July 2011 - Xymon - Xymon mailman web

Feature request for log test
by Johan.Sjoberg＠deltamanagement.se 28 Sep '11

28 Sep '11

Hi. We have a syslog server which receives logs from a number of servers and network devices. Currently we use the log test in Xymon to check for errors in these logs, and it works fine. But it is a little blunt since all log test end up in the same msgs test. It could also be a problem if we get an error in one log file, and need to ack or disable the test. In this case we would not get any alert if there were errors in one of the other logs. It would have been nice if you could add a client definition to a logfile test in analysis.conf, and report each log file as the device which is originates from. Or maybe as a separate syslog test to distinguish it from the msgs test. This way we could also set up individual alerts for the different logged devices. I could, of course, write a client- or serverside script for this, but I always find it difficult to do good log monitoring scripts and it would be nice to be able to use the logic already in Xymon What do you think? Would anyone else be interested in this feature? I also have no idea how much work it would be. /Johan

4 5

How to get vmstat5 to show on Trends page
by pnixon＠gmail.com 15 Sep '11

15 Sep '11

Hey all, I'm trying to figure out how to get the vmstat5 graph to show up on the trends page for a 4.3.3 installation. I've tried adding vmstat5 to the GRAPHS statement in xymonserver.cfg, as well as vmstat::1, vmstat::5, etc with no success. Suggestions? Thanks! --Patrick

4 4

AIX df command problem
by sholmes42＠mac.com 13 Sep '11

13 Sep '11

I am having a problem similar to one recently posted, but this is on an AIX host and is caused (I think) by a problem in the way xymon does df on AIX. The xymon version is 4.2.3 and the AIX OS version is 3.5 (I think, I'm a Solaris Admin). Anyway, I can find no way to force the df on AIX to use POSIX formatting AND to report only local file systems. Even if I could, I don't think I can override what xymon uses for df since the comments in the hobbitclient.cfg file say that the envariable definition is only there for compatibility and it is not used. The problem is that an NFS mount file system line in the df output is being parsed wrong and the number in the usage column is being used for the percent used (Available) so that is a huge number. Not only that, again similar to the previous problem, the file system name is being picked up as the contents of the last 3 fields in the output line, i.e. it is not /mnt/tsmupdates (which is what it should be) but "3020485 50% /tsm/updates", which, of course, prevents me from effectively ignoring that file system. I've tried using DISK %.*/mnt/.* IGNORE and that doesn't work. Does anyone have any suggestions? We have a big red page where we shouldn't have. Thanks, Steve -- The test of a democracy is not the magnificence of buildings or the speed of automobiles or the efficiency of air transportation, but rather the care given to the welfare of all the people. -Helen Adams Keller, lecturer and author (1880-1968) Truth never damages a cause that is just. -Mohandas Karamchand Gandhi (1869-1948)

3 4

Double combo's - returning -1 - xymon 4.3.3
by david.gore＠one.verizon.com 13 Sep '11

13 Sep '11

Does anyone out there using double leveled combos, combos of combos that work? If so perhaps you could share an example from your config that works? Thanks in advance, Here is the example from the man pages: ---- WebCluster.http = (Web1.http || Web2.http) AppSrvCluster.procs = (AppSrv1.conn && AppSrv1.procs) || (AppSrv2.conn && AppSrv2.procs) Customer.cluster = WebCluster.http && AppSrvCluster.procs The first line defines a new test, with hostname "WebCluster" and the columnname "http". It will be green if the http test on either the "Web1" or the "Web2" server is green. The second line defines a "procs" test for the "AppSrvCluster" host. Each of the AppSrv1 and AppSrv2 hosts is checked for "conn" (ping) and their "procs" test. On each host, both of these must be green, but the combined test is green if that condition is fulfilled on just one of the hosts. The third line uses the two first tests to build a "double combined" test, defining a test that shows the overall health of the system. ---- So in theory it should work? For reference we are using Xymon 4.3.3 on RedHat Linux Enterprise 5.7. ~David From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Rager, Richard R (Rich) Sent: Thursday, June 30, 2011 19:02 To: xymon at xymon.com Subject: [Xymon] Double combo's - returning -1 - xymon 4.3.3 Hi, Anyone using double combo messages? I was following the man pages, which state they are possible, but my tests calculate "-1" and the color comes out $unknown. Thu Jun 30 18:43:24 2011 (iam.db&&gam.db) = (-1&&-1) = 1 &unknown iam.db &unknown gam.db Sample config from combo.cfg. I have changed hostnames to protect the innocent...combos based on the values returned by dbcheck.pl...our DB's are served on 4 node Oracle Grid clusters, which is why we have alias' for the DB, such as servername_dbname. Hostnames are defined in hosts.d as "0.0.0.0 gam # noconn nonongreen noproppurple:*" gam/iam/impact all defined the same in hosts. iam.db = (servername\_iam.audit && servername\_iam.conn && servername\_iam.extent && servername\_iam.info && servername\_iam.invobj && servername\_iam.locks && servername\_iam.rollback && servername\_iam.session && servername\_iam.tblspace && servername\_iam.trends && servername\_iam.uptime) gam.db = (servername\_gam.audit && servername\_gam.conn && servername\_gam.extent && servername\_gam.info && servername\_gam.invobj && servername\_gam.locks && servername\_gam.rollback && servername\_gam.session && servername\_gam.tblspace && servername\_gam.trends && servername\_gam.uptime) These two above work fine. They are single layer combo tests...All my single layer combo tests work. The double combo is this: impact.db = (iam.db && gam.db) - same with our without parenthesys...if I use single ampersand, color propogates up, but staus still shows &unknown. We have tried multiple combinations taking the combo down to barest form, and still get the errors (&unknown). Log doesn't really help... combostatus.log.1:21316 2011-06-30 03:58:03 Symbolic 'event.db&&gam.db&&iam.db&&jbpm.db' converted to '-1&&-1&&-1&&-1' I put the --debug on the cmd in tasks, and not logging much else helpful. Appreciate some thoughs or suggestions. Rich Rager VZB ________________________________________ This message was created by the sender using your @mci.com address. If you wish to continue to receive messages from this sender, please respond informing them to use your @verizonbusiness.com email address. The mci.com email domain will be decommissioned October 31, 2010. Please inform sender to use your @verizonbusiness.com address, if you desire to continue to receive messages from them. Thank You Verizon Business Messaging

2 1

disk reporting issue on xymon 4.3.0-beta2
by tlewick＠tradebotsystems.com 31 Jul '11

31 Jul '11

Has anyone seen similar issues as below? Very rarely, we get false positives due to disk and process data coming from hosts being somewhat garbled. However, across several hundred hosts, it happens just often enough to be annoying. Below is an example of the disk issue from one of our xymon clients. As you can see, the disks were actually not above 30% utilized, and the alert cleared the next cycle. Just wondering if this has been resolved in later xymon versions? We are running xymon 4.3.0-0.beta2 Wed Jul 6 08:0]:30 CDT 2011 - Filesystems NOT ok 22% / (102738628% used) has reached the PANIC level (97%) 29% /boot (351664% used) has reached the PANIC level (97%) Filesystem ] 1]24-blocks Used Available Capacity Mounted on /dev/sda7 137886784 28143896 102738628 22% / /dev/sda6 521064 142932 351664 29% /boot Next update cycle, everything is fine. Wed Jul 6 08:11:31 CDT 2011 - Filesystems OK Filesystem 1024-blocks Used Available Capacity Mounted on /dev/sda7 137886784 28144080 102738444 22% / /dev/sda6 521064 142932 351664 29% /boot

4 6

Payed support
by jef.jagers＠thomsonreuters.com 31 Jul '11

31 Jul '11

Hi Hendrik, Jeff, Although my google search probably provided me with an answer to my question I wanted to ask you just to make sure. Is there any payed support available for xymon? Regards, Jef Jagers

2 1

Apache tag not working, not playing nice with http tag.
by betsy.schwartz＠gmail.com 31 Jul '11

31 Jul '11

I've been trying to get apache results and am getting nothing, no results, no errors, as if it the tag wasn't there. UNLESS, and this is the weird part - *IF* I disable http for a given server I get *stats* under apache on the trends page, but still no apache column on the server page. Disabling http is not an option, as we've got nonstandard ports getting tested. With any http test enabled, just get blank "nan" values for apache. And no matter what, we don't get an apache column. Xymon server is xymon 4.3.2 on Oracle Enterprise Linux; most of the clients are running the latest apache and Solaris 10 u9. servers have ExtendedStatus On curl on the xymon server returns the expected stats with "curl http://myserver.example.com/server-status?auto" have tested using just a plain "apache" tag in hosts.cfg and apache=http://myserver.example.com/server-status?auto

3 5

use of aberrant behavior detection
by Mario.Contreras＠tigo.com.co 31 Jul '11

31 Jul '11

Hi We are using xymon/devmon pair and we want to use for some tests the "aberrant behavior detection" of RRDTOOL. Could someone please tell me what changes are necessary in XYMON configuration files to do so? I saw a similar question in the mail list back in 2005 but with no answer. Best regards Mario Contreras mario.contreras at tigo.com.co <mailto:mario.contreras at tigo.com.co> Este mensaje (incluyendo cualquier anexo) contiene informaci�n confidencial que se encuentra protegida por la ley. La informaci�n que contiene s�lo puede ser utilizada por la persona o la compa��a a la cual est� dirigido. Si usted no es un receptor autorizado, o por error recibe el mensaje, omita su contenido y elim�nelo inmediatamente. Cualquier retenci�n, difusi�n, distribuci�n y/o copia as� como la ejecuci�n de cualquier acci�n basado en el contenido del mismo, se encuentra estrictamente prohibido, y esta amparado por la ley. -------------- This message (including any attachments) contains confidential information intented for a specific individual and purpose, and is protected by law. If you are not the intented recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.

2 1

Patch: rrd disk fix
by malcolm.hunter＠gmx.com 30 Jul '11

30 Jul '11

Hi, This is a patch to fix a bug with parsing of disk data for RRD graphing. The original code assumed that if the drive letter was longer than one character, the system was actually a UNIX system. In fact, this column also holds the directory where volumes can be mounted - just like with UNIX systems. The patch removes this restriction - so it now only checks if there's a '/' at the start of the first column. Regards, Malcolm Index: xymond/rrd/do_disk.c =================================================================== --- xymond/rrd/do_disk.c (revision 6701) +++ xymond/rrd/do_disk.c (working copy) @@ -103,8 +103,7 @@ * So check if there's a slash in the NT filesystem letter - if yes, * then it's really a Unix system after all. */ - if ( (dsystype == DT_NT) && (*(columns[5])) && - ((strchr(columns[0], '/')) || (strlen(columns[0]) > 1)) ) + if ( (dsystype == DT_NT) && (*(columns[5])) && (strchr(columns[0], '/')) ) dsystype = DT_UNIX; switch (dsystype) {

2 1

upgrading to 4.3.3 on proxy, having issues.
by Paul.Root＠qwest.com 29 Jul '11

29 Jul '11

I have a proxy server that was running 4.2.3, and I upgraded to 4.3.3 The proxy came up and is updating the primary server. However, the proxy is also running the server on port 1985, and it's not updating. I've been changing the environment variables from BB... to XYMON... (BBSERVERLOGS becomes XYMONSERVERLOGS) and the commands from hobbit... and bb... to xymon... (bbgen becomes xymongen, etc). I'm seeing in the following error in xymon-display.log: xymon-display.log:2011-07-29 16:02:02 Failed to load current Xymon status, aborting page-update xymon-display.log:2011-07-29 16:03:03 Failed to load current Xymon status, aborting page-update xymon-display.log:2011-07-29 16:04:03 Failed to load current Xymon status, aborting page-update xymon-display.log:2011-07-29 16:05:03 Failed to load current Xymon status, aborting page-update xymon-display.log:2011-07-29 16:08:21 Failed to load current Xymon status, aborting page-update xymon-display.log:2011-07-29 16:09:23 Failed to load current Xymon status, aborting page-update It's got to be some communication between xymond and xymongen right? Any ideas? Thanks, Paul. $ ps -ef |grep xymon xymon 25002 1 0 16:08 ? 00:00:00 /usr/lib64/xymon/server/bin/xymonlaunch --config=/usr/lib64/xymon/server/etc/tasks.cfg --env=/usr/lib64/xymon/server/etc/xymonserver.cfg --log=/var/log/xymon/xymonlaunch.log --pidfile=/var/log/xymon/xymonlaunch.pid xymon 25003 25002 0 16:08 ? 00:00:00 xymond --listen=0.0.0.0:1985 --pidfile=/var/log/xymon/xymond.pid --restart=/usr/lib64/xymon/server/tmp/hobbitd.chk --checkpoint-file=/usr/lib64/xymon/server/tmp/hobbitd.chk --checkpoint-interval=600 --log=/var/log/xymon/xymond.log --admin-senders=127.0.0.1 204.155.141.230 --store-clientlogs=!msgs xymon 25004 25002 0 16:08 ? 00:00:00 /usr/lib64/xymon/server/bin/bbproxy --hobbitd --bbdisplay=127.0.0.1:1985,207.225.133.169,204.155.141.212 --listen=0.0.0.0 1984 --report=stnxymproxy.bbproxy --no-daemon --pidfile=/var/log/xymon/bbproxy.pid xymon 25107 1 0 16:08 ? 00:00:00 sh -c vmstat 300 2 1>/usr/lib64/xymon/server/tmp/xymon_vmstat.stnxymproxy.25013 2>&1; mv /usr/lib64/xymon/server/tmp/xymon_vmstat.stnxymproxy.25013 /usr/lib64/xymon/server/tmp/xymon_vmstat.stnxymproxy xymon 25108 25107 0 16:08 ? 00:00:00 vmstat 300 2 xymon 25110 25002 0 16:08 ? 00:00:00 xymond_channel --channel=stachg --log=/var/log/xymon/history.log xymond_history xymon 25111 25002 0 16:08 ? 00:00:00 xymond_channel --channel=page --log=/var/log/xymon/page.log xymond_alert --checkpoint-file=/usr/lib64/xymon/server/tmp/alert.chk --checkpoint-interval=600 xymon 25112 25002 0 16:08 ? 00:00:00 xymond_channel --channel=client --log=/var/log/xymon/clientdata.log xymond_client xymon 25113 25002 37 16:08 ? 00:00:42 xymond_channel --channel=status --log=/var/log/xymon/rrd-status.log xymond_rrd --rrddir=/var/lib/xymon/rrd xymon 25114 25002 42 16:08 ? 00:00:48 xymond_channel --channel=data --log=/var/log/xymon/rrd-data.log xymond_rrd --rrddir=/var/lib/xymon/rrd xymon 25115 25002 0 16:08 ? 00:00:00 xymond_channel --channel=clichg --log=/var/log/xymon/hostdata.log xymond_hostdata xymon 25124 25112 0 16:08 ? 00:00:00 xymond_client xymon 25125 25110 0 16:08 ? 00:00:00 xymond_history xymon 25139 25111 0 16:09 ? 00:00:00 xymond_alert --checkpoint-file=/usr/lib64/xymon/server/tmp/alert.chk --checkpoint-interval=600 Paul Root - Engineer III - Qwest is becoming CenturyLink This communication is the property of Qwest and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0