December 2012 - Xymon - Xymon mailman web

Technical questions regarding message flow
by Michael.Beatty＠sherwin.com 13 Dec '12

13 Dec '12

I have some technical questions in regard to how the actual message flow between server / clients take place. The first questions relate to network traffic. My intent is to monitor a large number of clients (getting close to 9,000) so this is going to be a question I need to fully understand before I go too far. What does the message look like and how big is it (excluding message text) ? Is it XML? How is the connection made between the client and host? Are sockets made? How does the server handle large volumes of connections. One thing I have read is that any bottle necks will be more likely with disk I/O than network traffic, is this fair? Secondly, what is the process of message flow between client and server? I understand how the xymonclient is configured to run at a defined interval (configured in clientlaunch.cfg), it gathers data from its logs and sends the data to the server. The server saves this in its /data/hist path along with any rrd data. The server uses this data to display its web pages. The next part I'm not sure I understand correctly.... The sever then sends a response to the client that contains data that instructs the client what information it wants next time (this is taken from hosts.cfg?) The client then uses this response to determine which information to collect and send the next time the client is launched. So, aside from the server's ping test, all traffic is initiated by the client? Thank you for any help. -- Michael Beatty

2 1

Connecting the "history" file dots...
by David.Mills＠ngc.com 12 Dec '12

12 Dec '12

Hi, All! In poking around my data directory, I see a listing like this for the "cpu" test data for one of my hosts: $ ls -rt /export/xymon/data/histlogs/pwmu002/cpu/ total 61 drwxr-xr-x 22 hobbit monitor 22 Dec 30 2010 ../ -rw-r--r-- 1 hobbit monitor 1.9K Feb 17 2012 Fri_Feb_17_00:30:59_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 17 2012 Fri_Feb_17_01:51:10_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 25 2012 Sat_Feb_25_09:41:40_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 25 2012 Sat_Feb_25_12:52:12_2012 -rw-r--r-- 1 hobbit monitor 1.9K Jun 24 10:21 Sun_Jun_24_10:21:19_2012 -rw-r--r-- 1 hobbit monitor 1.8K Jun 24 11:19 Sun_Jun_24_11:19:10_2012 -rw-r--r-- 1 hobbit monitor 1.8K Jun 24 11:54 Sun_Jun_24_11:54:21_2012 -rw-r--r-- 1 hobbit monitor 1.9K Nov 5 12:41 Mon_Nov_5_12:40:58_2012 -rw-r--r-- 1 hobbit monitor 1.9K Nov 5 13:30 Mon_Nov_5_13:30:54_2012 -rw-r--r-- 1 hobbit monitor 1.9K Dec 2 13:37 Sun_Dec_2_13:37:24_2012 -rw-r--r-- 1 hobbit monitor 1.9K Dec 2 14:07 Sun_Dec_2_14:07:31_2012 Each of these files is some sort of snapshot of the data displayed when you click on the "cpu" icon for the indicated host in Xymon. Why then, is the most recent data file a couple weeks old but the data displayed for the "cpu" icon is current on the screen? Thanks! david ~~~~~~~~~~~~~~~~~~~ David Mills Systems Administrator Northrop Grumman 512-595-1238 david.mills at ngc.com

3 3

Nesting include files hosts.cfg
by Michael.Beatty＠sherwin.com 12 Dec '12

12 Dec '12

It looks like the answer is no, but I'm going to try anyway. I've tested it and it doesn't appear to work, but maybe I'm doing it wrong. I have a large number of hosts to monitor. Is there a way to nest the tags for the hosts into a list of hosts to include into the hosts.cfg file? For Example: If I have a: group-only test1|test2|test3 host1 # test1 test2 test3 host2 # test1 test2 test3 host3 # test1 test2 test3 Is there a way I could do something along the lines of: having a file - tests.dat test1 test2 test3 and including it into a file hosts.dat host1 # include tests.dat host2 # include tests.dat host3 # include tests.dat and then putting in into the hosts.cfg file group-old test1|test2|test3 include hosts.dat Thank you. -- Michael Beatty

2 1

Alerts based on rrd graphs
by kc6ovd＠att.net 12 Dec '12

12 Dec '12

Anyone doing any alerting on graphed rrd data? Just looking for some sample of what you might be doing. -Kevin

2 1

hobbit-> xymon migration - devmon RRD - separator changed from comma to dot
by nicolas＠lienard.name 12 Dec '12

12 Dec '12

Hi After migrating an existing cluster from hobbit 4.2 to Xymon 4.3.10, everything is fine except RRD from DEVMON. Previously, there were like this: -rw-rw-r-- 1 xymon xymon 38624 Dec 12 10:45 if_load,Gi0_1.rrd And now, like this: -rw-rw-r-- 1 xymon xymon 38624 Dec 12 12:56 if_load.Gi0_1.rrd The difference is subtil: between load and Gi0, there is a "." (dot) instead of a "," (comma). Results is graphs are stuck on the date of migration because the graphs are taken the RRD with ",". I could delete them but i 'll lost history (2 years). I m going to copy the "," files to "." files to have full history and a small hole. But at first, wanted to know if anybody experienced this kind of issue ? Thanks in advance, Cheers Nico

1 1

Ignore pattern help
by Paul.Root＠CenturyLink.com 12 Dec '12

12 Dec '12

I have this line in the analsys.cfg file: LOG /opt/netcool/omnibus/log/MNS_NFMS_GW.log Error: COLOR=red IGNORE="%Writer|Reader|SQL" And when this line shows up: 12/11/12 06:37:07: Error: E-NGOBJSE-102-140: [ngobjserv]: ObjectServerA: No results have been returned in response to the cache details select SQL command. (0:No error) We get paged. I've changed the ignore pattern to "%Writer|%Reader|%SQL". This is a new error, that isn't an error for us. Will that change work, or does anyone have a better pattern? Thanks, Paul.

3 3

Setting up alerts based on specific messages and ignoring the others
by MatthewHarris＠air-watch.com 11 Dec '12

11 Dec '12

Hey Guys, is there any way using XYMON to set up specific alerts based on windows message ID's and hardware logs, I have been tasked with setting up monitoring the windows server hardware logs, and only alert on those, and have the rest of the messages show up as green. My boss is only interested in the hardware failures at the moment, we have nagios already set up, but I used hobbit in the past and was spoiled, so I want to set it up here, and hopefully replace nagios with xymon. To do that I need to find a way to alert on a few small things to give them a taste of xymon before I can get them to bite. I need to be able to set up an alert for a cluster failover, be able to alert on a hardware failure, and be able to alert on a cert expiration date. If you guys can help me out with some or all of those things, we'll be able to get nagios out and get xymon in. V/R Matt Matthew Harris Datacenter Ops O | +1 404.902.xxxx C | +1 404.xxx.xxxx F | +1 404.902.xxxx MatthewHarris at air-watch.com<mailto:MatthewHarris at air-watch.com> www.air-watch.com<http://www.air-watch.com/> [Description: Description: Description: cid:3420106421_29290231] This communication is confidential and is intended to be privileged pursuant to applicable law. If you are not a designated recipient of this message, please do not read, copy, use or disclose this message or its attachments. Notify the sender by replying to this message and delete or destroy all copies of this message and attachments in all media. Thank you.

2 1

Completely turning off collection of data
by Michael.Beatty＠sherwin.com 11 Dec '12

11 Dec '12

Is there a way to completely turn off the collection of a particular monitor on a client so that it doesn't send the data? It looks like the client gathers all the information all the time, sends it to the server, and the server determines which data to display. If I'm trying to save bandwidth, can I tell the client to not gather procs data (which on my system is about 15k per message) and just not send it? -- Michael Beatty

2 1

Xymon 4.3.10 and "multi-source status" errors
by novosirj＠umdnj.edu 11 Dec '12

11 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My xymond test is often yellow, and near as I can tell, the reason is often that I have so-called "multi-source statuses." However, the "second" source is the Xymon server, and this appears to happen most often when tests are disabled (as the blue status comes from the Xymon server). Should I be ignoring this? Is there a misconfiguration somewhere that has this server not properly identifying messages from itself? Thanks for your help. - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlDHc6YACgkQmb+gadEcsb6IRACfTH2APBg6vkSYdAd2FPfMKmUJ aygAoL6HVCab1U2X+eIb/GSNYqZNcmCN =754I -----END PGP SIGNATURE-----

2 1

Yellow n Red alerts
by novosirj＠umdnj.edu 11 Dec '12

11 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please keep replies on the list. Every time that error appears, there should be an error in the Apache log unless you have a strange Apache configuration. Are you certain you're looking at the correct Apache log directory? On 12/11/2012 01:20 PM, Mahesh Y wrote: > Hi Ryan, > > Thanks for your reply..host file was updated Nov 30 2011..Apache > logs are present for that time..I could not find any errors from > recent logs. > > Regards, Mahesh. > > > On Tue, Dec 11, 2012 at 2:14 AM, Novosielski, Ryan > <novosirj at umdnj.edu <mailto:novosirj at umdnj.edu>> wrote: > > On 12/10/2012 03:41 PM, Mahesh Y wrote: >> Hi All, > >> I could not see the history of red and yellow alerts ,I am able >> to view green. > >> When I click on red/yellow alerts..it throws below error.Please >> help to sort this issue.Tried removing and and re-installing >> hobbit rpm but no luck. > >> Internal Server Error The server encountered an internal error >> or misconfiguration and was unable to complete your request. >> Please contact the server administrator, you at yourhost.com > <mailto:you at yourhost.com> >> <mailto:you at yourhost.com <mailto:you at yourhost.com>> and inform > them of the time the error >> occurred, and anything you might have done that may have caused >> the error. > >> More information about this error may be available in the server >> error log. > > You need to look in your server error log, like it says. By > "server" it means the Apache server. > > > - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlDHejcACgkQmb+gadEcsb6migCfeX6NaYBQu6SslIIHkZdr3Ntq FY0An3tTfx6vADoddy2d+o+u8CiucnX9 =oqkz -----END PGP SIGNATURE-----

1 0