August 2011 - Xymon - Xymon mailman web

xymond, xymongen and xymonnet statistics
by greg.shea＠emc.com 18 Aug '11

18 Aug '11

Hi all, I have 4 Xymon servers in a new DataCenter. A primary and secondary display and a primary and secondary remote tests servers. I won't call them xymonnet servers because they're not. On my primary display server, all 4 servers are listed and I can see the xymond, xymongen and xymonnet statistics for the primary display server. How can I or is it even possible to have the other 3 servers send their xymon* statistics to the primary display? Name conn..... xymond xymongen xymonnet Primary Disp O O O O Secondary Disp O - - - Primary Synth O - - - Secondary Synth O - - - Anyone have any ideas? Thanks Greg Shea EMC Corporation

2 1

New server causing issues with CONN test
by poppy.ben＠marshfieldclinic.org 18 Aug '11

18 Aug '11

I'm having a pretty strange issue. We have our existing hobbit servers running on Fedora servers running hobbit 4.2.0. I'm working on installing brand new servers that will be running CentOS 6 64-bit and the latest version of xymon (4.3.3 before I saw 4.3.4 today). I did not see a fix to my issue in the 4.3.4 change log though, so figured I'd post here. In doing my update, I install the brand new server from scratch. Basically install CentOS 6 as a web server install, and then add in all the bits xymon needs (pcre, openssl, openldap, rrdtool, etc).. Then I compile and install xymon to /usr/lib/xymon. Next I copy over the bb-hosts file to the hosts.cfg, and follow the "migration" steps to get the data and configuration files over. Then I turn on xymon on the new server. Within a few minutes, 4 servers turn to red alerts on CONN on the existing Fedora based Hobbit servers. They begin flapping on and off of red alert until I shutdown the new CentOS xymon server. Within a few minutes of the new server being shut down, the alerts go away for good. I have tried going to Centos 5 32-bit, 64-bit, even trying xymon 4.2.3, or all the way back to hobbit 4.2.0 all with the same result, and the exact same 4 servers each time. I'm completely at a loss here. Does anyone know what may be causing these issues where the only difference is the OS being used (the distro, that is)? I just want to get our monitoring server upgraded to a stable OS, with updates, and get xymon up to date as well. Thanks, -Ben ______________________________________________________________________ The contents of this message may contain private, protected and/or privileged information. If you received this message in error, you should destroy the e-mail message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained within. Please contact the sender and advise of the erroneous delivery by return e-mail or telephone. Thank you for your cooperation.

4 9

alerting by OS type
by Neil.Simmonds＠express-gifts.co.uk 17 Aug '11

17 Aug '11

Hi all, I'd like to know if there is any way to configure alerts based on OS. I'd thought to change the hosts.cfg file and add a .win, .lin or .aix on the end of the hostname then use CLIENT and NAME parms to keep it working. That would then have enabled me to use host=*.lin etc in the alerts.cfg file. Unfortunately when I do this any centrally configured tests (i.e cpu, disk. Mem etc) turn purple after a while even though, when clicked on, the underlying layer is green and showing current data. We have a mix of Linux, AIX and Windows hosts and it would be really useful to me to be able to send alerts to different groups depending on the OS, however our server names don't comply to any standard that would allow me to use a regex to accomplish this. Has anyone any ideas how I might make this work. Thanks, Neil Simmonds Operations Analyst Operations Support Group Express Gifts Ltd. neil.simmonds at express-gifts.co.uk Tel :- 01254 303092 Fax :- 01254 303100 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1

Linux messages monitoring - best practice
by bb4＠richter-it.net 17 Aug '11

17 Aug '11

Hi folks, our company is switching from Solaris to Linux (Red Hat). And now I'm curious what patterns do you have for system log file monitoring since the messages and other files look slightly different from the ones in Solaris. Thanks Torsten

2 1

No REPEAT on SCRIPT for alerts
by MRowell＠shopzilla.com 17 Aug '11

17 Aug '11

Hi All, Interesting problem this one that I've yet to find a solution for, rather than sending an email out using the MAIL= keyword in the alerts.cfg we are just calling a script so the line looks like this HOST=* COLOR=RED REPEAT=6h SCRIPT /usr/local/bin/testscript.sh value However it appears that with the SCRIPT function and no MAIL function the REPEAT doesn't work, clicking info on an icon shows no change to the repeat and it's set at 30mins (default value possibly). If I switch it to MAIL from SCRIPT it all works fine and the REPEAT works correctly, any ideas, or am I going to have to write in a log of all alerts and make sure I don't send them outside the repeat inside my SCRIPT function? Cheers, Mike

1 1

problem with LOG and IGNORE in analysis.cfg
by Raymond.Lee＠CenturyLink.com 17 Aug '11

17 Aug '11

Hi, I have a server running Xymon 4.3.4 with a pretty basic analysis.cfg: DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST However, the IGNORE doesn't seem to work for the LOG line: (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com Hosttype []: sunos Test (cpu, mem, disk, proc, log, port): log log filename: /var/adm/messages To read log data from a file, enter '@FILENAME' at the prompt log line: ERROR this is just a TEST log line: Log status is red &red ERROR this is just a TEST What's funnier is that the log lines that should trigger a red alert are turning out to be green: (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com Hosttype []: sunos Test (cpu, mem, disk, proc, log, port): log log filename: /var/adm/messages To read log data from a file, enter '@FILENAME' at the prompt log line: this ERROR should be red log line: Log status is green Am I not using the LOG and IGNORE correctly in analysis.cfg, or is this a bug? Thanks, Ray This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

6 7

6 to 1 ratio on recovered messages to one red log file
by Tom.Stewart＠landsend.com 17 Aug '11

17 Aug '11

I have the August 1 patch for the recovery messages and add the Log ignore from last Friday. That help eliminate about 5000 messages a day! Now whenever I get a RED alerts from a log message, the recovered messages comes in 6 times for every 1 red Log message. Does anyone have any ideas. The analysis.cfg file is basically the same since Hobbit days. Tom

1 0

Log file monitoring
by Neil.Simmonds＠express-gifts.co.uk 16 Aug '11

16 Aug '11

Hi all, Perhaps we have unusual requirements but I've discovered an issue with Log file monitoring that I could do with a solution for. If we get some error messages in a log file than the msgs icon will successfully change colour, however if the next polling interval get's no error messages then it will revert to green. Unfortunately in our environment it is entirely possible that this brief colour change could be missed. I know I can configure alerts.cfg to send an alert out if we get any errors but what I would really like is a way to keep the colour change for a period of time after the log file entries appear. A bit like the new delayred/delayyellow functions but in reverse. Regards, Neil Simmonds Operations Analyst Operations Support Group Express Gifts Ltd. neil.simmonds at express-gifts.co.uk Tel :- 01254 303092 Fax :- 01254 303100 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------ NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0

Neotel Security forwarded attachment
by Neotel-Security＠neotel.co.za 16 Aug '11

16 Aug '11

The entire message "Re: [Xymon] Critical Systems 'Hosts docs'-URL does not show correct URL", originally sent to you by xymon-bounces at xymon.com (xymon-bounces at xymon.com) has been forwarded to you from the Microsoft Forefront Server Security Quarantine area. This message may have been re-scanned by Microsoft Forefront Server Security and handled according to the appropriate scan job's settings. <<Entire Message.eml>>

1 0

monitoring multiple logfiles
by gatis.anee＠gmail.com 16 Aug '11

16 Aug '11

Hi, I am monitoring multiple text based logfiles with xymon and having a following problem. If "msgs" is already red because of an error in one logfile and at the same time while "msgs" is still red new error comes in into another(or the same no matter) logfile I will not get any notification about that.. Is there any way how can we deal with that? Thank you!

2 1