October 2011 - Xymon - Xymon mailman web

GROUPs and recovery alerts
by keenha＠googlemail.com 19 Jan '12

19 Jan '12

Hi, I want to be able to group servers so that alerts for one bunch of servers go to one group of people, and another group of servesr to another group of people. I used the following config - analysis.cfg: HOST=myhost.mydomain.com GROUP=mygroup PROC blah PROC blahblah DISK ....etc alerts.cfg: GROUP=mygroup NOTICE RECOVERED COLOR=red MAIL me at mydomain.com REPEAT=15 Now, I tested this by stopping one of the PROCs listed, and I successfully received the alert e-mail. However, when I restarted that process to clear the alert, the status goes green but I do not receive any recovery message. I also tried just having the GROUP defined against each individual PROC line (rather than against the HOST), but that didn't result in a recovery message either. Am I doing something wrong, or is this a bug? I can provide the debug output from the alert process if required. Cheers, Heather

5 13

Multiplicated Background-gif after update to 4.3.5
by hj.beckers＠kreis-steinfurt.de 12 Jan '12

12 Jan '12

After upgrading from 4.3.0b2 to 4.3.5 the background-gif on the service pages gets multiplicated across the page (see attached screenshot). The overview pages are ok. Any hints?

4 4

Issues after upgrade from 4.2.3 to 4.3.5
by skadz＠skadz.com 13 Dec '11

13 Dec '11

Hi All - I've been running hobbit/xymon for a long time, but I've finally just joined the list due to a number of issues after I upgraded from 4.2.3 to 4.3.5. I walked through and fixed all the file names and everything SEEMS ok, but am seeing a number of strange things: a) When I start up xymon, I don't get my previous state back. The xymond options have: --restart=/usr/lib/xymon/server/tmp/xymond.chk --checkpoint-file=/usr/lib/xymon/server/tmp/xymond.chk And the files has data: 8136 /usr/lib/xymon/server/tmp/xymond.chk But when I restart the server or service, I seem to lose all data and anything that has been disabled or acked is now once again back to it's starting state. b) I can't seem to add new machines. I add a machine to hosts.cfg and analysis.cfg and it shows up on the web page, but it never seems to actually receive any data. I've tried reloading the service, but that doesn't seem to help. I even tried something like: xymon localhost 'enable machine.company.com' But it did not help. I see on the Ghost client page that it seems to recognize the correlation as it has a candidate, but isn't doing anything. Do I need to do something different with this newer version to enable a machine instead of just adding it to the two files? c) Last issue is very similar to the previous issue. I removed a machine from the hosts.cfg file, then ran: xymon localhost 'drop machine.company.com' But when it didn't check in for an hour, it still seemingly went purple and sent out emails/pages. I did a reload on the service and this now seems to have stopped, but I don't think it should have happened in the first place. d) I get startup errors that don't seem to make a ton of sense: In xymonlaunch.log, I see: 2011-10-25 12:11:51 xymonlaunch starting 2011-10-25 12:11:51 Loading tasklist configuration from /usr/lib/xymon/server/etc/tasks.cfg 2011-10-25 12:11:51 Cannot open directory 2011-10-25 12:11:51 Loading hostnames 2011-10-25 12:11:51 Cannot load host data 2011-10-25 12:11:51 Loading saved state 2011-10-25 12:11:51 Cannot access checkpoint file /usr/lib/xymon/server/tmp/xymond.chk for restore 2011-10-25 12:11:51 Setting up network listener on 0.0.0.0:1984 2011-10-25 12:11:51 Setting up signal handlers 2011-10-25 12:11:51 Setting up xymond channels 2011-10-25 12:11:51 Setting up logfiles As I said, I am seeing all of the hosts that I have in the system and have double checked the permissions and the xymon user can most definitely access all of the files, so why am I getting these errors? [xymon at vir5ob xymon]$ whoami xymon [xymon at vir5ob xymon]$ wc -l /usr/lib/xymon/server/tmp/xymond.chk 8136 /usr/lib/xymon/server/tmp/xymond.chk [xymon at vir5ob xymon]$ ls -als /usr/lib/xymon/server/tmp/xymond.chk 31756 -rw-rw-r-- 1 xymon xymon 32474378 Oct 26 17:54 /usr/lib/xymon/server/tmp/xymond.chk I am also seeing: 2011-10-26 17:54:50 Cannot load host data in my xymond.log every 10 minutes. As I said, any files seem to be accessible as far as I can tell, but maybe since the error message is not very verbose, I am not looking in the right place. I know these probably all seem like newbie questions, but I have done all the debugging I seem to be able to do and can't figure anything out on these. Any help would be greatly appreciated. Thanks! Skadz

3 4

FW: FW: Regular expression
by Neil.Simmonds＠express-gifts.co.uk 13 Dec '11

13 Dec '11

With some assistance from users on here I've finally managed to get this working after starting with LOG %.* %.*error.* COLOR=red. Some careful and staged refinement of the regex got me to this, LOG %application "%Backup Exec System Recovery.{1,50}Error.*" COLOR=red That seems to work fine and gives me the level of granularity for the failures that I wanted. Thanks to all who helped. ________________________________ From: Lerch, Alfred [mailto:alfred_lerch at mentor.com] Sent: 28 September 2011 11:58 To: Neil Simmonds Subject: RE: [Xymon] FW: Regular expression I took me quite a bit of trial and horror to get log ignores to work with BBWin in central mode - and it isn't nice... I had a lot of PowerShell entries to suppress. Basically neither ignoring event types like success, informational etc. nor ignoring by event number seem to work. I finally went for ANALYSIS.CFG CLASS=mywinserver LOG %.* %^critical.* COLOR=red LOG %.* %^error.* COLOR=red LOG %.* %^failure.* COLOR=red LOG %.* %^warning.* COLOR=yellow CLIENT-LOCAL.CFG [mywinserver] eventlog:windows powershell:5120 ignore Engine state is changed from None to Available etc etc etc And make sure you are using the class in your bbwin.cfg on the client. Good luck Alfred From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds Sent: Freitag, 23. September 2011 15:37 To: xymon at xymon.com Subject: [Xymon] FW: Regular expression Thanks for that Daniel, It's still not working. I've even reduced it down to the following, LOG eventlog:application Error COLOR=red I've also tried LOG eventlog_application Error COLOR=red And LOG application Error COLOR=red All with no success. These entries are all in analysis.cfg on the server and the BBWin agent is running in central mode. I'd really like to get this working if anyone can help? Regards, Neil. ________________________________ From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of McDonald, Dan Sent: 22 September 2011 16:43 To: Xymon Subject: Re: [Xymon] Regular expression On 9/22/11 7:54 AM, "Neil Simmonds" <Neil.Simmonds at express-gifts.co.uk> wrote: > Hi all, > > I¹m trying to monitor a Windows event log for an error, > > I¹ve got BBWin 0.12 installed in central mode and I¹ve successfully got the > eventlogs showing up in messages, > > However if I get an error from Backup Exec similar to this, > > error - 2011/09/22 13:30:00 - Backup Exec System Recovery (100) - Error > EC8F17B7: Cannot create recovery points for job: BACKUP_SCHED_01_30_SAT. Error > E7B70001: Win32/Win64 API DeviceIoControl(IOCTL_VSNAP_VDIFF_STOP) failed. > Error EBAB03F1: The device does not recognize the command. Details: 0xE7B70001 > Source: Backup Exec System Recovery > > Despite the fact that I have this, ³LOG eventlog:Application %(Backup Exec > System Recovery\.+?|Error) COLOR=yellow² in my analysis.cfg file the color > doesn¹t change. Why did you escape the . ? If you remove the \ in front of the ., it might work better. I don't think you need to specify greediness either. In other projects we tend to be very suspicious of unqualified .+ expansions, as they can consume a lot of memory. You might try something like: %(Backup Exec System Recovery.{1,50}Error) That is read as "look for the exact words "Backup Exec System Recovery", followed by the word "Error" no more than 50 characters later..." -- Daniel J McDonald, CCIE # 2495, CISSP # 78281 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1

xymon 4.3.5 errors
by tdiehl＠rogueind.com 06 Dec '11

06 Dec '11

Hi, I just upgraded from 4.3.4 to 4.3.5 and I am getting errors that I do not understand. I would appreciate it if someone could tell me what to look at to correct the errors in the following log snippets: ==> xymonlaunch.log <== 2011-09-20 16:06:59 xymonlaunch starting 2011-09-20 16:06:59 Loading tasklist configuration from /usr/lib/xymon/server/etc/tasks.cfg 2011-09-20 16:06:59 Loading hostnames 2011-09-20 16:06:59 Cannot load host data 2011-09-20 16:06:59 Loading saved state 2011-09-20 16:06:59 Setting up network listener on 0.0.0.0:1984 2011-09-20 16:06:59 Setting up signal handlers 2011-09-20 16:06:59 Setting up xymond channels 2011-09-20 16:06:59 Setting up logfiles ==> xymongen.log <== 2011-09-20 16:07:04 xymond status-board not available, code 0 2011-09-20 16:07:04 Failed to load current Xymon status, aborting page-update ==> history.log <== 2011-09-20 16:07:51 Peer not up, flushing message queue ==> rrd-status.log <== 2011-09-20 16:07:51 Peer not up, flushing message queue ==> xymond.log <== 2011-09-20 16:07:51 Whoops ! Failed to send message (timeout) 2011-09-20 16:07:51 -> 2011-09-20 16:07:51 -> Recipient '192.168.0.2', timeout 15 2011-09-20 16:07:51 -> 1st line: 'config hosts.cfg' 2011-09-20 16:07:51 Cannot load hosts.cfg from xymond, code 7 2011-09-20 16:07:51 Failed to load from xymond, reverting to file-load I am using the exact same hosts.cfg as I used with 4.3.4. selinux is in permissive and the permissions on hosts.cfg are as follows. (bugs pts10) # ll /etc/xymon/hosts.cfg -rw-r--r-- 1 root root 4255 Aug 30 04:57 /etc/xymon/hosts.cfg (bugs pts10) # In addition, restarting xymon clears all of the acks and disabled hosts. I can reset them without problem but I do not understand why they are getting deleted. If it matters the system is a Centos 5 i386 box. Regards, -- Tom Diehl tdiehl at rogueind.com Spamtrap address mtd123 at rogueind.com

3 3

Devmon Templates for Cisco Routers
by MNeumark＠savemart.com 14 Nov '11

14 Nov '11

Hey does anyone happen to have a template they are willing to share to monitor VPN connections on the Cisco 2800 series routers? Matt

2 1

MS SQL Devmon Template
by MNeumark＠savemart.com 14 Nov '11

14 Nov '11

Does anyone have a MS SQL devmon template that they are willing to share? Thank, Matt

2 1

secondary/slave dns server monitoring
by naveen＠lastninja.net 14 Nov '11

14 Nov '11

Hi, When specifying dns tests in the hosts.cfg file, does xymon perform a dns/dig lookup to the server IP address, or is it a lookup using the resolver of the server hosting xymon? I want to construct some tests to ensure that DNS is active/resolving for a secondary/slave DNS servers without requiring the server to run the agent. Thanks. -- Naveen Nathan To understand the human mind, understand self-deception. - Anon

2 1

http test question
by tlewick＠tradebotsystems.com 10 Nov '11

10 Nov '11

Hi all. Is it possible to control the times an HTTP URL test is performed? I know I can add http://www.sample.com and use regexs to look for an occurrence of the word Fail, but we would only like it to check once or twice per day, say at 7:45 and then once more at 8:25. I know its easy to control the timing of when the alert is sent. But can I limit when the test is run? Short of creating an ext-script, not sure how I do that in xymon. Thanks, Taylor

5 5

Can Alerts Be Configured Based on Page-->Group?
by Ed.Stuart＠austinenergy.com 10 Nov '11

10 Nov '11

Is there a way to configure alerts based on membership in a group on a page? There is a page qualifier, but we would like to apply specific rules for servers in particular groups on pages. If not, is there a way to apply rules to particular hosts on a page? **Please apply a generous amount of all the usual disclaimers here.**

3 4