December 2011 - Xymon - Xymon mailman web

Alerting - I'm not doing it right...
by Carl.Inglis＠rakon.com 15 Dec '11

15 Dec '11

Hi, You may have a point on the delay criteria. I'll try taking that out. Thanks! Carl [Rakon Logo] Carl Inglis Systems Administrator Rakon UK Limited Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 (0)1522 812630 | Fax:+44 (0) 1522 812664 | Mob: +44 (0) 7786 552915 Carl.Inglis at rakon.com | www.rakon.com Winner of the 2010 Lincolnshire Business of the Year Award This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments. From: Johan Sjöberg [mailto:Johan.Sjoberg at deltamanagement.se] Sent: 15 December 2011 11:15 To: Carl Inglis Subject: RE: Alerting - I'm not doing it right... Hi. Maybe it doesn't count as received if the delay of the first line hasn't been exceeded yet? I have to admit I haven't even seen this UNMATCHED feature before, so I thought all matching lines would generate an alert. /Johan From: Carl Inglis [mailto:Carl.Inglis at rakon.com] Sent: den 15 december 2011 12:12 To: Johan Sjöberg Subject: RE: Alerting - I'm not doing it right... Hi Johan, The relevant section of the Info page looks like this: winUpdates carl.inglis at rakon.com<mailto:carl.inglis at rakon.com> (R,S) 1d - 1d - purple,yellow,red carl.inglis at rakon.com<mailto:carl.inglis at rakon.com> (R,S,U) - - 1h - purple,yellow,red It would seem that I have misunderstood the UNMATCHED entry then. The man page says "The alert is sent to this recipient ONLY if no other recipients received an alert for this event. " I thought that it meant that for any given pass through alerts.cfg ("this event") the UNMATCHED recipient would only be emailed if the event hadn't triggered any other recipient. Regards, Carl From: xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com> [mailto:xymon-bounces at xymon.com]<mailto:[mailto:xymon-bounces at xymon.com]> On Behalf Of Johan Sjöberg Sent: 15 December 2011 10:31 To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] Alerting - I'm not doing it right... Hi. How does it look in the "Info" page for that server? Both alert lines would match that server, thus giving you an alert every hour, with an extra e-mail once per day, after a day, unless the server is in the printers page. If you don't want the second alert line to match that server/test, you need to exclude it. /Johan From: xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com> [mailto:xymon-bounces at xymon.com] On Behalf Of Carl Inglis Sent: den 15 december 2011 11:03 To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Alerting - I'm not doing it right... Hi folks, I'm sure this is going to be something really silly that I've missed - but I've been pulling my hair out over this one for a couple of days now. alerts.cfg $EMAIL_ALERT=carl.inglis at rakon.com<mailto:$EMAIL_ALERT=carl.inglis at rakon.com> $LIN_WINDOWS_PROBLEMS=$EMAIL_ALERT HOST=%lin(.*) SERVICE=%win(.*) MAIL $LIN_WINDOWS_PROBLEMS REPEAT=24h DURATION>1d RECOVERED STOP HOST=* EXPAGE=printers MAIL $EMAIL_ALERT REPEAT=1h RECOVERED UNMATCHED STOP When the host "lin-apps-01" has a yellow alert on it's "winUpdates" services, I expect it to shout about it once every 24h. It is, however, shouting about it once every hour. It's clear that the first HOST line is being ignored - I suspect my regex is incorrect in some way. Any thoughts or pointers would be appreciated. Regards, Carl [Winner of the NZ Hi-Tech Awards 2011 - Hi-Tech Company of the Decade] Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090. Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content.

1 0

RFE: Oracle tests
by colin.coe＠gmail.com 14 Dec '11

14 Dec '11

Hi Henrik Would it be possible to move the Oracle tests into Xymon instead of it being an addon? This would save people from having to look around for the oracle tests and wonder if it is: (a) trustworthy and (b) the latest version. I know there is currently a tnslistener test, just hoping for a bit more. TIA CC -- RHCE#805007969328369

1 0

Current Critical Systems
by mogabr＠hotmail.com 14 Dec '11

14 Dec '11

Hello i need help from all xymon experts how i can make Current Critical Systems acknowledge alerts stored to file or directory ? i want keep this data in flat file to import after that into db table please note i am asking about acknowledge alerts from Current Critical Systems page NOT normal acks alerts please help regards

1 0

delayred and delayyellow do not appear in info page
by spah＠syntec.co.uk 14 Dec '11

14 Dec '11

delayred and delayyellow do not appear in the info column status page (svcstatus.sh?HOST=<hostname>&SERVICE=info). I would expect them to appear perhaps under Other tags, or perhaps at the top of alerting before the table of alerts. This is on 4.3.7. 192.168.4.56 Db1 # delayred=special:10 delayyellow=special:5 Or does delayred and delayyellow not apply to custom tests? (If so, the docs do not mention this.) Kind regards, SebA

2 1

DISPLAYGROUP on alert.cfg
by jchen.nygh＠gmail.com 14 Dec '11

14 Dec '11

Thanks Henrik. Yes I meant "Not functioning". In my hosts.cfg, I have spaces on the group description, i.e.: group group 1 In alert.cfg, it works if I use: DISPLAYGROUP=%group.1 However, it fails if I use: DISPLAYGROUP="group 1" What is the best way to put a string (with space in it) in DISPLAYGROUP? John Chen ========= On 14-12-2011 17:02, John Chen wrote: >* I am using xmon-4.3.7 and xymon-4.3.5.*>* It seems the DISPLAYGROUP on alter.cfg is now functioning.* Assume you meant "NOT functioning" ... >* Can somebody share some examples for using "DISPLAYGROUP" on alert.cfg?* See www.xymon.com, the "External sites" page and "www.sslug.dk": http://www.xymon.com/xymon-cgi/svcstatus.sh?HOST=www.sslug.dk&SERVICE=info You can see the alert.cfg file on http://www.xymon.com/xymon-cgi/viewconf.sh?alert Regards, Henrik

2 1

uninstall Xymon
by Nelandran.Moodley＠standardbank.co.za 14 Dec '11

14 Dec '11

Hi How do I uninstall Xymon. Newbie Thanks Nelandran Moodley | Unix Systems Engineer | Group Technology Infrastructure | Standard Bank of South Africa | 44 Borrowdale Road | RiverClub | Sandton | RSA [cid:image001.png at 01CCBA4F.5132D3D0] nelandran.moodley at standardbank.co.za<mailto:Bongane.mabasa at standardbank.co.za> Office: +27 11 700 1542 Mobile: +27 82 7792059 Standard Bank email disclaimer and confidentiality note Please go to http://www.standardbank.co.za/site/homepage/emaildisclaimer.html to read our email disclaimer and confidentiality note. Kindly email disclaimer at standardbank.co.za (no content or subject line necessary) if you cannot view that page and we will email our email disclaimer and confidentiality note to you.

4 4

DISPLAYGROUP on alert.cfg
by jchen.nygh＠gmail.com 14 Dec '11

14 Dec '11

Hi All, I am using xmon-4.3.7 and xymon-4.3.5. It seems the DISPLAYGROUP on alter.cfg is now functioning. I have hosts.cfg as: ---------------------- page page1 page1-desc group group 1 xxx.xxx.xxx.xxx host1 # tests xxx.xxx.xxx.xxx host2 # tests group group 2 .... --------------------- And in "alert.cfg" I have: ----------------------- DISPLAYGROUP="group 1" COLOR=red RECOVERED MAIL alert at mail.local DURATION>5m REPEAT=24h ----------------------- Restart/Relod the xymon daemon, and then check the "info" on host1 and host2, I got: Alerting: No alerts defined Can somebody share some examples for using "DISPLAYGROUP" on alert.cfg? Thanks, John Chen =========

2 1

Xymon 4.3.7 released
by henrik＠hswn.dk 14 Dec '11

14 Dec '11

Hi, after a week of intensive bug-hunting - thanks to everyone who chimed in with new reports! - I have released Xymon 4.3.7. This simply has fixes for all the bugs found in the past week and reported on the mailing list: * Fix acknowledge CGI (broken in 4.3.6) * Fix broken uptime calculation for systems reporting "1 day" * Workaround Solaris breakage in the LFS-support detection * Fix/add links to the HTML man-page index. * Fix "Stop after" value not being shown on the "info" page. * Fix broken alert texts when using FORMAT=SMS * Fix wrong description of xymondboard CRITERIA in xymon(1) * Fix missing columnname in analysis.cfg(5) DS example * Fix missing space in output from disk IGNORE rules in xymond_client --dump-config * Fix overwrite of xymon-apache.conf when upgrading * Fix installation so it does not remove include/directory lines from configuration files. * Add client/local/ directory for custom client script It is available from the Sourceforge mirrors now. I have also uploaded a VMware image with a pre-installed Debian 6 plus Xymon 4.3.7. Regards, Henrik

4 3

BBwin crashing on one server
by Johan.Sjoberg＠deltamanagement.se 14 Dec '11

14 Dec '11

Hi. We have been using hobbit/Xymon for a very long time, with BBwin as windows client. I know BBwin is not an official client, but it feels like there is no other place for BBwin support. Yesterday I installed BBwin on three new servers (Windows 2008 R2 SP1). On one of them, it has crashed twice since then. I can't remember BBwin crashing ever on any other server. I am posting this here with the hope that someone else has experienced this, or might have any idea on how to start troubleshooting it. These are the errors generated in the event log when BBwin crashes: Log Name: Application Source: Application Error Date: 2011-12-09 06:41:06 Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: ncvib-web Description: Faulting application name: BBWin.exe, version: 0.12.0.100, time stamp: 0x484714cd Faulting module name: ntdll.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba58 Exception code: 0xc0000005 Fault offset: 0x00022373 Faulting process id: 0x4e4 Faulting application start time: 0x01ccb5ae6fd454a8 Faulting application path: C:\Program Files (x86)\BBWin\bin\BBWin.exe Faulting module path: C:\Windows\SysWOW64\ntdll.dll Report Id: 63695830-2228-11e1-8cc8-005056970016 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-12-09T05:41:06.000000000Z" /> <EventRecordID>1492254</EventRecordID> <Channel>Application</Channel> <Computer>ncvib-web</Computer> <Security /> </System> <EventData> <Data>BBWin.exe</Data> <Data>0.12.0.100</Data> <Data>484714cd</Data> <Data>ntdll.dll</Data> <Data>6.1.7601.17514</Data> <Data>4ce7ba58</Data> <Data>c0000005</Data> <Data>00022373</Data> <Data>4e4</Data> <Data>01ccb5ae6fd454a8</Data> <Data>C:\Program Files (x86)\BBWin\bin\BBWin.exe</Data> <Data>C:\Windows\SysWOW64\ntdll.dll</Data> <Data>63695830-2228-11e1-8cc8-005056970016</Data> </EventData> </Event> Log Name: System Source: Service Control Manager Date: 2011-12-09 06:41:07 Event ID: 7034 Task Category: None Level: Error Keywords: Classic User: N/A Computer: ncvib-web Description: The Big Brother Hobbit Client service terminated unexpectedly. It has done this 2 time(s). Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> <EventID Qualifiers="49152">7034</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8080000000000000</Keywords> <TimeCreated SystemTime="2011-12-09T05:41:07.049125000Z" /> <EventRecordID>32596</EventRecordID> <Correlation /> <Execution ProcessID="460" ThreadID="6280" /> <Channel>System</Channel> <Computer>ncvib-web</Computer> <Security /> </System> <EventData> <Data Name="param1">Big Brother Hobbit Client</Data> <Data Name="param2">2</Data> </EventData> </Event> Regards, Johan Sjöberg

2 2

xymon 4.3.6 Graph error
by Nelandran.Moodley＠standardbank.co.za 14 Dec '11

14 Dec '11

Hi I'm running xymon 4.3.6 and have installed it for the 1st time. This is a vanilla installation on solaris 10! I'm not able to display any graph telemetry, get the following error when I click on the graph icon "Garbage ': 14-Dec-2011 07:34:29' after command: COMMENT:Updated: 14-Dec-2011 07:34:29" Is there a bug with this version? Many thanks Nelandran Moodley | Unix Systems Engineer | Group Technology Infrastructure | Standard Bank of South Africa | 44 Borrowdale Road | RiverClub | Sandton | RSA [cid:image001.png at 01CCBA32.5C812380] nelandran.moodley at standardbank.co.za<mailto:Bongane.mabasa at standardbank.co.za> Office: +27 11 700 1542 Mobile: +27 82 7792059 Standard Bank email disclaimer and confidentiality note Please go to http://www.standardbank.co.za/site/homepage/emaildisclaimer.html to read our email disclaimer and confidentiality note. Kindly email disclaimer at standardbank.co.za (no content or subject line necessary) if you cannot view that page and we will email our email disclaimer and confidentiality note to you.

2 1