October 2012 - Xymon - Xymon mailman web

Mismatched colors / confusing alert when test and xymongen both running every 60 seconds
by betsy.schwartz＠gmail.com 03 Oct '12

03 Oct '12

We are running xymon 4.3.7 on a somewhat slow linux box (hope to migrate this week). I've experimented with running xymongen more frequently; xymon fell over when I ran it every 20 seconds so it is currently running once a minute. We have a custom test, GGAdmin, that is ALSO running once a minute and seeing somewhat frequent status changes. Yesterday it was changing from red to green, when the team was paged with this alert message: Sent: Mon 10/1/2012 4:18 PM Subject: Xymon [539804] db4.example.com:GGAdmin CRITICAL (RED) message content included: green Mon Oct 1 16:16:24 2012 <h3 style="color:cyan">Golden Gate Status </h3> &green All Golden Gate Monitors are Green <snip> So that's a red alert page, sent at 4:18 but the contents of the email indicated green at 4:16. I looked at the logs on the client, which are running verbosely. Everything on the client side was correct - sent red status with red content; green status with green content I sent these messages to the xymon server: /export/home/xymon/client/bin/bb 10.100.5.42 'status db4.example.com.GGAdmin red Mon Oct 1 16:14:07 2012 <...snip...> &red GGPROC1 status is STOPPED /export/home/xymon/client/bin/bb 10.100.5.42 'status db4.example.com.GGAdmin green Mon Oct 1 16:15:17 2012 <....snip...> &green All Golden Gate Monitors are Green /export/home/xymon/client/bin/bb 10.100.5.42 'status db4example.com.GGAdmin green Mon Oct 1 16:16:24 2012 <....snip...> &green All Golden Gate Monitors are Green My theory is that we sent status messages so frequently that between the time xymon saw the red dot and grabbed the contents for the message, the color had changed, so the email content came from a later message than the subject. Does this sound possible? We're going to be moving to a faster server, and I cranked the test frequency down to 5 minutes for now, but our new grandboss is pushing us to get the alert time down as fast as possible (and making unfavorable comparisons to Nagios...) so I'd like to get us running at as fast a cycle speed as we can handle. thanks for any thoughts

1 0

xymon-mailack
by jlaidman＠rebel-it.com.au 02 Oct '12

02 Oct '12

On 29 September 2012 02:51, Ray Reuter <ray.reuter at gmail.com> wrote: > I have created the .procmailrc file it looks like this. The file is in > /home/xymon 755 permissions and owned by xymon:xymon I tried the ownership > as root as well. > > DEFAULT=$HOME/Mailbox > LOGFILE=$HOME/procmail.log > :0 > | $HOME/server/bin/xymon-mailack --env=/home/xymon/server/etc/xymonserver.cfg > > > When I run it on the CLI using this command > > ./xymon-mailack --env=/home/xymon/server/etc/xymonserver.cfg --debug > > I get nothing, it just returns an empty line, and sits there. I must be > missing something. > Yes you are. The xymon-mailack program expects an email message on standard input, and if run on the command-line your keyboard becomes standard input. You can do something like this: xymon-mailack --env=... < sample-email But first you need to put an email message into the file "sample-mail". You could create a file like this by temporarily removing the .procmailrc file (to let messages go into the xymon user's mailbox) and then sending the xymon user an email, and then copying a mail message from /var/mail/xymon. Note that the mailbox file can contain multiple messages each separated by blank line+"From " (from-space), and you only want one of them. J

3 9

xymon-mailack
by ray.reuter＠gmail.com 02 Oct '12

02 Oct '12

SUBJECT: Xymon [216807] lvhwebappold:disk CRITICAL (RED) test . 250 2.0.0 Ok: queued as D522A52F9 This is from another linux machine that I ran the telnet command from. On Tue, Oct 2, 2012 at 11:44 AM, Andrew Rakowski <landrew at pnnl.gov> wrote: > Hi Ray, > > To follow the SMTP protocol, I believe you need to add a "data" command > after your "rcpt to", then you can enter the "subject:" line (and any > other headers), followed by a blank line, then the body of the message. > > I think postfix is complaining that it doesn't know what the "SUBJECT: > xxx" command is... > > Cheers, > > -Andrew > > > ------------------------------------------------------------------------------ > Andrew Rakowski | Voice: 509.371.6465 | Email: > landrew at pnnl.gov > [CISSP] Infrastructure System Administration [GPG key: > 43994A12] > Environmental Molecular Sciences Lab | Pacific Northwest National > Laboratories > P.O. Box 999 | Mailstop K8-83 | Richland, WA 99352 [USA] > > ------------------------------------------------------------------------------ > > On Tue, 2 Oct 2012, Ray Reuter wrote: > > } Well we are getting closer. I am now able to telnet to the server. I > tried to send mail to > } the server but kicked off every time i try to do the subject line. > } [root at xxxcacti2 ~]# telnet XXXXXXXX.xxx.com 25 > } Trying 10.1.72.168... > } Connected to XXXXXXXXX.xxx.com (xx.xx.x.x). > } Escape character is '^]'. > } 220 XXXXXXXXX.lvh.com ESMTP Postfix > } helo XXXXXXXXXX.lvh.com > } 250 XXXXXXX.lvh.com > } MAIL FROM: raymond.reuter at xxx.com > } 250 2.1.0 Ok > } RCPT TO: xymon at xxxxxxx.xxx.com > } 250 2.1.5 Ok > } "SUBJECT: Xymon" > } 221 2.7.0 Error: I can break rules, too. Goodbye. > } Connection closed by foreign host. > } > } I have the .procmailrc file set up as per the xymon man page, still not > sure if the "Mailbox" > } is a directory or file. and the directory structure of the xymon home > directory looks like > } this. > } > } drwxr-xr-x. 2 xymon xymon 4096 Oct 2 11:02 Mailbox > } -rw-r--r--. 1 xymon xymon 0 Oct 1 12:15 procmail.log > } -rwxr-xr-x. 1 xymon xymon 124 Oct 2 11:04 .procmailrc > } > } This feature is one of the most important to the company I work for and > have been trying to > } get it to work for a couple of days now. We even added an MX record for > the server so mail > } can be delivered to it directly. Telnet works locally and remote. > } > } Any recommendations would be greatly appreciated, you have all been a > huge help so far and > } this monitoring tool has done wonders for this company. > } > } > } > } > } > } > } On Tue, Oct 2, 2012 at 1:58 AM, Jeremy Laidman <jlaidman at rebel-it.com.au> > wrote: > } On 2 October 2012 02:46, Ray Reuter <ray.reuter at gmail.com> wrote: > } I am using Centos 6.2 > } > } > } By default Centos (aka Red Hat) v6 boxes run postfix (rather than > Sendmail). > } > } During my install I do not remember installing anything as the mail > } transport, but the alerting was working right out of the box from > day one. > } > } > } Initially, postfix is configured so it won't accept SMTP connections > from off the box. > } So outbound emails will get sent OK, but incoming emails will not get > delivered to the > } Xymon server. > } > } Test this by attempting to telnet to the Xymon server on port 25 from > another device, > } such as a Windows PC, with "telnet xymon.server.name 25". If you get a > "connection > } refused" or similar message, than you need to reconfigure Postfix to > accept remote > } connections. > } > } I followed the man page for the mailack and created everything as > per the > } instructions, but I am not even sure the mail is reaching the > server at > } this point. > } > } > } Probably not. Have a look at the "STANDARD_CONFIGURATION_README" file > that came with > } Postfix for instructions on setting things up, particularly the "Postfix > on a local > } network" section. > } > } J > } > } > } > } >

1 0

getting xymon to work with win2008r2 clents in centralmode
by tomas.andersson＠sca.com 02 Oct '12

02 Oct '12

Hi there ! Has anybody got xymon to function properly with windows 2008r2 clients in central mode ?? I get it to function properly using local mode but I want to use central mode usinf the latest BBwin 0.13. When we tried to specify central mode we found that there was some problem for the BBWin to create the logfile to be sent to the xymon server Apparently since the bbwin was installed in the ...Program files (x86) folder and after quoting the Path parameter in the bbwin config file It suddenly started creating a huge 67 MB ! file to send (included all event error and application logs ...). So we then configured the client-local.cfg on the xymon server to try to ignore those. Unfortunately the xymon server did not send the client-local.cfg to the client. Qestions: the file client-local.cfg on the server where you specify what log files should be sent back to the server and what text matching you want the syntax is like: [win32] eventlog:Security:10240 ignore Success eventlog:System:10240 ignore Information eventlog:Application:10240 ignore Information [freebsd] log:/var/log/messages:10240 [netbsd] log:/var/log/messages:10240 ... The OS-name whithin brackets [ ] is this name win32 for windows 2008r2 also or should this "OS-name" (uname on all unixlike machines) be specified to something else like win64 on windows 2008r2 machines or ?? Is there a command that xymon uses to figure out the os type on windows server or how does this function ?? Is it possible to specify [] or [*] as a default entry in the client-local.cfg on the xymon server ??? Best Regards, /Tomas Andersson Unix System Admin/Tech/Dev SCA IT Services Tel. +46 31 7460313 Mob. +46 703 610313 This message may contain confidential, proprietary or legally privileged information and is intended for the addressee's use only. Any usage, disclosure, distribution, print or copying of any part of this message is prohibited unless you are the intended recipient. If you receive this message in error, please delete it from any computer and notify the sender. If you suspect that this message may have been altered, please notify the sender. SCA has taken every reasonable precaution to ensure that this e-mail and any attachments to this e-mail has been scanned for viruses. However, SCA does not accept liability for any damage caused by software viruses brought to you by this mail.

3 2

[SOLVED] Problem with the smtps test (unspecified SSL error)
by novosirj＠umdnj.edu 02 Oct '12

02 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/02/2012 02:22 AM, Jeremy Laidman wrote: > On 2 October 2012 13:18, Novosielski, Ryan <novosirj at umdnj.edu > > Agreed. Although that post was from 7 years ago, and a lot has > happened since then. For instance, STARTTLS is supported for > LDAPv3, so perhaps support for SMTP/STARTTLS is nigh. > > At some point, Henrik has to draw a line at the depth of > multi-layer protocols he supports. Perhaps it's time for an > external test script instead. You can then add a bunch of other > email tests such as anti-relay, anti-virus, bogus sender domain, > etc. While that is true (that one must draw the line somewhere), I think STARTTLS is a common enough one-layer-deep protocol that is pretty reasonable to support as it's used by a variety of things. Not worth the amount of effort it sounded like was described in the earlier post, but something to look toward when parts get rewritten I think. Anyways, thanks so much for your pointers. Those couple of tests were sitting broken for quite awhile, and I even had the OpenSSL output (it appeared in the bbd test for my network machine), but for some reason the fact that telnetting to the port and getting readable stuff back very much implied no SSL escaped me earlier. - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlBql9QACgkQmb+gadEcsb7lugCfSZBZ5yfWco8wqyA/bV2FR0fC nGEAn0uosXIJHh5zRhA4Bf93r1ZBcgro =oynN -----END PGP SIGNATURE-----

1 0

Problem with alerts on a DS value
by jlaidman＠rebel-it.com.au 02 Oct '12

02 Oct '12

On 1 October 2012 04:01, shea, greg <greg.shea at emc.com> wrote: > Xymon 4.3.7, testing cpu load from vmstat rrd file works great except for > the actual alert. > > ** > > I was expecting the string 'CPU Idle load Normal at &V%" HOST=%^hostprd0' > to appear in the alert**** > > but it doesn't. > The "HOST=%^hostprd0" string isn't part of the text, so won't show in the alert. > The Subject line in email shows the correct color (YELLOW), but the body > says green.**** > > The text string doesn't show up in BBALPHAMSG. Any suggestions? > I'm guessing that's because the "DS" result is an override to an existing status, and what you're seeing in the message body is the original color before override. Does the yellow status page also show the "green" in the body? J

1 0

Problem with the smtps test (unspecified SSL error)
by jlaidman＠rebel-it.com.au 02 Oct '12

02 Oct '12

On 28 September 2012 06:29, Ryan Novosielski <novosirj at umdnj.edu> wrote: > Xymon 4.2.3 here still. For some reason, smtps doesn't test properly. > >From my tests, that server is not listening on port 587, or is being blocked by a firewall/router. But perhaps access is restricted. Assuming port 587 is open to you, you can test the SSL negotiation using openssl: $ openssl s_client -connect mail.umdnj.edu:587 </dev/null This should show you certificate details. If it doesn't then there was no (valid) SSL handshake. At the very least, you should be able to connect with telnet: $ telnet mail.umdnj.edu 587 </dev/null This should show "Connected" and then immediately "Connection closed". If not, then you have a more elementary problem. If you get "Connection refused" then the service is probably not running. If you get a timeout, then there is probably a firewall/router blocking your packets. Cheers Jeremy

2 1

HP-UX client
by jlaidman＠rebel-it.com.au 02 Oct '12

02 Oct '12

On 28 September 2012 02:35, Ray Reuter <ray.reuter at gmail.com> wrote: > Does anyone have a good client install for monitoring HP-UX or OpenVMS? > The HP-UX is my main concern and also I would have almost no idea of how to > do the install of the client so any major help would be appreciated. A Xymon client binary is best, but if it's politically or technically impossible to get it installed, you can simulate a Xymon client if you can get a shell prompt over the network (eg ssh), by using my xymon-rclient.sh script, now available at xymonton.org/monitors. As recently discussed on this list, the script assumes that you're using bash and GNU sed on the Xymon server, but a standard bourne shell is fine client-side. Cheers Jeremy

1 0

Looking for Xymon clients for Solaris
by d.tom.schmitt＠L-3com.com 01 Oct '12

01 Oct '12

I am looking to now tackle the Solaris systems, does anyone have either a HowTo or a compiled Solaris client for Sparc and x86? I am running 4.3.0-0.beta2 Xymon server and have the compiled client running on multiple CentOS systems. The Xymon server is on a CentOS server. Is there a good tutorial/HowTo that shows how to just compile a client or do you take the entire portion of the source tree and do a 'make' and 'make install', etc. ? I do not want to download the entire Xymon system and compile it unless I have to. A little guidance would be greatly appreciated J Solaris 11 (Sparc, X86) Solaris 10 (Sparc, X86) Solaris 9 (Sparc) Solaris 8 (Sparc) Thanks, Tom Schmitt Senior IT Staff - R&D L-3 Communication Systems West 640 North 2200 West P.O. Box 16850 Salt Lake City, UT 84116 Phone (801) 594-3030 Cell (801) 231-7230 eFax (470) 201-6644 \\\\||//// \ ~ ~ / | @ @ | --oOo---(_)---oOo-- Have A Nice Day ! It is not necessary to change. Survival is not mandatory. -- W. Edwards Deming

4 3

State of DEPENDS/ROUTE
by novosirj＠umdnj.edu 01 Oct '12

01 Oct '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, - From the Xymon 4.3.10 manual: - --- depends=(testA:host1/test1,host2/test2),(testB:host3/test3),[...] This tag allows you to define dependencies between tests. If "testA" for the current host depends on "test1" for host "host1" and test "test2" for "host2", this can be defined with depends=(testA:host1/test1,host2/test2) When deciding the color to report for testA, if either host1/test1 failed or host2/test2 failed, if testA has failed also then the color of testA will be "clear" instead of red or yellow. Since all tests are actually run before the dependencies are evaluated, you can use any host/test in the dependency - regardless of the actual sequence that the hosts are listed, or the tests run. It is also valid to use tests from the same host that the dependency is for. E.g. 1.2.3.4 foo # http://foo/ webmin depends=(webmin:foo/http) is valid; if both the http and the webmin tests fail, then webmin will be reported as clear. Note: The "depends" tag is evaluated by xymonnet while running the network tests. It can therefore only refer to other network tests that are handled by the same server - there is currently no way to use the e.g. the status of locally run tests (disk, cpu, msgs) or network tests from other servers in a dependency definition. Such dependencies are silently ignored. - --- Is there any chance we might see a change in this feature? I currently am finding that most of the dependencies I'd want are actually based on local tests... as in if I know a service is not running on a host, I don't need to get paged about the service also being unreachable. It would seem to me (not knowing the internals of Xymon) that the display server has all of the information to make this work, but I guess it's more of a coding effort than an impossibility? - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlBpwiQACgkQmb+gadEcsb4glgCgimHlNfW65rFtIpvLsxrrmfRj V4YAnjImJr+cjYMb4e5iiAQFCztqn0ef =edaF -----END PGP SIGNATURE-----

1 0