August 2011 - Xymon - Xymon mailman web

Assistance with Custom NCV graph on 4.3.4
by robert.e.gordon＠seagate.com 20 Aug '11

20 Aug '11

Hello - I recently added a few custom tests to my 4.3.4 installation and although the tests show up fine, the graphs are totally broken on the new tests... (All of the built in tests are working ok..).. In looking through the mailing list I was able to find several entries that said "try this" and "try that" however so far nothing has worked. (On a related note, the slab demo on the xymon site is experiencing similar issues..) Here is the information on the system.... Operating System: Ubuntu 11.04 64b Xymon Version: 4.3.4 ################################ ## Test Name: PPSmsgq ################################ QueueRelease : 0 spamdigest : 0 encrypt : 0 default : 0 postini : 0 decrypt : 0 primary : 1492 alert : 0 reinject : 0 tlsfallback : 0 spam5 : 0 googprod : 0 digest : 0 ################################ ## xymonserver.cfg ################################ TEST2RRD+=",esmtp,PPSmsgq=ncv,PPSMisc" GRAPHS+=",esmtp,PPSmsgq,PPSMisc" NCV_PPSmsgq="QueueRelease:GAUGE,spamdigest:GAUGE,encrypt:GAUGE,default:GAUGE,postini:GAUGE,decrypt:GAUGE,primary:GAUGE,alert:GAUGE,reinject:GAUGE,tlsfallback:GAUGE,spam5:GAUGE,googprod:GAUGE,digest:GAUGE" # NCV_PPSmsgq="*:GAUGE" (Note.. I have tried both the the NCV_PPSmsgq entries above...) ################################ ## graphs.cfg ################################ [PPSmsgq] TITLE Mail Queue Length YAXIS Queue Size DEF:primary=PPSmsgq.rrd:primary:GAUGE DEF:googprod=PPSmsgq.rrd:googprod:GAUGE LINE2:primary#@COLOR@ LINE2:googprod#@COLOR@ ################################ ## tasks.cfg ################################ [rrdstatus] ENVFILE /opt/xymon/server/etc/xymonserver.cfg NEEDS xymond CMD xymond_channel --channel=status --log=$XYMONSERVERLOGS/rrd-status.log xymond_rrd --rrddir=$XYMONVAR/rrd --extra-tests=PPSmsgq,PPSMisc # "rrddata" updates RRD files with information that arrives as "data" messages. [rrddata] ENVFILE /opt/xymon/server/etc/xymonserver.cfg NEEDS xymond CMD xymond_channel --channel=data --log=$XYMONSERVERLOGS/rrd-data.log xymond_rrd --rrddir=$XYMONVAR/rrd --extra-tests=PPSmsgq,PPSMisc ################################ ## RRD Datafile Head.... ################################ <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE rrd SYSTEM "http://oss.oetiker.ch/rrdtool/rrdtool.dtd">  <rrd> <version>0003</version> <step>300</step>  <lastupdate>1313802922</lastupdate>  <ds> <name> QueueRelease </name> <type> GAUGE </type> <minimal_heartbeat>600</minimal_heartbeat> <min>NaN</min> <max>NaN</max>  <last_ds>0</last_ds> <value>0.0000000000e+00</value> <unknown_sec> 0 </unknown_sec> </ds> .... snip .... <ds> <name> default </name> <type> GAUGE </type> <minimal_heartbeat>600</minimal_heartbeat> <min>NaN</min> <max>NaN</max>  <last_ds>0</last_ds> <value>0.0000000000e+00</value> <unknown_sec> 0 </unknown_sec> </ds> .... snip .... <ds> <name> googprod </name> <type> GAUGE </type> <minimal_heartbeat>600</minimal_heartbeat> <min>NaN</min> <max>NaN</max>  <last_ds>1</last_ds> <value>2.2000000000e+01</value> <unknown_sec> 0 </unknown_sec> </ds> .... snip ....  <row><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000 000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>5.6500000000e+02</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.00 00000000e+00</v><v>8.2700000000e+00</v><v>0.0000000000e+00</v></row>  <row><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000 000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>5.6911666667e+02</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.00 00000000e+00</v><v>3.0966666667e+00</v><v>0.0000000000e+00</v></row>  <row><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000 000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>5.6625666667e+02</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.0000000000e+00</v><v>0.00 00000000e+00</v><v>1.5133333333e+00</v><v>0.0000000000e+00</v></row> .... snip .... Data is going into the database..... Any suggestions on what I can try next? Thanks for the help - - Bob Gordon --- This message encrypted in Double-ROT-13 for your protection ---

3 3

Xymond and xymonnet quirks
by poppy.ben＠marshfieldclinic.org 19 Aug '11

19 Aug '11

And all sorts of other errors as well in CONN and HTTP tests.. I'm reverting back to original xymonnet -----Original Message----- From: Poppy, Ben Sent: Friday, August 19, 2011 2:05 PM To: 'henrik at hswn.dk'; xymon at xymon.com Subject: RE: [Xymon] Xymond and xymonnet quirks I got this error: Error output: Odd ... pending_dns_count=704 after a queue run The total time for dns tests dropped from over 300 to ~80 now.. -----Original Message----- From: henrik at hswn.dk [mailto:henrik at hswn.dk] Sent: Friday, August 19, 2011 6:37 AM To: xymon at xymon.com Cc: Poppy, Ben Subject: Re: [Xymon] Xymond and xymonnet quirks On Thu, 18 Aug 2011 21:59:32 +0200, Henrik Størner <henrik at hswn.dk> wrote: > On 18-08-2011 21:58, Poppy, Ben wrote: >> Will do. Any ideas on the DNS Tests item? > > I'm looking into it. Not sure yet if it is caused by Xymon, or by the > upgrade of the C-ARES library (which is used for all of the DNS stuff). Think I got it now. Would You mind trying out this patch for me ? To apply: cd xymon-4.3.4 patch -p0 < /tmp/dns-timeout.patch make cp -p ~xymon/server/bin/xymonnet ~xymon/server/bin/xymonnet.orig cp xymonnet/xymonnet ~xymon/server/bin/ This should enforce the normal timeout-setting for DNS tests also. Regards, Henrik ______________________________________________________________________ The contents of this message may contain private, protected and/or privileged information. If you received this message in error, you should destroy the e-mail message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained within. Please contact the sender and advise of the erroneous delivery by return e-mail or telephone. Thank you for your cooperation.

1 0

xymond, xymongen and xymonnet statistics
by greg.shea＠emc.com 18 Aug '11

18 Aug '11

Hi all, I have 4 Xymon servers in a new DataCenter. A primary and secondary display and a primary and secondary remote tests servers. I won't call them xymonnet servers because they're not. On my primary display server, all 4 servers are listed and I can see the xymond, xymongen and xymonnet statistics for the primary display server. How can I or is it even possible to have the other 3 servers send their xymon* statistics to the primary display? Name conn..... xymond xymongen xymonnet Primary Disp O O O O Secondary Disp O - - - Primary Synth O - - - Secondary Synth O - - - Anyone have any ideas? Thanks Greg Shea EMC Corporation

2 1

New server causing issues with CONN test
by poppy.ben＠marshfieldclinic.org 18 Aug '11

18 Aug '11

I'm having a pretty strange issue. We have our existing hobbit servers running on Fedora servers running hobbit 4.2.0. I'm working on installing brand new servers that will be running CentOS 6 64-bit and the latest version of xymon (4.3.3 before I saw 4.3.4 today). I did not see a fix to my issue in the 4.3.4 change log though, so figured I'd post here. In doing my update, I install the brand new server from scratch. Basically install CentOS 6 as a web server install, and then add in all the bits xymon needs (pcre, openssl, openldap, rrdtool, etc).. Then I compile and install xymon to /usr/lib/xymon. Next I copy over the bb-hosts file to the hosts.cfg, and follow the "migration" steps to get the data and configuration files over. Then I turn on xymon on the new server. Within a few minutes, 4 servers turn to red alerts on CONN on the existing Fedora based Hobbit servers. They begin flapping on and off of red alert until I shutdown the new CentOS xymon server. Within a few minutes of the new server being shut down, the alerts go away for good. I have tried going to Centos 5 32-bit, 64-bit, even trying xymon 4.2.3, or all the way back to hobbit 4.2.0 all with the same result, and the exact same 4 servers each time. I'm completely at a loss here. Does anyone know what may be causing these issues where the only difference is the OS being used (the distro, that is)? I just want to get our monitoring server upgraded to a stable OS, with updates, and get xymon up to date as well. Thanks, -Ben ______________________________________________________________________ The contents of this message may contain private, protected and/or privileged information. If you received this message in error, you should destroy the e-mail message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained within. Please contact the sender and advise of the erroneous delivery by return e-mail or telephone. Thank you for your cooperation.

4 9

alerting by OS type
by Neil.Simmonds＠express-gifts.co.uk 17 Aug '11

17 Aug '11

Hi all, I'd like to know if there is any way to configure alerts based on OS. I'd thought to change the hosts.cfg file and add a .win, .lin or .aix on the end of the hostname then use CLIENT and NAME parms to keep it working. That would then have enabled me to use host=*.lin etc in the alerts.cfg file. Unfortunately when I do this any centrally configured tests (i.e cpu, disk. Mem etc) turn purple after a while even though, when clicked on, the underlying layer is green and showing current data. We have a mix of Linux, AIX and Windows hosts and it would be really useful to me to be able to send alerts to different groups depending on the OS, however our server names don't comply to any standard that would allow me to use a regex to accomplish this. Has anyone any ideas how I might make this work. Thanks, Neil Simmonds Operations Analyst Operations Support Group Express Gifts Ltd. neil.simmonds at express-gifts.co.uk Tel :- 01254 303092 Fax :- 01254 303100 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1

Linux messages monitoring - best practice
by bb4＠richter-it.net 17 Aug '11

17 Aug '11

Hi folks, our company is switching from Solaris to Linux (Red Hat). And now I'm curious what patterns do you have for system log file monitoring since the messages and other files look slightly different from the ones in Solaris. Thanks Torsten

2 1

No REPEAT on SCRIPT for alerts
by MRowell＠shopzilla.com 17 Aug '11

17 Aug '11

Hi All, Interesting problem this one that I've yet to find a solution for, rather than sending an email out using the MAIL= keyword in the alerts.cfg we are just calling a script so the line looks like this HOST=* COLOR=RED REPEAT=6h SCRIPT /usr/local/bin/testscript.sh value However it appears that with the SCRIPT function and no MAIL function the REPEAT doesn't work, clicking info on an icon shows no change to the repeat and it's set at 30mins (default value possibly). If I switch it to MAIL from SCRIPT it all works fine and the REPEAT works correctly, any ideas, or am I going to have to write in a log of all alerts and make sure I don't send them outside the repeat inside my SCRIPT function? Cheers, Mike

1 1

problem with LOG and IGNORE in analysis.cfg
by Raymond.Lee＠CenturyLink.com 17 Aug '11

17 Aug '11

Hi, I have a server running Xymon 4.3.4 with a pretty basic analysis.cfg: DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST However, the IGNORE doesn't seem to work for the LOG line: (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com Hosttype []: sunos Test (cpu, mem, disk, proc, log, port): log log filename: /var/adm/messages To read log data from a file, enter '@FILENAME' at the prompt log line: ERROR this is just a TEST log line: Log status is red &red ERROR this is just a TEST What's funnier is that the log lines that should trigger a red alert are turning out to be green: (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com Hosttype []: sunos Test (cpu, mem, disk, proc, log, port): log log filename: /var/adm/messages To read log data from a file, enter '@FILENAME' at the prompt log line: this ERROR should be red log line: Log status is green Am I not using the LOG and IGNORE correctly in analysis.cfg, or is this a bug? Thanks, Ray This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

6 7

6 to 1 ratio on recovered messages to one red log file
by Tom.Stewart＠landsend.com 17 Aug '11

17 Aug '11

I have the August 1 patch for the recovery messages and add the Log ignore from last Friday. That help eliminate about 5000 messages a day! Now whenever I get a RED alerts from a log message, the recovered messages comes in 6 times for every 1 red Log message. Does anyone have any ideas. The analysis.cfg file is basically the same since Hobbit days. Tom

1 0

Log file monitoring
by Neil.Simmonds＠express-gifts.co.uk 16 Aug '11

16 Aug '11

Hi all, Perhaps we have unusual requirements but I've discovered an issue with Log file monitoring that I could do with a solution for. If we get some error messages in a log file than the msgs icon will successfully change colour, however if the next polling interval get's no error messages then it will revert to green. Unfortunately in our environment it is entirely possible that this brief colour change could be missed. I know I can configure alerts.cfg to send an alert out if we get any errors but what I would really like is a way to keep the colour change for a period of time after the log file entries appear. A bit like the new delayred/delayyellow functions but in reverse. Regards, Neil Simmonds Operations Analyst Operations Support Group Express Gifts Ltd. neil.simmonds at express-gifts.co.uk Tel :- 01254 303092 Fax :- 01254 303100 Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority ------------ NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0