January 2012 - Xymon - Xymon mailman web

makerpm.sh
by Paul.Root＠CenturyLink.com 31 Jan '12

31 Jan '12

Just how does one use build/makerpm.sh to create an rpm? I'm trying to use it to build just the client, and it's trying to build rrdtool, and I know I don't need that on a client. Paul Root - Senior Engineer Managed Services Systems - CenturyLink This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 2

Load Average threshold - a mathematic rule regarding the number of threads ?
by nicolas＠lienard.name 31 Jan '12

31 Jan '12

Hello Our LA rule is currently "LOAD 5 10" but we can't apply this kind of rule automatically for all our devices anymore. Indeed, we have more and more devices with many threads. I'd like to know if people have the same issue because it's very annoying to override the LOAD when we could automatize it. For instance we would like to follow this kind of rule: 1 cpu : "LOAD 2 4" 2 cpu : "LOAD 4 8" 2 cpu, 12 threads by cpu (=24 threads in total) : "LOAD 48 96" We could calculate it with n=`grep -ci process /proc/cpuinfo` and applying LOAD "n x2" "n x4" It is possible to have this kind of feature ? Anybody else is interested by that ? how do you handle your Load Average threshold ? CHeers Nico

2 1

ping.jsp is empty, Xymon considers this an error
by nleskiw＠gmail.com 31 Jan '12

31 Jan '12

The applications we're testing use an empty ping.jsp page. Xymon considers no content an error. I tried setting httpstatus;URL;0|2..;3..|4..|5..|999 but that hasn't worked. (Other than adding text to the ping.jsp page) can anyone make any recommendations on how to avoid this and still test the URL? -Nick

3 2

Is there a way to do trend analysis or prediction or anomaly detection with Xymon?
by jddcef＠gmail.com 31 Jan '12

31 Jan '12

Hi there, Is there a plugin or feature of xymon that anyone knows of that allows one to do anomaly detection on the graph data? i.e. if there is nonstandard behavior on the graph that stands out, and you want it to be investigated. Kind regards, David

3 2

[xymon] log parsing on windows
by massimiliano.angei＠akhela.com 27 Jan '12

27 Jan '12

Hi all, Is it possible to monitor log files (not event viewer) under windows machines? For example *.log files containing particular patterns (error strings…) I'm trying Bbwin client but using central mode I'm only capable to parse event log. Maybe someone has an external that affords this feature… thanks in advance! Massimiliano A.

3 2

[XYMON] New sever with Solaris or Linux
by gbegin＠csc.com 27 Jan '12

27 Jan '12

Hello, I'm planning to install a new XYMON server and have to decide which OS to use. I can install Solaris or Linux (RedHat, Suse). What are the pro and con according to you? I'm planning to use about 3 xymonproxies and at least 1000 clients (potentially up to 6000). What about using SAN disks ? Cordialement, Regards,Mit freundlichen Grüßen, Gautier BEGIN Admin and Tools Team CSC Computer Sciences Luxembourg S.A. 12D Impasse Drosbach L-1882 Luxembourg Global Outsourcing Service | p:+352 24 834 276 | m:+352 621 229 172 | gbegin at csc.com | www.csc.com CSC • This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose • CSC Computer Sciences SAS • Registered Office: Immeuble Le Balzac, 10 Place des Vosges, 92072 Paris La Défense Cedex, France • Registered in France: RCS Nanterre B 315 268 664

5 6

Remove An Alert for a Specific Server
by Ed.Stuart＠austinenergy.com 26 Jan '12

26 Jan '12

Hello; we are running Xymon 4.2.0. We have a number of our alerts and triggers set up on a page basis. How can we disable the alert for one category for server on a page without disabling it for all the servers defined on that page? For example, if all the servers were defined to be on page Example and we had a trigger that for all servers on page Example where we are montoring the existence of an ntp process how could we disable the monitor for the ntp process for just one server on that page? Ed There's no place like 127.0.0.1

2 1

Can I monitor how many connections are in TIME_WAIT for a specific port
by Paul.Root＠CenturyLink.com 25 Jan '12

25 Jan '12

Hi, We are monitoring a particular port that we are having issues with. 8022, it's a proxy port for HP NA. Anyway, I have an expect script that goes in and tests the functionality of the port. But when it starts to go bad, this script get stuck in TIME_WAIT, along with the users connecting to the port. So, can I look at the port data before I try connecting, and if there are a bunch of TIME_WAIT connections, just skip the test entirely? I'm running the test from the xymon server, so I was thinking of pulling the data out of xymon directly. Would that by xymoncmd? Thanks, Paul. Paul Root - Engineer III Managed Services Systems - CenturyLink This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

4 8

Log message "Data flooding from"
by hj.beckers＠kreis-steinfurt.de 25 Jan '12

25 Jan '12

What does the above message mean? The client sends oversized packages as well: xymond.log:2012-01-25 08:15:36 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:20:45 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:25:53 Oversize stachg msg from xymond for myclient:msgs truncated (n=523042, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize page/ack/notify msg from xymond for myclient:msgs truncated (n=523073, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize status msg from xymond for myclient:msgs truncated (n=523071, limit=262144) xymond.log:2012-01-25 08:25:54 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:31:03 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:36:13 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:41:22 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:46:33 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:51:42 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 My xymonserver.cfg contains: MASXMSG_STATUS="5000000" MASXMSG_CLIENT="5000000" MASXMSG_DATA="5000000" The status line for the client shows all entries besides "conn" as purple. Any suggestions? Hermann-Josef Beckers

2 2

Problem with TIME qualifier to PORT test
by jlaidman＠rebel-it.com.au 24 Jan '12

24 Jan '12

Oh wise people of the Xymon clan I occasionally have logrotate spawn a post-rotate process that hangs and needs to be manually killed. This is easily detected because the parent process also persists as "/bin/sh /etc/cron.daily/logrotate". I want to detect when logrotate has been running for more than an hour, and as it starts at 1am, I added the following line into my hosts' analysis.cfg file: PROC "%^/bin/sh /etc/cron.daily/logrotate" 0 0 "TEXT=/etc/cron.daily/logrotate" TIME=*:0200:0100 My understanding is that this makes the rule apply only between 2am and 1am, or in other words, forces "green" between 1am and 2am. I added this line yesterday. Alas, 2 out of 6 hosts showed a red "procs" alert at around 10 seconds after 1am (when logrotate runs), for 5 minutes. So it failed for me. Curiously, two servers that have an ongoing problem with a hung logrotate process (which inspired the check I'm trying to implement) showed green for the hour from 1am to 2am, then went back to red. So this indicates that the time qualifier is being handled correctly by those servers. I can't figure out why it went red for the other servers that don't have a hung logrotate process. Any ideas? Perhaps this is due to time lag between the client data delivery and the analysis. I wonder if I should change the timespec to "TIME=*:0200:0055"? Cheers Jeremy

1 0