November 2011 - Xymon - Xymon mailman web

GROUPs and recovery alerts
by keenha＠googlemail.com 19 Jan '12

19 Jan '12

Hi, I want to be able to group servers so that alerts for one bunch of servers go to one group of people, and another group of servesr to another group of people. I used the following config - analysis.cfg: HOST=myhost.mydomain.com GROUP=mygroup PROC blah PROC blahblah DISK ....etc alerts.cfg: GROUP=mygroup NOTICE RECOVERED COLOR=red MAIL me at mydomain.com REPEAT=15 Now, I tested this by stopping one of the PROCs listed, and I successfully received the alert e-mail. However, when I restarted that process to clear the alert, the status goes green but I do not receive any recovery message. I also tried just having the GROUP defined against each individual PROC line (rather than against the HOST), but that didn't result in a recovery message either. Am I doing something wrong, or is this a bug? I can provide the debug output from the alert process if required. Cheers, Heather

5 13

Multiplicated Background-gif after update to 4.3.5
by hj.beckers＠kreis-steinfurt.de 12 Jan '12

12 Jan '12

After upgrading from 4.3.0b2 to 4.3.5 the background-gif on the service pages gets multiplicated across the page (see attached screenshot). The overview pages are ok. Any hints?

4 4

trend list
by olivier＠audry.fr 14 Dec '11

14 Dec '11

hello I can I query the xymon server to get the trend list ? thx oau

3 3

Issues after upgrade from 4.2.3 to 4.3.5
by skadz＠skadz.com 13 Dec '11

13 Dec '11

Hi All - I've been running hobbit/xymon for a long time, but I've finally just joined the list due to a number of issues after I upgraded from 4.2.3 to 4.3.5. I walked through and fixed all the file names and everything SEEMS ok, but am seeing a number of strange things: a) When I start up xymon, I don't get my previous state back. The xymond options have: --restart=/usr/lib/xymon/server/tmp/xymond.chk --checkpoint-file=/usr/lib/xymon/server/tmp/xymond.chk And the files has data: 8136 /usr/lib/xymon/server/tmp/xymond.chk But when I restart the server or service, I seem to lose all data and anything that has been disabled or acked is now once again back to it's starting state. b) I can't seem to add new machines. I add a machine to hosts.cfg and analysis.cfg and it shows up on the web page, but it never seems to actually receive any data. I've tried reloading the service, but that doesn't seem to help. I even tried something like: xymon localhost 'enable machine.company.com' But it did not help. I see on the Ghost client page that it seems to recognize the correlation as it has a candidate, but isn't doing anything. Do I need to do something different with this newer version to enable a machine instead of just adding it to the two files? c) Last issue is very similar to the previous issue. I removed a machine from the hosts.cfg file, then ran: xymon localhost 'drop machine.company.com' But when it didn't check in for an hour, it still seemingly went purple and sent out emails/pages. I did a reload on the service and this now seems to have stopped, but I don't think it should have happened in the first place. d) I get startup errors that don't seem to make a ton of sense: In xymonlaunch.log, I see: 2011-10-25 12:11:51 xymonlaunch starting 2011-10-25 12:11:51 Loading tasklist configuration from /usr/lib/xymon/server/etc/tasks.cfg 2011-10-25 12:11:51 Cannot open directory 2011-10-25 12:11:51 Loading hostnames 2011-10-25 12:11:51 Cannot load host data 2011-10-25 12:11:51 Loading saved state 2011-10-25 12:11:51 Cannot access checkpoint file /usr/lib/xymon/server/tmp/xymond.chk for restore 2011-10-25 12:11:51 Setting up network listener on 0.0.0.0:1984 2011-10-25 12:11:51 Setting up signal handlers 2011-10-25 12:11:51 Setting up xymond channels 2011-10-25 12:11:51 Setting up logfiles As I said, I am seeing all of the hosts that I have in the system and have double checked the permissions and the xymon user can most definitely access all of the files, so why am I getting these errors? [xymon at vir5ob xymon]$ whoami xymon [xymon at vir5ob xymon]$ wc -l /usr/lib/xymon/server/tmp/xymond.chk 8136 /usr/lib/xymon/server/tmp/xymond.chk [xymon at vir5ob xymon]$ ls -als /usr/lib/xymon/server/tmp/xymond.chk 31756 -rw-rw-r-- 1 xymon xymon 32474378 Oct 26 17:54 /usr/lib/xymon/server/tmp/xymond.chk I am also seeing: 2011-10-26 17:54:50 Cannot load host data in my xymond.log every 10 minutes. As I said, any files seem to be accessible as far as I can tell, but maybe since the error message is not very verbose, I am not looking in the right place. I know these probably all seem like newbie questions, but I have done all the debugging I seem to be able to do and can't figure anything out on these. Any help would be greatly appreciated. Thanks! Skadz

3 4

FW: FW: Regular expression
by Neil.Simmonds＠express-gifts.co.uk 13 Dec '11

13 Dec '11

With some assistance from users on here I've finally managed to get this working after starting with LOG %.* %.*error.* COLOR=red. Some careful and staged refinement of the regex got me to this, LOG %application "%Backup Exec System Recovery.{1,50}Error.*" COLOR=red That seems to work fine and gives me the level of granularity for the failures that I wanted. Thanks to all who helped. ________________________________ From: Lerch, Alfred [mailto:alfred_lerch at mentor.com] Sent: 28 September 2011 11:58 To: Neil Simmonds Subject: RE: [Xymon] FW: Regular expression I took me quite a bit of trial and horror to get log ignores to work with BBWin in central mode - and it isn't nice... I had a lot of PowerShell entries to suppress. Basically neither ignoring event types like success, informational etc. nor ignoring by event number seem to work. I finally went for ANALYSIS.CFG CLASS=mywinserver LOG %.* %^critical.* COLOR=red LOG %.* %^error.* COLOR=red LOG %.* %^failure.* COLOR=red LOG %.* %^warning.* COLOR=yellow CLIENT-LOCAL.CFG [mywinserver] eventlog:windows powershell:5120 ignore Engine state is changed from None to Available etc etc etc And make sure you are using the class in your bbwin.cfg on the client. Good luck Alfred From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds Sent: Freitag, 23. September 2011 15:37 To: xymon at xymon.com Subject: [Xymon] FW: Regular expression Thanks for that Daniel, It's still not working. I've even reduced it down to the following, LOG eventlog:application Error COLOR=red I've also tried LOG eventlog_application Error COLOR=red And LOG application Error COLOR=red All with no success. These entries are all in analysis.cfg on the server and the BBWin agent is running in central mode. I'd really like to get this working if anyone can help? Regards, Neil. ________________________________ From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of McDonald, Dan Sent: 22 September 2011 16:43 To: Xymon Subject: Re: [Xymon] Regular expression On 9/22/11 7:54 AM, "Neil Simmonds" <Neil.Simmonds at express-gifts.co.uk> wrote: > Hi all, > > I¹m trying to monitor a Windows event log for an error, > > I¹ve got BBWin 0.12 installed in central mode and I¹ve successfully got the > eventlogs showing up in messages, > > However if I get an error from Backup Exec similar to this, > > error - 2011/09/22 13:30:00 - Backup Exec System Recovery (100) - Error > EC8F17B7: Cannot create recovery points for job: BACKUP_SCHED_01_30_SAT. Error > E7B70001: Win32/Win64 API DeviceIoControl(IOCTL_VSNAP_VDIFF_STOP) failed. > Error EBAB03F1: The device does not recognize the command. Details: 0xE7B70001 > Source: Backup Exec System Recovery > > Despite the fact that I have this, ³LOG eventlog:Application %(Backup Exec > System Recovery\.+?|Error) COLOR=yellow² in my analysis.cfg file the color > doesn¹t change. Why did you escape the . ? If you remove the \ in front of the ., it might work better. I don't think you need to specify greediness either. In other projects we tend to be very suspicious of unqualified .+ expansions, as they can consume a lot of memory. You might try something like: %(Backup Exec System Recovery.{1,50}Error) That is read as "look for the exact words "Backup Exec System Recovery", followed by the word "Error" no more than 50 characters later..." -- Daniel J McDonald, CCIE # 2495, CISSP # 78281 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1

BBALPHAMSG truncated
by gjs＠sonnit.dk 08 Dec '11

08 Dec '11

I'm currently in the progress of upgrading/replacing my old hobbit version 4.2.0 to 4.3.4 I have installed on a brand new server and I'm just testing if everything is ok. My SMS alert script seems to work ok, but the BBALPHAMSG variable seems to be truncated to around 12-16 characters, leaving the status messages incomplete. I can easily add $DOWNSECS and/or $DOWNSECSMSG and they are added to the message which then is longer of cause. The exact same script works on my old server, and by manually setting the variables I can send any text I like. Anyone seen this behavior ? ---- Running on FreeBSD 8.2-RELEASE >From /var/log/xymon/alert.log: 2011-11-29 22:12:29 Paging script /usr/local/www/xymon/server/ext/kannel-sms.sh terminated by signal 60 (not sure if signal 60 is ok) ---- Best regards Gorm

3 12

"Stop after" not shown in the Info-Page, again
by martin.flemming＠desy.de 07 Dec '11

07 Dec '11

Hi ! I'm running xymon 4.3.5 and can't get the "Stop after" information shown on the info-page like in this very old thread http://lists.xymon.com/archive/2008-November/022162.html the code of lib/loadalerts.c should be ok ... my alert-config snip PAGE=services/door MAIL $XYMON COLOR=yellow,red DURATION<2h FORMAT=plain RECOVERED NOTICE With DURATION>2h or REPEAT=4h everything is shown on the info-page ... Got anybody an idea or got the same problem ? thanks & cheers Martin

2 1

xymon 4.3.5 errors
by tdiehl＠rogueind.com 06 Dec '11

06 Dec '11

Hi, I just upgraded from 4.3.4 to 4.3.5 and I am getting errors that I do not understand. I would appreciate it if someone could tell me what to look at to correct the errors in the following log snippets: ==> xymonlaunch.log <== 2011-09-20 16:06:59 xymonlaunch starting 2011-09-20 16:06:59 Loading tasklist configuration from /usr/lib/xymon/server/etc/tasks.cfg 2011-09-20 16:06:59 Loading hostnames 2011-09-20 16:06:59 Cannot load host data 2011-09-20 16:06:59 Loading saved state 2011-09-20 16:06:59 Setting up network listener on 0.0.0.0:1984 2011-09-20 16:06:59 Setting up signal handlers 2011-09-20 16:06:59 Setting up xymond channels 2011-09-20 16:06:59 Setting up logfiles ==> xymongen.log <== 2011-09-20 16:07:04 xymond status-board not available, code 0 2011-09-20 16:07:04 Failed to load current Xymon status, aborting page-update ==> history.log <== 2011-09-20 16:07:51 Peer not up, flushing message queue ==> rrd-status.log <== 2011-09-20 16:07:51 Peer not up, flushing message queue ==> xymond.log <== 2011-09-20 16:07:51 Whoops ! Failed to send message (timeout) 2011-09-20 16:07:51 -> 2011-09-20 16:07:51 -> Recipient '192.168.0.2', timeout 15 2011-09-20 16:07:51 -> 1st line: 'config hosts.cfg' 2011-09-20 16:07:51 Cannot load hosts.cfg from xymond, code 7 2011-09-20 16:07:51 Failed to load from xymond, reverting to file-load I am using the exact same hosts.cfg as I used with 4.3.4. selinux is in permissive and the permissions on hosts.cfg are as follows. (bugs pts10) # ll /etc/xymon/hosts.cfg -rw-r--r-- 1 root root 4255 Aug 30 04:57 /etc/xymon/hosts.cfg (bugs pts10) # In addition, restarting xymon clears all of the acks and disabled hosts. I can reset them without problem but I do not understand why they are getting deleted. If it matters the system is a Centos 5 i386 box. Regards, -- Tom Diehl tdiehl at rogueind.com Spamtrap address mtd123 at rogueind.com

3 3

ORA-12514 in xymon
by jtorwesten＠csc.com 06 Dec '11

06 Dec '11

Hello, in xymon we sometimes get the following error message output after adding a new database Oracle 10g and Oracle 11g. ORA-12514:TNS:listener does not currently know of service requested in connect descriptor (IDBD Error: OCIServerAttach) It's not a configuration error, SID, Port, Servername or IP adress are all configured properly. All other remote applications can connect with this values, only xymon has problems to connect. All our databases are configured in the same way in xymon, but only some of them show the ORA-12514 failure. Does anybody have seen this problem also in the past? Thank you Jens

2 1

FW: Xymon [491707] 211-Glendale:conn CRITICAL (RED)
by rroginela＠AmeriCashLoans.net 06 Dec '11

06 Dec '11

What would cause this????? This is new in 4.3.x I have a 4.2 box and this never happens.... Its like the status gets stuck.... Thank you, Rafal -----Original Message----- From: xymon at xymon Sent: Saturday, November 19, 2011 10:48 AM To: Monitoring Escelation Subject: Xymon [491707] 211-Glendale:conn CRITICAL (RED) green Sat Nov 19 10:47:31 2011 conn ok Service conn on 211-Glendale is OK (up) &green 10.xx.xx.1 is alive (30.5 ms) See http://xymon.americashloans.net/xymon-cgi/svcstatus.sh?HOST=211-Glendale&SE… <font face="Arial, Helvetica, sans-serif" color="#999999" size="-1"> This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden. (3.8)</font> <font face="Arial, Helvetica, sans-serif" color="#009900" size="-1"> Please consider the environment before printing this email. </font>

3 2