April 2012 - Xymon - Xymon mailman web

Hobbit default ssl certs
by janford.hof＠cats.usdoj.gov 26 Apr '12

26 Apr '12

I've delved into many files and Internet sites, but cannot find where the global defaults are for WARNDAYS and ALARMDAYS for sslcert. I can modify the parameters for various servers in the bb-hosts file, but I need to find the overall defaults. If they are hidden in a binary coded file, how would I decompile it, or whatever, to find this info? Thanks for any answers. Janford Hof DOJ AFMS Unisys Contractor Floor 5 Rm. 5W.414 145 N Street, NE Washington, DC 20530 Direct: (202) 305 4963 janford.hoff at unisys.com<mailto:janford.hoff at unisys.com> (Alternate e-mail) Confidentiality Notice: This message (including any attachments) contains privileged and confidential information intended for a specific purpose, and is protected by law. If you are not the intended recipient, please notify the sender and permanently delete this message and any attachments immediately. Any disclosure, dissemination, distribution, or copying of this message, or the taking of any action based on it, is strictly prohibited. You should not retain, copy or use this message or any attachments for any purpose, nor disclose all or any part of the contents to any other person.

3 3

Customizing Xymon email formats
by Don.Kuhlman＠schawk.com 25 Apr '12

25 Apr '12

Hi folks. Thought I would share this. I modified the html_mail.pl script to replace hobbit or bb references with xymon references. It was using some older pointers so I replaced that. I also re-formatted the email piece to change the subject line. I don't know if there is any interest in this, but I can share the .pl code if so. I had a question about this though - if I want to keep only the item that has the alert and get rid of all the extra info from $bbalphmsg, is there some way to do that besides using FORMAT=SMS in the alerts.cfg file? When I use FORMAT=SMS, I get a shorter msg, but then lose the other items that are alerting. Regards, Don K Here's a snip of the long email with the Proto listing shortened. I would only like the items with the alert in the email. See http://xymonserver.domain.com/xymon-cgi/svcstatus.sh?HOST=SERVERNAME&SERVIC…<http://srmxymon.ambrosi.com/xymon-cgi/svcstatus.sh?HOST=C3SRMSQL01P&SERVICE…> red Wed Apr 25 14:56:04 2012 - Ports NOT ok [cid:3A143FC6-FC3C-45BF-95B1-B4C2509C3D73] SQL_Port_1433 (found 0, req. 1 or more) [cid:DB9F1850-5AED-4E93-9CA0-7A19E6BC9855] Listen (found 37, req. none) Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:80 0.0.0.0:0 LISTENING TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP 0.0.0.0:2383 0.0.0.0:0 LISTENING … .. .

1 0

Master slave configuration
by tdiehl＠rogueind.com 25 Apr '12

25 Apr '12

Hi, I have 2 xymon servers that watch the same networks and servers from 2 geographically diverse locations. The idea is that if one of the servers looses connectivity I will get notified from the other system. This seems to almost work OK, except both servers send ALL of the client data they have to the other server. If I click on the xymond icon I see things under Multi-source statuses like system1:smtp reported by 172.25.1.2 and 192.168.0.2. Can someone tell me how to configure the xymon servers to only send client data about themselves to the other server? I would like each server to run and report only its own test results. Is this documented somewhere? My Google foo has not worked very well wrt this question. Regards, -- Tom Diehl tdiehl at rogueind.com Spamtrap address mtd123 at rogueind.com

2 2

Additional tests from xymon server
by damian.ioan＠gmail.com 25 Apr '12

25 Apr '12

Hi Thank you all for your replies. xymongrep is what I was looking for. Also, Buchan's script was very helpful. I've managed to add the desired checks by adding a new task in $XYMONHOME/servers/etc/tasks.d/domain-checks.cfg like this: [Domain] ENVFILE $XYMONSERVERROOT/server/etc/xymonserver.cfg NEEDS xymond CMD $XYMONSERVERROOT/server/ext/domain_check.pl LOGFILE $XYMONSERVERLOGS/ext-domain_check.log INTERVAL 5m In $XYMONSERVERROOT/server/ext/domain_check.pl I used xymongrep to filter out only the hosts with the domain tag in hosts.cfg and sent the status for each of the hostnames I've found back to xymon. I'm a bit suprised I couldn't find documentation for such endevours more easily. On 4/16/2012 12:25 PM, Buchan Milne wrote: > On Friday, 13 April 2012 19:10:34 Ioan Damian wrote: >> Hi, >> >> I'm trying to add a test to the xymon server. This one has to reside >> server-side because not it does domain checks and not all domains have an >> assigned IP. Also, connectivity is not a concern here. What I'm trying to >> do is add some domain in a subpage and check for changes in their >> nameserver IPs. I've written a perl script that does the job and it takes >> the domain name as a parameter. In practice I'm trying to replicate what >> xymonnet does with the various checks like dns, http, smtp, etc. >> >> I would have something like this hosts.cfg: >> >> page domainchecks<H3>Domain Checks<H3> >> <some IP> <the domain name> # noconn<my_test_name> >> >> I did scrip this to check all domains at once but, that's not a desired >> behavior because I need to xymon to treat them separately and tell me for >> each if something changed or not according to my script. >> >> I setup a test task in tasks.cfg like this: >> >> [Environment] >> ENVFILE /var/lib/xymon/server/etc/xymonserver.cfg >> NEEDS xymond >> CMD $XYMONSERVERROOT/server/ext/env.pl >> LOGFILE $XYMONSERVERLOGS/ext-env.log >> INTERVAL 5m >> >> I've set it up for some hosts to no avail: >> >> <some ip> <hostname> # env >> >> It only shows up for the xymon server, which leads me to think this is more >> cumbersome than I first thought. Has anyone managed to do something like >> this before? > Please find an example attached. If I were to write this script today, I might > rather use a perl module I have that handles the communication with hobbitd. > This one uses 'ol' as the service name, or tag that should be in the hosts.cfg > file. I haven't modified it to run in Xymon 4.3.x, the bbhostgrep, and > possibly $ENV{BB} and $ENV{BBDISP} may need to be changed ... > > I would recommend against using 'env' as a test name though, as some tests > (e.g. Devmon templates) use 'env' for 'environmental monitoring', such as > temperature, humidity etc. > > Regards, > Buchan

2 2

PROC matching failure due to column bloat
by jlaidman＠rebel-it.com.au 24 Apr '12

24 Apr '12

Peeps I have both Solaris and Linux servers where a large or long-running process causes PROC matching to fail. Here are some examples: 7701 1 root Feb 28 S 24 0.0 00:00:00 0.0 572 2692 /sbin/agetty -L 9600 ttyS0 vt102 7702 1 root Feb 28 S 23 0.0 00:00:00 0.0 576 2692 /sbin/agetty -L 9600 ttyS1 vt102 7704 1 named Feb 28 S 18 2.4 1-08:59:39 4.4 270500 412784 /usr/sbin/named -u named -f 26498 3293 root 12:47:46 S 14 0.0 00:00:00 0.0 468 2676 sleep 180 This is on Linux. Note the longer-than-a-day TIME column that pushes the columns after it to the right. The following is on Solaris 9: 11201 11199 n101649 12:38:54 S 59 0.0 0:00 0.0 1000 1144 vmstat 300 2 11202 1 n101649 12:38:54 S 59 0.0 0:00 0.0 968 1104 sh -c iostat -dxsrP 300 2 1>/tmp/xymon_iostatdisk.redacted 3244 2965 root Feb_16 S 59 0.0 5:20 0.1 7104 18736 /opt/OV/lbin/eaagt/opcle -std 3245 2965 root Feb_16 S 59 0.0 1:18 0.1 6376 20960 /opt/OV/lbin/eaagt/opcmona 3253 1 root Feb_16 S 59 0.9 1-10:46:45 0.8 58168 59632 /usr/local/sbin/named -f Solaris "ps" output allows more characters for TIME than Linux. However in this case the memory columns (RSS and VSZ) are larger than expected, pushing a couple of digits over into the process name area. It seems that Xymon is parsing these based on fixed column sizes, defined for each OS. The result of these particular examples is that Xymon fails to match on the process name. Instead, I need to use match strings like so: PROC "%^(\d* |^)/usr/local/sbin/named(\s*$|\s)" 1 1 "TEXT=/usr/local/sbin/named" or PROC "%^(\d* |^)/usr/sbin/named(\s*$|\s)" 1 1 "TEXT=/usr/sbin/named" I guess this email is part "am I doing something wrong", part "does anyone have a better idea", and part feature request (for more awk-like positional matching). Cheers Jeremy

3 2

Strange ghost reports
by ejacobs＠thomaspublishing.com 24 Apr '12

24 Apr '12

I have two xymon servers (4.3.7) running, one here in Pennsylvania and one in New York. Both have "summary" lines at the end of their hosts.cfg files pointing to the other. In PA, the xymond button shows most, if not all, of the NY clients as ghosts, with the reporting IP being the IP of the PA hobbit server. NY doesn't have this problem. Anyone know why this might be happening? -- Eric Jacobs Thomas Publishing Company Infrastructure and operations Information Technology Group Phone: 215-494-7312 Email: ejacobs at thomaspublishing.com

2 2

Windows service monitoring
by Neil.Simmonds＠express-gifts.co.uk 24 Apr '12

24 Apr '12

Hi all, We are monitoring various Windows services using BBWin 0.12 in central mode reporting to a Xymon 4.3.4 server. In the analysis.cfg file for a number of servers we have the following type of entry, SVC SQLSERVERAGENT status=started startup=automatic As far as I can see from the analysis.cfg help that is exactly the correct format, however when this flags red, we get the following message, SQLSERVERAGENT is started/automatic - want started/automatic When I look down the list of processes SQLSERVERAGENT is clearly shown as stopped, SQLSERVERAGENT automatic stopped SQLSERVERAGENT Does anyone have any idea why the message is incorrect and if there is a way to fix it? Regards, Neil Simmonds Operation Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0

vCenter monitoring
by gendalia＠iastate.edu 24 Apr '12

24 Apr '12

What do people use for vCenter monitoring? -Tracy

3 2

Occasional issue with process listings
by tlewick＠tradebotsystems.com 23 Apr '12

23 Apr '12

Background, we have a xymon server that is monitoring roughly 700 devices, mix of windows and linux with some network devices, etc. Running Xymon 4.3.3 for several months now with no issues. No recent config changes, but recently I've seen an issue where a few of the linux clients (haven't noticed it on Windows clients) will have their process checks go red, and when you click on the process page it appears the client data is being truncated, thus most or all of the process checks are red. This only lasts for one cycle, then everything is back to green. Its happened maybe 5-10 times today. However, there are no entries in xymond.log regarding Oversize status message from client W.X.Y.Z truncated, etc. Is this a known issue with xymon?

2 2

.default. not working?
by jdustin＠usm.maine.edu 21 Apr '12

21 Apr '12

Using testip was the whole point, because I wanted to apply that tag to a bunch of hosts. I decided to add tags to host entries instead. I do not use FQDN, and wondered if that might have something to do with testip. Thanks for the suggestion though! Please forgive typos - sent from a mobile device On Apr 21, 2012, at 11:30, "Mark Mulligan <MMulligan at llbean.com>" <MMulligan at llbean.com> wrote: > Have you tried changing testip to noconn so that it does not try to resolve the IP address? The example in hosts.cfg does not use a testip. > > Thanks, > Mark > > -----Original Message----- > From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Jon Dustin > Sent: Monday, April 16, 2012 3:23 PM > Cc: xymon at xymon.com > Subject: =?utf-8?B?UmU6IFtYeW1vbl0gLmRlZmF1bHQuIG5vdCB3b3JraW5nPw====?> > Can anyone think of a way I can debug the processing of hosts.cfg? For some reason my ".default." entry is not being read correctly, and no matter what I try Xymon complains. > > Thanks for reading. > > Sent from a mobile device, please excuse any typos. > > > -----Original Message----- > From: Jon Dustin [jdustin at usm.maine.edu] > Received: Monday, 16 Apr 2012, 8:27 > CC: xymon at xymon.com [xymon at xymon.com] > Subject: =?utf-8?B?UmU6IFtYeW1vbl0gLmRlZmF1bHQuIG5vdCB3b3JraW5nPw====?> > > >>>> "Jon Dustin" <jdustin at usm.maine.edu> 2012-04-16T08:27:57.783283 >>> > Nope, still not working: > > 0.0.0.0 .default. # testip NOPROPRED:+if_load NOPROPYELLOW:+if_load > > (note - there are TABS on both sides of .default. - in case that makes a difference) > > Thanks for reading. > >>>> On 4/16/2012 at 3:08 AM, in message > <CALMep04wRHCuimkWdDEN868C3-KPyJH5FcwyshAOW-dpQASGOw at mail.gmail.com>, Steven Carr <sjcarr at gmail.com> wrote: >> Try... >> >> NOPROPRED:+if_load NOPROPYELLOW:+if_load >> >> That's what I have in mine and it works. >> >> Steve >> >> >> >> On 16 April 2012 03:04, Jon Dustin <jdustin at usm.maine.edu> wrote: >> >>> No, my .default. is all on one line. Very perplexing! >>> >>> -- >>> Jon Dustin - Network Specialist >>> University of Southern Maine >>> Portland, ME 207-780-4152 >>> >>>>>> Steve Holmes 04/15/12 8:15 PM >>> >>> Is the .default. really on 3 lines? If so, that is your problem. Put >>> it all on one line. >>> >>> Steve >>> >>> Wherever you go, there you are. >>> >>> On Apr 15, 2012, at 7:06 PM, "Jon Dustin" wrote: >>> >>>> Greetings - >>>> >>>> I'm currently running Xymon v4.3.7, and having troubles getting the >>> ".default." entry to work properly. Here is what I have configured: >>>> >>>> page devs Network Devices >>>> 0.0.0.0 .default. # testip NOPROPRED:if_load >>> NOPROPYELLOW:if_load >>>> (then a bunch of hosts below) >>>> >>>> It seems the .default. entry is ignored (status IS propagated >>>> upward), >>> *and* I see the following error in xymonnet: >>>> >>>> dnsresolve - internal error, name '' not in cache >>>> xymonnet: Cannot resolve IP for host >>>> >>>> Am I misunderstanding the ".default." entry? Thanks for anything >>>> you can >>> pass along. >>>> > > > -- > > Jon Dustin - Network Specialist > University of Southern Maine > Portland, ME 207-780-4152 > > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

1 0