August 2010 - Xymon - Xymon mailman web

Andreas Sin/CH/ITC/ALSTOM is out of the office.
by andreas.sin＠alstom.com 23 Aug '10

23 Aug '10

I will be out of the office starting 23.08.2010 and will not return until 30.08.2010. I will respond to your message when I return. I will return on Tuesday, 31st of August 2010 in the morning. During this time my deputies are Alexander Worbs, Przemyslaw Hoppe and Piotr Ostrowski. In emergency cases I'm reachable on my mobile phone +41 79 619 35 36. If I shouldn't pick up the phone, please leave me a message and I will get back to you. Best regards Andreas Sin

1 0

bb-hosts, host names
by joea＠j4computers.com 22 Aug '10

22 Aug '10

Is there a way to "escape" host name strings, in bb-hosts, to allow, say, spaces, in host names/descriptions? joe a.

3 2

New install, no hosts shown
by joea＠j4computers.com 22 Aug '10

22 Aug '10

In a new install of xymon, the base web page displays, but none of the hosts listed in bb-host will show. Not even the default host. Obviously, I have something mis configured. Thanks in advance

3 2

New install, no hosts shown - Never Mind
by joea＠j4computers.com 22 Aug '10

22 Aug '10

Removed dark glasses. Noted logs indicated typo in host IP. Recompiled. Working, so far, as expected. joe a. In a new install of xymon, the base web page displays, but none of the hosts listed in bb-host will show. Not even the default host. Obviously, I have something mis configured. Thanks in advance

1 0

client only shows conn, info and trends
by canghel＠cjh.org 20 Aug '10

20 Aug '10

Hello, I've added another redhat client to my xymon server. The client and the server are in the same network. The client has the redhat firewall disabled. I see in the /bbhome/client/tmp/clientname.txt that all the other reports are running for cpu, memory, messages...but for the life of me I can't figure out why I can't make the server get all that info.. I did a ping from server for client and it works I did a ping from client to server it says "client is alive" I don't know much about firewalls but I added other clients and all was fine.. Any suggestion will be appreciated. Thanks, Camelia

2 1

client only shows conn, info and trends
by mmoldvan＠csc.com 19 Aug '10

19 Aug '10

Hi Camelia, Have you tried checking your ghost clients list? The new client may not be matching 100% to the entry in your bb-hosts file. If that's the case, you can modify the xymon start up script for your clients to add FQDN, or use the "CLIENT: <alias>" in the bb-hosts file if changing the startup script isn't an option. Good luck, Matt. Unix System Administrator Computer Science Corporation This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. From: "Camelia Anghel" <canghel at cjh.org> To: <xymon at xymon.com> Date: 08/19/2010 09:54 AM Subject: [xymon] client only shows conn, info and trends Hello, I’ve added another redhat client to my xymon server. The client and the server are in the same network. The client has the redhat firewall disabled. I see in the /bbhome/client/tmp/clientname.txt that all the other reports are running for cpu, memory, messages…but for the life of me I can’t figure out why I can’t make the server get all that info.. I did a ping from server for client and it works I did a ping from client to server it says “client is alive” I don’t know much about firewalls but I added other clients and all was fine.. Any suggestion will be appreciated. Thanks, Camelia This is an e-mail from General Dynamics Land Systems. It is for the intended recipient only and may contain confidential and privileged information. No one else may read, print, store, copy, forward or act in reliance on it or its attachments. If you are not the intended recipient, please return this message to the sender and delete the message and any attachments from your computer. Your cooperation is appreciated.

1 0

Adding a custom RRD to graphs and monitoring
by mmoldvan＠csc.com 19 Aug '10

19 Aug '10

All, This is stressing me out, hopefully someone takes the time to go through my ramblings below and help me out. Lots of information so please bear with me. For the past few days I've been trying to add a custom script (iostat information) and have the data graphed, but I'm not having any luck (mostly due to not understanding the RRD definitions in hobbitgraph.cfg). I've read through a ton of the how-tos on the subject, but all of them seem to vary a bit on the details. My resulting graphs look like this: http://imgur.com/4Nwrp.jpg So far I've got a script running on two systems reporting data back to the main page. This brings up my first question: When sending information to be graphed, is the data passed in as a bb status message or a bb data message? I thought I had it working at one point by sending similar data below through a status message, but I'd like to pass only a status message and HTML through the "bb status" command and keep the actual data passed for the RRD in the "bb data" command if that works. I also tried wrapping the data below in HTML comments as below, but no luck. "" Sample data: c1t50060E80104AAE50d1 : 0.82 c1t50060E80104AAE50d2 : 0.07 c1t50060E80104AAE50d3 : 1.71 c1t50060E80104AAE50d4 : 0.46 c3t50060E80104AAE52d0 : 1.31 c3t50060E80104AAE52d1 : 1.53 c3t50060E80104AAE52d2 : 0.09 c3t50060E80104AAE52d3 : 3.14 c3t50060E80104AAE52d4 : 0.61 c3t50060E80104AAE52d12 : 0.06 c0t0d0 : 11.70 c1t50060E80104AAE50d0 : 0.87 I've seen it both ways in the examples. I tried sending both, but that doesn't seem to be working. From what I understand if I specify a test as NCV in the TEST2RRD section, one of the running processes (hobbitd or hobbitrrd) will read in the "name : value" pair and pass that to an RRD update/create command? Does that require integer values or are floating point up to a certain precision acceptable? Currently I'm passing .2f from the nawk script and getting a bunch of "nans" in the RRD output (could be various reasons, though). Here go the details (NOTE: All host names and IP addresses have been scrubbed to protect the innocent): Script output: + /opt/xymon/client/bin/bb <xymon.server.ip> 'data <client.fqdn>.trends c1t50060E80104AAE50d1 : 0.82 c1t50060E80104AAE50d2 : 0.07 c1t50060E80104AAE50d3 : 1.71 c1t50060E80104AAE50d4 : 0.46 c3t50060E80104AAE52d0 : 1.31 c3t50060E80104AAE52d1 : 1.53 c3t50060E80104AAE52d2 : 0.09 c3t50060E80104AAE52d3 : 3.14 c3t50060E80104AAE52d4 : 0.61 c3t50060E80104AAE52d12 : 0.06 c0t0d0 : 11.70 c1t50060E80104AAE50d0 : 0.87 ' + /opt/xymon/client/bin/bb <xymon.server.ip> 'status <client.fqdn>.iostat green Thu Aug 19 10:47:28 EDT 2010 c1t50060E80104AAE50d1 : 0.82 c1t50060E80104AAE50d2 : 0.07 c1t50060E80104AAE50d3 : 1.71 c1t50060E80104AAE50d4 : 0.46 c3t50060E80104AAE52d0 : 1.31 c3t50060E80104AAE52d1 : 1.53 c3t50060E80104AAE52d2 : 0.09 c3t50060E80104AAE52d3 : 3.14 c3t50060E80104AAE52d4 : 0.61 c3t50060E80104AAE52d12 : 0.06 c0t0d0 : 11.70 c1t50060E80104AAE50d0 : 0.87 ' Another question: I've seen some examples sending as "bb data <client.fqdn>.trends", is that correct, or if I'm using the "bb data" command do I have to specify the test name as above? The RRD files are thus being created for every disk as such: -rw-r--r-- 1 xymon 495 19648 Aug 19 11:06 iostat,c0t0d0.rrd -rw-r--r-- 1 xymon 495 19648 Aug 18 23:22 iostat,c0t1d0.rrd -rw-r--r-- 1 xymon 495 19648 Aug 19 11:06 iostat,c1t50060E80104AAE50d0.rrd ...snip... -rw-r--r-- 1 xymon 495 19648 Aug 18 23:22 iostat,c3t50060E80104AAE52d8.rrd -rw-r--r-- 1 xymon 495 19648 Aug 18 23:22 iostat,c3t50060E80104AAE52d9.rrd An rrdtool dump <whatever>.rrd does confirm that some values are making it into the RRDs (assuming so by "last_ds" in dump output below): [root@<hostname> <fqdn.rrd.dir>]# rrdtool dump iostat,c3t50060E80104AAE52d9.rrd | more <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE rrd SYSTEM "http://oss.oetiker.ch/rrdtool/rrdtool.dtd">  <rrd> <version>0003</version> <step>300</step>  <lastupdate>1282188121</lastupdate>  <ds> <name> lambda </name> <type> GAUGE </type> <minimal_heartbeat>0</minimal_heartbeat> <min>6.0000000000e+02</min> <max>NaN</max>  <last_ds>2.05</last_ds> <value>NaN</value> <unknown_sec> 121 </unknown_sec> </ds>  <rra> <cf>AVERAGE</cf> <pdp_per_row>1</pdp_per_row>  <params> <xff>5.0000000000e-01</xff> </params> <cdp_prep> <ds> <primary_value>NaN</primary_value> <secondary_value>0.0000000000e+00</secondary_value> <value>NaN</value> <unknown_datapoints>0</unknown_datapoints> </ds> </cdp_prep> <database>  <row><v>NaN</v></row> ...snip, all others are NaN also...  <row><v>NaN</v></row> </database> </rra> <rra> <cf>AVERAGE</cf> <pdp_per_row>6</pdp_per_row>  <params> <xff>5.0000000000e-01</xff> </params> <cdp_prep> <ds> <primary_value>0.0000000000e+00</primary_value> <secondary_value>0.0000000000e+00</secondary_value> <value>NaN</value> <unknown_datapoints>4</unknown_datapoints> </ds> </cdp_prep> <database>  <row><v>NaN</v></row> ...snip, all NaNs til the end... Relevant lines from /etc/xymon/hobbitserver.cfg: [root@<hostname> ~]# egrep 'TEST2RRD|GRAPHS' /etc/xymon/hobbitserver.cfg # TEST2RRD defines the status- and data-messages you want to collect RRD data TEST2RRD="cpu=la,disk,inode,qtree,memory,$PINGCOLUMN=tcp,http=tcp,dns=tcp,dig=tcp,time=ntpstat,vmstat,vmio=ncv, iostat=ncv ,netstat,temperature,apache,bind,sendmail,mailq,nmailq=mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,files,procs=processes,ports,clock,lines,ops,stats,cifs,JVM,JMS,HitCache,Session,JDBCConn,ExecQueue,JTA,TblSpace,RollBack,MemReq,InvObj,snapmirr,snaplist,snapshot" GRAPHS="la,disk,inode,qtree,files,processes,memory,users,vmstat:vmstat0|vmstat1|vmstat2|vmstat3|vmstat4|vmstat5|vmstat6|vmstat7|vmstat8|vmstat9, iostat ,vmio,tcp.http,tcp,netstat,ifstat,mrtg::1,ports,temperature,ntpstat,apache,bind,sendmail,mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,clock,lines,ops,stats,cifs,JVM,JMS,HitCache,Session,JDBCConn,ExecQueue,JTA,TblSpace,RollBack,MemReq,InvObj,snapmirr,snaplist,snapshot,devmon::1,if_load::1,temp, ncv" - (a tip from the web said "ncv" had to be in the GRAPHS portion and said "not sure why just trust me" ...) Relevant lines from /etc/xymon/hobbitgraph.cfg: [iostat] TITLE I/O Utilization - Overall FNPATTERN iostat(.*).rrd YAXIS Stats DEF:p at RRDIDX@=@RRDFN@:lambda:AVERAGE LINE1.5:p at RRDIDX@#@COLOR@:@RRDPARAM@ GPRINT:p at RRDIDX@:AVERAGE: \: %5.1lf (avg)\n Anyone know of a link that explains some of the terminology above? I checked the rrdcreate man page, but didn't see the parts about "@RRDIDX@" and @RRDFN@" and the other stuff. p at RRDIDX@ seems to be in a lot of examples I've seen, and all my data is making it in with those variables (is that what they are?) without having multiple DEF statements. The above is generating the image I included a link to above ( http://imgur.com/4Nwrp.jpg) Thanks again to anyone that can help out ... I've been pulling my hair out about this for a few days. Regards, Matt. Unix System Administrator Computer Science Corporation This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

1 0

Premature end of script headers: bb-histlog.sh
by vadud3＠gmail.com 19 Aug '10

19 Aug '10

I am getting core dump only for historical yellow data for some hosts. apache log: [Fri Jul 23 16:17:22 2010] [error] [client 192.168.0.94] Premature end of script headers: bb-histlog.sh, referer: https://xymon.example.net/hobbit-cgi/bb-hist.sh?HISTFILE=cer1cc-015.clientc… (hobbit)@xymon:~$ REQUEST_METHOD=GET SCRIPT_NAME=bb-histlog.sh QUERY_STRING="HOST=cer1cc-014.clientcare.example.net&SERVICE=cpu&TIMEBUF=Wed_Jul_21_14:56:42_2010" cgi-bin/bb-histlog.sh generates core dump. (hobbit)@xymon:~$ file core core: ELF 32-bit LSB core file 80386 Version 1, from 'hobbitsvc.cgi' (hobbit)@xymon:~$ gdb server/bin/hobbitsvc.cgi core [..] (gdb) backtrace #0 0xfed64fa1 in realfree () from /lib/libc.so.1 #1 0xfed655bf in cleanfree () from /lib/libc.so.1 #2 0xfed64adb in _malloc_unlocked () from /lib/libc.so.1 #3 0xfed64a04 in malloc () from /lib/libc.so.1 #4 0x08067621 in xmalloc (size=12) at memory.c:119 #5 0x0805a1f1 in expand_env (s=0x80707bb "4.2.3") at environ.c:296 #6 0x0805a08c in xgetenv (name=0x80715c9 "HOBBITDREL") at environ.c:165 #7 0x0805db08 in headfoot (output=0x8089e28, template=0x80717d3 "histlog", pagepath=0x80716c6 "", head_or_foot=0x80717f3 "header", bgcolor=4) at headfoot.c:1114 #8 0x0805f639 in generate_html_log (hostname=0x80913a8 "cer1cc-014.clientcare.example.net", displayname=0x80913a8 "cer1cc-014.clientcare.example.net", service=0x808aa90 "cpu", ip=0x8099168 "10.240.91.208", color=4, sender=0x80ad668 "10.240.91.208", flags=0x806ff21 "", logtime=0, timesincechange=0x8047bbc "0.00 minutes", firstline=0x8094128 "yellow Wed Jul 21 14:56:35 GMT 2010 up: 98 days, 0 users, 624 procs, load=7.51", restofmsg=0x80ae61f "&yellow Load is HIGH\nSystem clock is 0 seconds off\n\n\n\n\n 2:56pm up 98 days, 17:04, 0 users, load average: 9.38, 7.51, 4.34\n624 processes: 623 sleeping, 1 running, 0 zombie, 0 stopped\nCPU states: 0"..., acktime=0, ackmsg=0x0, acklist=0x0, disabletime=0, dismsg=0x0, is_history=1, wantserviceid=0, htmlfmt=0, hobbitd=0, multigraphs=0x8073060 ",disk,inode,qtree,quotas,snapshot,TblSpace,if_load,", linktoclient=0x808ae40 "bb-histlog.sh?CLIENT=cer1cc-014.clientcare.example.net&amp8TIMEBUF=1279724202", nkprio=0x0, nkttgroup=0x0, nkttextra=0x0, output=0x8089e28) at htmllog.c:150 #9 0x08054189 in do_request () at hobbitsvc.c:421 #10 0x0805530e in main (argc=4, argv=Cannot access memory at address 0x555202bc ) at hobbitsvc.c:518 Any one have a workaround? I tried to change the CFLAGS and recompile with gcc 4.3.4 replaced CFLAGS = -g -O2 -Wall -Wno-unused -D_REENTRANT $(LFSDEF) $(OSDEF) with CFLAGS = -g -O2 -Wall -D_REENTRANT $(LFSDEF) $(OSDEF) that did not help here. -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 4

Windows Event logs monitor added to Xymonton
by david.baldwin＠ausport.gov.au 18 Aug '10

18 Aug '10

This is my solution for the deficiencies of both BBNT's msgs and BBwin (broken in central mode) windows event log reporting. Neither effectively work for Vista/2008 to my knowledge. http://xymonton.trantor.org/doku.php/monitors:winevtmsgs.pl Reports on Windows Event logs forwarded with SNARE (a free Windows event log forwarder over syslog) http://www.intersectalliance.com/projects/SnareWindows/index.html Each Windows server needs the appropriate version of Snare installed (Vista/2008 different from older versions of Windows) and configured to forward to central syslog server. Install on central syslog server. Assumed this is the same as xymon server (need to use bb-hosts 'evt' tag to denote tested hosts). Sample config for using rsyslog documented. Can also report on cluster nodes and cluster resources (e.g. SQL or Exchange) - in such cases each cluster node forwards all events for all nodes. Highly configurable alerting on various event log fields by exact string match or regexp. Sample rule: # sample rule: # DCs (Domain Controllers) # host name specified by regexp # ignore System:MRxSMB 8003 messages about Browser service # yellow on System:KDC 26 messages (often Error, but not that significant) # green on System:NETLOGON (various) messages (often Error) about deleted/disabled/etc computer accounts # # "DCs" => { # "host" => qr/^(dc\d+)/i, # "ignore" => { # "Browser" => { # "src" => "System", # "cat" => "MRxSmb", # "evn" => qr/^(8003)$/, # }, # }, # "yellow" => { # "KDC" => { # "src" => "System", # "cat" => "KDC", # "evn" => "26", # }, # }, # "green" => { # "NoCompAcct" => { # "src" => "System", # "cat" => "NETLOGON", # "evn" => qr/^(5719|572[23]|5805)$/, # }, # }, # }, Any questions, suggestions, problems drop me a line. David. -- David Baldwin - IT Unit Australian Sports Commission www.ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617 ------------------------------------------------------------------------------------- Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender. -------------------------------------------------------------------------------------

2 5

Ping response time report and graphing dispaly incorrect.
by dennis.riley＠timken.com 17 Aug '10

17 Aug '10

Using Xymon 4.2.3 on CentOS 5.2. When pinging local hosts with sub-ms response times, like 0.25 ms, the Xymon conn display and graph treat it as 25 ms. However when pinging remote hosts which have a much larger response time (much greater than 1 ms), the display and graph seem to correctly reflect the response time. Has anyone else seen this? Dennis Riley Dennis.riley at timken.com ----------------------------------------- This message and any attachments are intended for the individual or entity named above. If you are not the intended recipient, please do not forward, copy, print, use or disclose this communication to others; also please notify the sender by replying to this message, and then delete it from your system. The Timken Company / The Timken Corporation

3 6