechanism to change the SNMP status on Xymon. (Example, if saving the configuration generates a "Normal" SNMP trap....) Ugly, but it'd work. The other way to address it would be to come up with a way to manually acknowledge or clear a trap similar to the alert acknowledgment in Xymon. I've never had time to pursue that. 2 - origination of the trap The only way I can think of addressing this is if each database server can be configured to send SNMP traps on their own. The SNMPTRAPD daemon uses the sending device's hostname and that's what is used to send to Xymon. Hope this helps, Andy From: Nicole Beck [mailto:nskyrca at syr.edu] Sent: Friday, October 15, 2010 9:42 AM To: 'xymon at xymon.com' Subject: [xymon] help setting up SNMP traps to Xymon Hello, I'm running Xymon 4.2.3 on RHEL 5.4 and I'm trying to setup Xymon to receive SNMP traps from our Oracle database servers. We are also running Oracle Enterprise Manager on another server (we call it the "grid") that monitors the Oracle database servers too, but our DBA's want to use Xymon to alert them of Oracle problems instead of the grid server so they don't get alerts from two different places. The DBA's manage OEM(therefore I'm not familiar with it), and have configured it to recieve SNMP traps and send them to Xymon. I configured the Xymon server to receive traps using the documentation at http://cerebro.victoriacollege.edu/hobbit-trap.html. We do receive traps, but there are two problems: 1. The trap status diamond does not change color when it gets a trap or when the trap clears. My understanding is that this is set in the Oracle MIBS that are translated to the /etc/snmp/snmptt.conf.oracle file. I'm not sure how to change the file to get it to give different alerts. If I change the word "NORMAL" in the following line to "SEVERE" the trap status will go red, but will not return to green when the trap clears. Any suggestions on how to fix this? EVENT oraEM4Alert .1.3.6.1.4.1.111.15.2.0.1 "Status Events" Normal 1. The traps status changes for the grid server instead of the database server with the problem. Drilling down into the "trap" status, you will see an error for the database server though. The snmptrapd.log and snmptt.log files (examples below) show the traps coming from the grid server. Does anyone know how to get the traps to appear under the database server name rather than the grid server? Example snmptrapd.log entry (host name changed): 2010-10-14 19:04:49 grid-server [xxx.xxx.xxx.xxx] (via UDP: [xxx.xxx.xxx.xxx]:51617) TRAP, SNMP v1, community public .1.3.6.1.4.1.111.15.2 Enterprise Specific Trap (1) Uptime: 0:06:31.00 .1.3.6.1.4.1.111.15.1.1.1.2.1 = STRING: "DB00157.world" .1.3.6.1.4.1.111.15.1.1.1.3.1 = STRING: "Database Instance" .1.3.6.1.4.1.111.15.1.1.1.4.1 = STRING: "database-server " .1.3.6.1.4.1.111.15.1.1.1.5.1 = STRING: "Status".1.3.6.1.4.1.111.15.1.1.1.6.1 = "" .1.3.6.1.4.1.111.15.1.1.1.7.1 = "" .1.3.6.1.4.1.111.15.1.1.1.8.1 = STRING: "Oct 14, 2010 7:04:00 PM EDT" .1.3.6.1.4.1.111.15.1.1.1.9.1 = STRING: "Critical" .1.3.6.1.4.1.111.15.1.1.1.10.1 = STRING: "Failed to connect to database instance: ORA-01033: ORACLE initialization or shutdown in progress (DBD ERROR: OCISessionBegin)." .1.3.6.1.4.1.111.15.1.1.1.11.1 = STRING: "Test SNMP database-server DB Down " .1.3.6.1.4.1.111.15.1.1.1.12.1 = STRING: "SYSMAN" .1.3.6.1.4.1.111.15.1.1.1.13.1 = STRING: "0" .1.3.6.1.4.1.111.15.1.1.1.14.1 = "" .1.3.6.1.4.1.111.15.1.1.1.15.1 = STRING: "923A730174F36B87E040E6801417642D" .1.3.6.1.4.1.111.15.1.1.1.16.1 = STRING: "0" .1.3.6.1.4.1.111.15.1.1.1.17.1 = "" .1.3.6.1.4.1.111.15.1.1.1.18.1 = STRING: "0" .1.3.6.1.4.1.111.15.1.1.1.19.1 = "" .1.3.6.1.4.1.111.15.1.1.1.20.1 = STRING: "1" .1.3.6.1.4.1.111.15.1.1.1.21.1 = STRING: "923A421065A8A060E040E68015173993" Example snmptt.log entry: Oct 14 19:04:52 xymon-server snmptt[0]: .1.3.6.1.4.1.111.15.2.0.1 SEVERE "Status Events" grid-server - The variables included in the oraEM4Alert trap. DB00157.world Database Instance database-server Status Oct 14, 2010 7:04:00 PM EDT Critical Failed to connect to database instance: ORA-01033: ORACLE initialization or shutdown in progress (DBD ERROR: OCISessionBegin). Test SNMP database-server DB Down SYSMAN 0 923A730174F36B87E040E6801417642D 0 0 1 923A421065A8A060E040E68015173993 Thanks in advance for any help. I'm sorry for the lengthy question. Nicole Beck

3 7

hobbit/xymon apt checking says "Packages not installed from apt repositories", from upgraded Ubuntu
by tsztur＠gmail.com 05 Nov '10

05 Nov '10

We upgraded version 10.04 to 10.10 Ubuntu. Hobbit is giving us a warning on the Monitoring page saying: "Packages not installed from apt repositories (1): linux-image-2.6.32-24-server (2.6.32-24.43)" even though a newer version is installed: uname -a: " 2.6.35-22-server #35-Ubuntu SMP Sat Oct 16 22:02:33 UTC 2010 x86_64 GNU/Linux" how can we clear this? The sources.list doesn't have any repo's from Lucid . where does hobbit get this information from and how can we clear this? tia!

1 0

Bug in downtime display on info-page
by dominique.frise＠unil.ch 05 Nov '10

05 Nov '10

Hi, After applying the patch below on a 4.3.0-beta2 installation, the optional "columns" setting is not displayed correctly. Example rule from bb-hosts -------------------------- DOWNTIME=orcl,orcl-chk,http:*:0655:1115:Backups Info display ------------ Planned downtime: [Malformed timespec] Dominique On 10/29/10 12:47 PM, Henrik Størner wrote: > In<B08F3F3D67451844A7A8A029FCC71E4C164233112E at WIN01.ad.deltamanagement.se> =?iso-8859-1?Q?Johan_Sj=F6berg?=<johan.sjoberg at deltamanagement.se> writes: > >> This might already be fixed in 4.3, but I'll report it anyway. >> The info page in 4.2.3 shows the downtime information in the wrong order. >> In bb-host I added "DOWNTIME=*:5:0445:0555:reboot" to schedule a downtime >> each Friday morning for a reboot of a server. I know this downtime works >> as intended, and the field order is according to the man-page. >> But on the info-page, the downtime is shown as >> "Planned downtime:All days:5:0445:0555:reboot", so the "day" and "service" >> fields are mixed up. > > Thanks for reporting this - the routine handling the time-display had > not been updated to support the extended format. Fixed now. The patch > below can be applied to 4.2.3 also, if you want to. > > > Regards, > Henrik > > Index: lib/timefunc.c > =================================================================== > --- lib/timefunc.c (revision 6532) > +++ lib/timefunc.c (working copy) > @@ -97,6 +97,7 @@ > static strbuffer_t *result = NULL; > char *sCopy; > char *sItem; > + char *itmstbuf; > > if (result == NULL) result = newstrbuffer(0); > clearstrbuffer(result); > @@ -120,12 +121,36 @@ > } > > sCopy = strdup(spec); > - sItem = strtok(sCopy, ","); > + sItem = strtok_r(sCopy, ",",&itmstbuf); > while (sItem) { > + char *tok, *onebuf, *e1, *e2, *e3, *e4, *e5; > + char *days, *starttime, *endtime, *columns, *cause; > char *oneday, *dtext; > - int daysdone = 0, firstday = 1; > - oneday = sItem; > + int daysdone = 0, firstday = 1, ecount; > > + e1 = e2 = e3 = e4 = e5 = NULL; ecount = 0; > + e1 = strtok_r(sItem, ":",&onebuf); > + if (e1) { ecount++; e2 = strtok_r(NULL, ":",&onebuf); } > + if (e2) { ecount++; e3 = strtok_r(NULL, ":",&onebuf); } > + if (e3) { ecount++; e4 = strtok_r(NULL, ":",&onebuf); } > + if (e4) { ecount++; e5 = strtok_r(NULL, ":",&onebuf); } > + if (e5) { ecount++; } > + > + if (ecount == 3) { > + /* Old format: e1=day, e2 = starttime, e3 = endtime */ > + days = e1; starttime = e2; endtime = e3; columns = NULL; cause = NULL; > + } > + else if (ecount == 5) { > + columns = e1; days = e2; starttime = e3; endtime = e4; cause = e5; > + } > + else { > + addtobuffer(result, "[Malformed timespec]"); > + sItem = NULL; > + continue; > + } > + > + oneday = days; > + > while (!daysdone) { > switch (*oneday) { > case '*': dtext = "All days"; break; > @@ -141,12 +166,25 @@ > } > > if (!firstday) addtobuffer(result, "/"); > + > addtobuffer(result, dtext); > oneday++; > firstday = 0; > } > > - sItem = strtok(NULL, ","); > + addtobuffer(result, ":"); addtobuffer(result, starttime); > + addtobuffer(result, ":"); addtobuffer(result, endtime); > + if (columns) { > + addtobuffer(result, " (status:"); > + if (strcmp(columns, "*") == 0) > + addtobuffer(result, "All"); > + else > + addtobuffer(result, columns); > + addtobuffer(result, ")"); > + } > + if (cause) { addtobuffer(result, " (cause:"); addtobuffer(result, cause); addtobuffer(result, ")"); } > + > + sItem = strtok_r(NULL, ",",&itmstbuf); > if (sItem) addtobuffer(result, ", "); > } > xfree(sCopy); > > To unsubscribe from the xymon list, send an e-mail to > xymon-unsubscribe at xymon.com > >

2 2

Fwd: Problem with false procs Update
by shea4th＠comcast.net 04 Nov '10

04 Nov '10

I didn't see this posted so trying again -----Original Message----- From: shea, greg Sent: Thursday, November 04, 2010 12:21 PM To: 'xymon at xymon.com' Cc: shea, greg Subject: Problem with false procs Update RESOLVED, skip to bottom for resolution or read on Hi all, As reported earlier, http://www.xymon.com/archive/2010/04/msg00058.html I've been having a problem with false procs showing up on other pages and causing alerts to go out that aren't for that host. Strange trying to explain it but for my dev box hobbitdev, I'm only interested in hobbitd_channel and heartbeat as seen from the snippet of my hobbit-clients.cfg file For certain ESX servers I'm looking for the specific procs listed below in the ESX VI Servers section. What's happening is, the procs from the ESX VI Servers page is merging with the procs from the HOST hobbitdev >From hobbitdev procs web page: hobbitdev - procs Thu Nov 04 10:08:10 EDT 2010 ------------------------------------------------------------------------ -------- Thu Nov 4 10:08:04 EDT 2010 - Processes NOT ok G hobbitd_channel (found 6, req. 1 or more) Y heartbeat (found 0, req. between 1 and 1) G /usr/sbin/sshd (found 1, req. 1 or more) R /opt/vmware/vpxa/vpx/vpxa (found 0, req. 1 or more) R /usr/lib/vmware/hostd/vmware-hostd (found 0, req. 1 or more) G /usr/sbin/snmpd (found 1, req. 1 or more) G cron (found 1, req. 1 or more) G sshd (found 5, req. 1 or more) ... ... >From hobbit-clients.cfg: HOST=hobbitdev LOAD 40.0 50.0 PROC hobbitd_channel PROC heartbeat 1 1 yellow GROUP=HHEARTBEAT FILE /apps/hobbit/server/etc/bb-hosts yellow MTIME>600 TRACK FILE /apps/hobbit/server/etc/hobbit-alerts.cfg yellow MTIME>600 TRACK FILE /apps/hobbit/server/etc/hobbit-clients.cfg yellow MTIME>600 TRACK PORT LOCAL=0.0.0.0:1984 TEXT=HobbitD ############################################################ ..SNIP.. ## ESX VI Servers PAGE=ESXVI LOAD 5.0 8.0 PROC /usr/sbin/sshd 1 -1 PROC /opt/vmware/vpxa/vpx/vpxa 1 -1 PROC /usr/lib/vmware/hostd/vmware-hostd 1 -1 PROC /usr/sbin/snmpd 1 -1 ############################################################ ..SNIP.. DEFAULT # These are the built-in defaults. #UP 1h UP 30m LOAD 8.0 10.0 DISK "%^/mnt.*|^/cdrom.*" 102 102 DISK * 90 95 MEMPHYS 101 102 MEMSWAP 85 95 MEMACT 90 95 LOG /var/log/messages "%(?-i)NOTICE" LOG /var/log/messages "%(?-i)WARNING" COLOR=yellow LOG /var/adm/messages "%(?-i)NOTICE" "IGNORE=%(file system full|disabled dmpnode|di\ sabled path|enabled dmpnode|enabled path|vx_nospace|vxdmp|dmp_tur_temp_pgr|pure-ftpd|rdftp|\ downloaded|uploaded|Deleted|acl_server|unrecognized ioctl|Unknown:|exited without|uid 29108\ |unregistered|pcn: possible RX|nfssrv)" RESOLUTION In hobbit-clients.cfg there's an entry for ESX VI Servers, well this doesn't exist. I'm not watching those ESX servers from my dev box and there is no entry in bb-hosts for this as well. I've removed the PAGE=ESXVI entry from hobbit-clients.cfg and the "phantom" processes are now gone. Sorry for being long winded here, just wanted to post so no one else runs into this bone-headed mistake. Regards Gregory R Shea EMC Corporation

1 0

Can we verify the DNS response
by mike＠terrapintesting.com 04 Nov '10

04 Nov '10

An entry in the bb-host file like: 192.168.10.10 bambam # dns=fred will perform a DNS query against the server bambam for the hostname: fred. The way I understand it is if a response is received, the DNS is considered good. I would like to know if here are any options to verify the result. In my particular case, we want to query against a "Split DNS" server and confirm the correct IP is being returned in the A record. So, 192.168.10.10 bambam.dom.com # dns=fred.dom.com 71.137.200.10 bambam.dom.com # dns=fred.dom.com The first entry should return: 192.168.10.15 The second entry should return: 71.137.200.15 If DNS views are broken, the 2nd entry may return: 192.168.10.15 If so, I want to get a page so DNS can be fixed. Thanks, Mike

3 5

Problem with false procs Update
by greg.shea＠emc.com 04 Nov '10

04 Nov '10

RESOLVED, skip to bottom for resolution or read on Hi all, As reported earlier, http://www.xymon.com/archive/2010/04/msg00058.html I've been having a problem with false procs showing up on other pages and causing alerts to go out that aren't for that host. Strange trying to explain it but for my dev box hobbitdev, I'm only interested in hobbitd_channel and heartbeat as seen from the snippet of my hobbit-clients.cfg file For certain ESX servers I'm looking for the specific procs listed below in the ESX VI Servers section. What's happening is, the procs from the ESX VI Servers page is merging with the procs from the HOST hobbitdev >From hobbitdev procs web page: hobbitdev - procs Thu Nov 04 10:08:10 EDT 2010 ------------------------------------------------------------------------ -------- Thu Nov 4 10:08:04 EDT 2010 - Processes NOT ok G hobbitd_channel (found 6, req. 1 or more) Y heartbeat (found 0, req. between 1 and 1) G /usr/sbin/sshd (found 1, req. 1 or more) R /opt/vmware/vpxa/vpx/vpxa (found 0, req. 1 or more) R /usr/lib/vmware/hostd/vmware-hostd (found 0, req. 1 or more) G /usr/sbin/snmpd (found 1, req. 1 or more) G cron (found 1, req. 1 or more) G sshd (found 5, req. 1 or more) ... ... >From hobbit-clients.cfg: HOST=hobbitdev LOAD 40.0 50.0 PROC hobbitd_channel PROC heartbeat 1 1 yellow GROUP=HHEARTBEAT FILE /apps/hobbit/server/etc/bb-hosts yellow MTIME>600 TRACK FILE /apps/hobbit/server/etc/hobbit-alerts.cfg yellow MTIME>600 TRACK FILE /apps/hobbit/server/etc/hobbit-clients.cfg yellow MTIME>600 TRACK PORT LOCAL=0.0.0.0:1984 TEXT=HobbitD ############################################################ ..SNIP.. ## ESX VI Servers PAGE=ESXVI LOAD 5.0 8.0 PROC /usr/sbin/sshd 1 -1 PROC /opt/vmware/vpxa/vpx/vpxa 1 -1 PROC /usr/lib/vmware/hostd/vmware-hostd 1 -1 PROC /usr/sbin/snmpd 1 -1 ############################################################ ..SNIP.. DEFAULT # These are the built-in defaults. #UP 1h UP 30m LOAD 8.0 10.0 DISK "%^/mnt.*|^/cdrom.*" 102 102 DISK * 90 95 MEMPHYS 101 102 MEMSWAP 85 95 MEMACT 90 95 LOG /var/log/messages "%(?-i)NOTICE" LOG /var/log/messages "%(?-i)WARNING" COLOR=yellow LOG /var/adm/messages "%(?-i)NOTICE" "IGNORE=%(file system full|disabled dmpnode|di\ sabled path|enabled dmpnode|enabled path|vx_nospace|vxdmp|dmp_tur_temp_pgr|pure-ftpd|rdftp|\ downloaded|uploaded|Deleted|acl_server|unrecognized ioctl|Unknown:|exited without|uid 29108\ |unregistered|pcn: possible RX|nfssrv)" RESOLUTION In hobbit-clients.cfg there's an entry for ESX VI Servers, well this doesn't exist. I'm not watching those ESX servers from my dev box and there is no entry in bb-hosts for this as well. I've removed the PAGE=ESXVI entry from hobbit-clients.cfg and the "phantom" processes are now gone. Sorry for being long winded here, just wanted to post so no one else runs into this bone-headed mistake. Regards Gregory R Shea EMC Corporation

1 0