May 2011 - Xymon - Xymon mailman web

external script: listzone 4 solaris
by work＠infomaniak.ch 09 May '11

09 May '11

Hello, we got a lot of machines which hosts numbers of zones. And as zone can move from one host to an other, I've made a simple script that keeps track of all of them. more info on: https://github.com/briner/listzone-solaris-4-xymon Regards cED

1 1

logfile monitoring
by gatis.anee＠gmail.com 09 May '11

09 May '11

Hi, I have configured xymon to monitor log files and using "GROUP" option on different patterns it sends out emails to different recipients, but the problem is that if the "msgs" is already red because of pattern1, then if pattern2 will show up at the same time alert won't be sent out. Is there any way how we can solve it? I am still using 4.2.2 if that is changing something. Thanks!

1 0

Weird value in devmon graph
by olivier＠audry.fr 09 May '11

09 May '11

many thx I will do this oau ----- Mail original ----- De: "W.J.M. Nelis" <Wim.Nelis at nlr.nl> À: "Olivier AUDRY" <olivier at audry.fr> Envoyé: Lundi 9 Mai 2011 13:52:50 Objet: Re: [Xymon] Weird value in devmon graph Hello, > during two days this week end we got very huge value in all my devmon graph. See the attachement. Since this morning no more issue. > > any idee ? Perhaps we can add a max value at the rrd creation ? > We see similar graphs from a few devices which at random times reset all their SNMP counters. If the throughput is measured using a 32-bit counter, and if you are using type COUNTER in the RRD, a reset of a counter is interpreted as a counter-wrap. With an polling frequency of once per 120 seconds, you will see peaks of up to 290 [Mb/s]. This explains that there might be peaks, it does not explain that the peak-values are effectivly the same in the instances shown. If a reset of the SNMP counters turns out to be the cause, you could solve it (A) by using 64-bit counters or (B) by using type DERIVE in RRD combined with a lower limit of zero. The limit will "annihilate" any negative derivates. Kind regards, Wim Nelis. ******************************************************************************************************* The NLR disclaimer (http://www.nlr.nl/emaildisclaimer) is valid for NLR e-mail messages. *******************************************************************************************************

1 0

Core dump in svcstatus.c (historylog) with empty TIMEBUF
by jlaidman＠rebel-it.com.au 09 May '11

09 May '11

Folks I can crash svcstatus, causing a core dump, by doing a historylog query with an empty TIMEBUF value (or setting it to things like "%00"). It's indirectly caused by a successful stat() on a directory and then assuming that it's a file, but subsequent reads from the directory causes chaos with pointers. My fix is to catch the special case of a directory. I suspect the log file handling code that comes after stat() could be made a bit more suspicious/robust, but I don't have sufficient skill to do this task myself. Here's my patch: --- web/svcstatus.c.orig 2011-05-06 15:36:11.000000000 +1000 +++ web/svcstatus.c 2011-05-09 15:30:18.000000000 +1000 @@ -467,7 +467,7 @@ p = tstamp; while ((p = strchr(p, '_')) != NULL) *p = ' '; sethostenv_histlog(tstamp); - if ((stat(logfn, &st) == -1) || (st.st_size < 10)) { + if ((stat(logfn, &st) == -1) || (st.st_size < 10) || S_ISDIR(st.st_mode)) { errormsg("Historical status log not available\n"); return 1; } Cheers Jeremy

2 2

wrong XYMONDREL in html-sides
by martin.flemming＠desy.de 09 May '11

09 May '11

Hi ! I've got the curious problem, that on my pages, right at the bottom, the false xymon-version will be displayed ... only on the last page (host/service-only) is the right one 4.3.3 to see .... it seems that the XYMONDREL-Variable won't be exported :-( .. here the output ot the last lines of my xymon.html <TABLE SUMMARY="Bottomline" WIDTH="100%"> <TR> <TD> <HR WIDTH="100%"> </TD> </TR> <TR> <TD ALIGN=RIGHT><FONT FACE="Arial, Helvetica" SIZE="-2" COLOR="silver"><B><A HREF="http://xymon.sourceforge.net/" style="text-decoration: none">Xymon 4.3.0-0.20101114.beta3</A></B></FONT></TD> </TR> </TABLE> Any hints, what's going wrong ? Thanks & cheers Martin

1 0

[xymon] Re: holes in trend graphs
by jlaidman＠rebel-it.com.au 06 May '11

06 May '11

Has anyone made progress with this? I have the exact same problem with no solution and nothing interesting in the logs. As soon as I disable caching on xymond_rrd, the gaps go away. However as soon as I did this, the graphs for "cpu load" and "users and processes" both stopped updating completely. All other trend graphs are perfect. None of the network tests had a problem, so this seems to be restricted to numbers coming from the xymon client as "client data". -----Original Message----- From: "Stewart, Tom L." <Tom.Stewart (at) landsend.com> Date: Wed, 12 Jan 2011 09:18:03 -0600 To: xymon (at) xymon.com Subject: [xymon] Re: holes in trend graphs I believe Henrik has found and fixed this issue, but I don't know if it is in the beta3 version. He has been talking about a new release. Tom -----Original Message----- From: Dominique Frise [mailto:dominique.frise (at) unil.ch] Sent: Wednesday, January 12, 2011 2:08 AM To: xymon (at) xymon.com Subject: [xymon] Re: holes in trend graphs

3 8

Xymon 4.3.3 released, including security-related bugfixes
by henrik＠hswn.dk 06 May '11

06 May '11

Hi, Xymon version 4.3.3 is now available for download from Sourceforge. This release contains some important security-related bugfixes - essentially, some of the Xymon CGI scripts can be abused to read any file on the webserver. So upgrading is highly recommended. Some of these issues are probably present in all of the older 4.0.x and 4.2.x versions, so if you haven't upgraded to 4.3.x yet, this might be a good opportunity to do so. I would like to thank Jeremy Laidman for reporting this issue. A couple of other bugfixes were also included in this version. Here's the full list: * SECURITY FIX: Some CGI parameters were used to construct filenames of historical logfiles without being sanitized, so they could be abused to read files on the webserver. * SECURITY FIX: More cross-site scripting vulnerabilities. * Remove extra "," before "History" button on status-view * Critical view: Shring priority-column to 10% width * hosts.cfg loader: Check for valid IP spec (nibbles in 0-255 range). Large numbers in a nibble were accepted, triggering problems when trying to ping the host. * Alert macros no longer limited to 8kB Regards, Henrik

1 0

Directory traversal vulnerability in svcstatus.c (historylog)
by jlaidman＠rebel-it.com.au 06 May '11

06 May '11

Peoples I've discovered a directory traversal vulnerability in the svcstatus.c file, allowing a remote attacker to view any file on the filesystem that's visible to the web server user. When viewing a specific historical entry, and then setting the parameter for TIMEBUF to "../../../..(etc)/path/to/file" you get to view the file. For example: http://somesite.com/xymon-cgi/historylog.sh?HOST=somehost&SERVICE=conn&TIME… Here's a patch to prevent it: ---- web/svcstatus.c.orig 2011-05-06 12:12:45.000000000 +1000 +++ web/svcstatus.c 2011-05-06 13:20:47.000000000 +1000 @@ -83,6 +83,12 @@ else if (strcasecmp(cwalk->name, "TIMEBUF") == 0) { /* Only for the historical logs */ tstamp = strdup(cwalk->value); + char *p = basename(tstamp); + /* Sanity check timestamp to avoid dir traversal attacks */ + if (strcmp(p,tstamp) != 0) { + errormsg("Invalid time specification\n"); + return 1; + }; } else if (strcasecmp(cwalk->name, "CLIENT") == 0) { char *p; I'm not a C coder, so there's an excellent chance someone else can come up with a better patch. It would be nice to log an error into the web server log, but it doesn't work for me, and I'm guessing the xymon CGI process closes stderr when it starts up or something like that. Cheers Jeremy

2 1

nongreen.html
by vadud3＠gmail.com 05 May '11

05 May '11

The nongreen.html file shows the host type and description from info column gets appended into the hostname. It was not like that with bb2.html This is an upgrade from hobbit 4.2.0 to xymon 4.3.2 So among other stuff I have the Host type and Description shows in info column as always https://xymon.example.net/hobbit-cgi/svcstatus.sh?HOST=storage.example.net&… Host type: Array Description: Loc 38B, S/N 12345678 However this info now gets appended into the host name in nongreen.html page like below and makes the page real wide with even longer description https://xymon.example.net/hobbit/nongreen.html storage.example.net (Array:Loc 38B, S/N 12345678) list of services column I must have managed to break a template? I removed the server/web/* and just uploaded /usr/src/xymon-4.3.2/xymond/webfiles/* using tar. Thanks -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

2 2

DNS timeout not working
by ragonlan＠gmail.com 05 May '11

05 May '11

Hi, Since I installed version 4.3 (previous version may have same issue) DNS timeout stopped working. In Task.cfg I put this line: CMD xymonnet --report --ping --checkresponse --timeout=10 --dns-timeout=15 But dns-timeout didn't solve the issue. When I put a host that doesn't response to DNS, time-out is too large: Wed May 4 16:03:59 2011 dns NOT ok Service dns on HS-755 is not OK : Service unavailable Timeout Seconds: 178.169 If I remove dns-timeout parameter DNS check time is even greater: Service dns on HS-755 is not OK : Service unavailable Timeout Seconds: 356.336 With DNS test enabled: << TIME SPENT Event Start time Duration xymonnet startup 1357697.287237 - Service definitions loaded 1357697.287887 0.000650 Tests loaded 1357697.293270 0.005382 DNS lookups completed 1357699.442598 2.149328 Test engine setup completed 1357699.445198 0.002600 TCP tests completed 1357711.442436 11.997237 PING test completed (108 hosts) 1357719.107813 7.665377 PING test results sent 1357719.108279 0.000465 Test result collection completed 1357719.108485 0.000205 LDAP test engine setup completed 1357719.108485 0.000000 LDAP tests executed 1357719.108486 0.000000 LDAP tests result collection completed 1357719.108486 0.000000 DNS tests executed 1357897.279645 178.171159 Test results transmitted 1357897.281396 0.001751 xymonnet completed 1357897.282446 0.001049 TIME TOTAL 199.995208 >> Without DNS test: << TIME SPENT Event Start time Duration xymonnet startup 64910.045082 - Service definitions loaded 64910.045765 0.000682 Tests loaded 64910.051131 0.005365 DNS lookups completed 64910.055655 0.004524 Test engine setup completed 64910.058453 0.002797 TCP tests completed 64911.034675 0.976221 PING test completed (105 hosts) 64912.167164 1.132489 PING test results sent 64912.168239 0.001074 Test result collection completed 64912.168467 0.000227 LDAP test engine setup completed 64912.168467 0.000000 LDAP tests executed 64912.168468 0.000000 LDAP tests result collection completed 64912.168468 0.000000 DNS tests executed 64912.177910 0.009441 Test results transmitted 64912.179840 0.001930 xymonnet completed 64912.181299 0.001459 TIME TOTAL 2.136217 >> Does anyone know how to fix it? If I put many DNS test failures the whole xymon get purple because xymonnet don't do DNS test in parallel but in serial (one after other). thank for you time,

3 2