January 2012 - Xymon - Xymon mailman web

Is there a way to do trend analysis or prediction or anomaly detection with Xymon?
by jddcef＠gmail.com 31 Jan '12

31 Jan '12

Hi there, Is there a plugin or feature of xymon that anyone knows of that allows one to do anomaly detection on the graph data? i.e. if there is nonstandard behavior on the graph that stands out, and you want it to be investigated. Kind regards, David

3 2

[xymon] log parsing on windows
by massimiliano.angei＠akhela.com 27 Jan '12

27 Jan '12

Hi all, Is it possible to monitor log files (not event viewer) under windows machines? For example *.log files containing particular patterns (error strings…) I'm trying Bbwin client but using central mode I'm only capable to parse event log. Maybe someone has an external that affords this feature… thanks in advance! Massimiliano A.

3 2

[XYMON] New sever with Solaris or Linux
by gbegin＠csc.com 27 Jan '12

27 Jan '12

Hello, I'm planning to install a new XYMON server and have to decide which OS to use. I can install Solaris or Linux (RedHat, Suse). What are the pro and con according to you? I'm planning to use about 3 xymonproxies and at least 1000 clients (potentially up to 6000). What about using SAN disks ? Cordialement, Regards,Mit freundlichen Grüßen, Gautier BEGIN Admin and Tools Team CSC Computer Sciences Luxembourg S.A. 12D Impasse Drosbach L-1882 Luxembourg Global Outsourcing Service | p:+352 24 834 276 | m:+352 621 229 172 | gbegin at csc.com | www.csc.com CSC • This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose • CSC Computer Sciences SAS • Registered Office: Immeuble Le Balzac, 10 Place des Vosges, 92072 Paris La Défense Cedex, France • Registered in France: RCS Nanterre B 315 268 664

5 6

Remove An Alert for a Specific Server
by Ed.Stuart＠austinenergy.com 26 Jan '12

26 Jan '12

Hello; we are running Xymon 4.2.0. We have a number of our alerts and triggers set up on a page basis. How can we disable the alert for one category for server on a page without disabling it for all the servers defined on that page? For example, if all the servers were defined to be on page Example and we had a trigger that for all servers on page Example where we are montoring the existence of an ntp process how could we disable the monitor for the ntp process for just one server on that page? Ed There's no place like 127.0.0.1

2 1

Can I monitor how many connections are in TIME_WAIT for a specific port
by Paul.Root＠CenturyLink.com 25 Jan '12

25 Jan '12

Hi, We are monitoring a particular port that we are having issues with. 8022, it's a proxy port for HP NA. Anyway, I have an expect script that goes in and tests the functionality of the port. But when it starts to go bad, this script get stuck in TIME_WAIT, along with the users connecting to the port. So, can I look at the port data before I try connecting, and if there are a bunch of TIME_WAIT connections, just skip the test entirely? I'm running the test from the xymon server, so I was thinking of pulling the data out of xymon directly. Would that by xymoncmd? Thanks, Paul. Paul Root - Engineer III Managed Services Systems - CenturyLink This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

4 8

Log message "Data flooding from"
by hj.beckers＠kreis-steinfurt.de 25 Jan '12

25 Jan '12

What does the above message mean? The client sends oversized packages as well: xymond.log:2012-01-25 08:15:36 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:20:45 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:25:53 Oversize stachg msg from xymond for myclient:msgs truncated (n=523042, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize page/ack/notify msg from xymond for myclient:msgs truncated (n=523073, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize status msg from xymond for myclient:msgs truncated (n=523071, limit=262144) xymond.log:2012-01-25 08:25:54 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:31:03 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:36:13 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:41:22 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:46:33 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:51:42 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 My xymonserver.cfg contains: MASXMSG_STATUS="5000000" MASXMSG_CLIENT="5000000" MASXMSG_DATA="5000000" The status line for the client shows all entries besides "conn" as purple. Any suggestions? Hermann-Josef Beckers

2 2

Problem with TIME qualifier to PORT test
by jlaidman＠rebel-it.com.au 24 Jan '12

24 Jan '12

Oh wise people of the Xymon clan I occasionally have logrotate spawn a post-rotate process that hangs and needs to be manually killed. This is easily detected because the parent process also persists as "/bin/sh /etc/cron.daily/logrotate". I want to detect when logrotate has been running for more than an hour, and as it starts at 1am, I added the following line into my hosts' analysis.cfg file: PROC "%^/bin/sh /etc/cron.daily/logrotate" 0 0 "TEXT=/etc/cron.daily/logrotate" TIME=*:0200:0100 My understanding is that this makes the rule apply only between 2am and 1am, or in other words, forces "green" between 1am and 2am. I added this line yesterday. Alas, 2 out of 6 hosts showed a red "procs" alert at around 10 seconds after 1am (when logrotate runs), for 5 minutes. So it failed for me. Curiously, two servers that have an ongoing problem with a hung logrotate process (which inspired the check I'm trying to implement) showed green for the hour from 1am to 2am, then went back to red. So this indicates that the time qualifier is being handled correctly by those servers. I can't figure out why it went red for the other servers that don't have a hung logrotate process. Any ideas? Perhaps this is due to time lag between the client data delivery and the analysis. I wonder if I should change the timespec to "TIME=*:0200:0055"? Cheers Jeremy

1 0

Configure custom msgs "history" for individual host
by Johan.Sjoberg＠deltamanagement.se 24 Jan '12

24 Jan '12

Hi. By default, the msgs test checks 30 minutes log history. Is it possible to override this for a specific host? /Johan

2 1

NOPROPYELLOW:disk
by Neil.Simmonds＠express-gifts.co.uk 24 Jan '12

24 Jan '12

On our AIX servers we have NOPROPYELLOW:disk in the hosts.cfg however we have now realised that for 1 particular filesystem we do want the yellow to propagate. Is there any way to do this? Thanks, Neil Simmonds Operation Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1

Problem with "xymon download filename" in 4.3.5
by Ralf.Zeiss＠aiinformatics.com 24 Jan '12

24 Jan '12

Hello, I try to get a configuration for an external with the download option. The File is located in Servers Download folder. First download works fine. But when I edit the File and change something I get the old Version on download. Looks like a cached File. When I restart Xymon services on the Server I'll get the correct file. Is it a Bug or a Feature or is there any Configswitch to disable the cache? Greetings Ralf ________________________________ applied international informatics GmbH Sitz der Gesellschaft: Berlin; Registergericht: Berlin-Charlottenburg HRB 77891B Geschaeftsfuehrung: Josef Duermoser, Michael Bihn Wichtiger Hinweis: Diese E-Mail und etwaige Anlagen koennen Betriebs- oder Geschaeftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrtuemlich erhalten haben, ist Ihnen der Status dieser E-Mail bekannt. Bitte benachrichtigen Sie uns in diesem Fall sofort durch Antwort-Mail und loeschen Sie diese E-Mail nebst etwaigen Anlagen von Ihrem System. Ebenso duerfen Sie diese E-Mail oder ihre Anlagen nicht kopieren oder an Dritte weitergeben. Vielen Dank! Important Note: This e-mail and any attachment are confidential and may contain trade secrets or otherwise protected from disclosure. If you have received it in error, you are on notice of its status. Please notify us immediately by reply e-mail and then delete this e-mail and any attachment from your system. If you are not the intended recipient please understand that you must not copy this e-mail or any attachment or disclose the contents to any other person. Thank you!

2 3