May 2012 - Xymon - Xymon mailman web

Help with Xymon 4.3.7 runing Solaris x86
by Paul.Jacobs＠lchclearnet.com 29 May '12

29 May '12

Hi all, I have installed Xymon previously on Linux and had no problems getting the graphs to display on the web page but despite numerous attempts and lots of searching on the web I can't get them to be displayed at all on my Solaris x86 installation. They just appear on any browser like this below but there were no errors during installation and compilation. No errors in the apache logs either. I have gone to the demo site http://xymon.com/xymon/xymon.html and can see all the graphs fine and then drill down using the zoom fine. On my system I just get this message "Garbage ': 29-May-2012 14:36:38' after command: COMMENT:Updated: 29-May-2012 14:36:38" Any ideas as stumped? Thanks Paul [cid:image001.png at 01CD3DA8.9D483E90] A copy of the LCH.Clearnet e-mail disclaimer can be found at: www.lchclearnet.com/disclaimer/email LCH.Clearnet Limited, Registered Office: Aldgate House, 33 Aldgate High Street, London EC3N 1EA. Recognised as a Clearing House under the Financial Services & Markets Act 2000. Reg in England No.25932. LCH.Clearnet SA, Siège Social, 18 rue du Quatre Septembre, 75002 Paris, Chambre de Compensation conformément au Code Monétaire et Financier.

2 1

Help with Xymon 4.3.7 runing Solaris x86
by Paul.Jacobs＠lchclearnet.com 29 May '12

29 May '12

Hi all, I have installed Xymon previously on Linux and had no problems getting the graphs to display on the web page but despite numerous attempts and lots of searching on the web I can't get them to be displayed at all on my Solaris x86 installation. They just appear on any browser like this below but there were no errors during installation and compilation. No errors in the apache logs either. I have gone to the demo site http://xymon.com/xymon/xymon.html and can see all the graphs fine and then drill down using the zoom fine. On my system I just get this message "Garbage ': 29-May-2012 14:36:38' after command: COMMENT:Updated: 29-May-2012 14:36:38" Any ideas as stumped? Thanks Paul [cid:image002.png at 01CD3DA8.F39FAB20] A copy of the LCH.Clearnet e-mail disclaimer can be found at: www.lchclearnet.com/disclaimer/email LCH.Clearnet Limited, Registered Office: Aldgate House, 33 Aldgate High Street, London EC3N 1EA. Recognised as a Clearing House under the Financial Services & Markets Act 2000. Reg in England No.25932. LCH.Clearnet SA, Siège Social, 18 rue du Quatre Septembre, 75002 Paris, Chambre de Compensation conformément au Code Monétaire et Financier.

1 0

e-mail alerts for a specific log? (Solaris 10)
by Nick＠Pettefar.com 29 May '12

29 May '12

Can anyone tell me how I can set up xymon so that specific (application) logs on specific servers send e-mail alerts (to several recipients)? I tried searching through the archives but could not find anything showing this. Do I have to configure (somehow) a different service? The servers run Solaris 10. I'm new to xymon. Nick

4 6

LOG alert with GROUP?
by Nick＠Pettefar.com 28 May '12

28 May '12

I am trying to use the GROUP keyword in a LOG alert to send an e-mail when "Warning" is in a certain log file and it isn't working. Is it possible? client-local.cfg [acnsvr1-ge1] log:/data/conductor/log/checkExtractDelivery.log:10240 analysis.cfg HOST=acnsvr1-ge1 LOG /data/conductor/log/checkExtractDelivery.log Warning COLOR=red GROUP=checkExtractDelivery alerts.cfg GROUP=checkExtractDelivery HOST=acnsvr1-ge1 MAIL nick at xxxx.com SERVICE=log COLOR=red No mail is sent. The server can send e-mails (checked using the same address with mailx). What does the "group not in include list" Failed message mean? ../bin/xymond_alert --debug --test acnsvr1-ge1 GROUP=checkExtractDelivery 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/hosts.cfg 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/alerts.cfg 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/holidays.cfg 6485 2012-05-28 17:33:42 send_alert acnsvr1-ge1:GROUP=checkExtractDelivery state 0 00006485 2012-05-28 17:33:42 send_alert acnsvr1-ge1:GROUP=checkExtractDelivery state Paging 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 127 00006485 2012-05-28 17:33:42 Failed 'GROUP=checkExtractDelivery HOST=acnsvr1-ge1' (group not in include list) 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 143 00006485 2012-05-28 17:33:42 *** Match with 'HOST=*' *** 6485 2012-05-28 17:33:42 Found a first matching rule 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 144 00006485 2012-05-28 17:33:42 *** Match with 'MAIL qtnoc at xxxx.com COLOR=red REPEAT=4h' *** 6485 2012-05-28 17:33:42 repeat acnsvr1-ge1|GROUP=checkExtractDelivery|mail|qtnoc at xxxx.com at 0 6485 2012-05-28 17:33:42 Alert for acnsvr1-ge1:GROUP=checkExtractDelivery to qtnoc at xxxx.com 00006485 2012-05-28 17:33:42 Mail alert with command '/var/spool/mail/root "Xymon [12345] acnsvr1-ge1:GROUP=checkExtractDelivery CRITICAL (RED)" qtnoc at xxxx.com' 6485 2012-05-28 17:33:42 No more secondary matching rule Regards, Nick Pettefar

2 1

One client alerts and a (seemingly) identical client doesn't.
by Nick＠Pettefar.com 28 May '12

28 May '12

I have two servers being monitored, a specific log file is monitored on each and the alerts, client-local and analysis file entries are identical for each. And yet one works (shows a reg MSGS dot and sends an e-mail) and one doesn't. It did for a while and then stopped. I have restarted xymon client on the server to no avail. What tools ara available and what should I be looking for in order to solve this peculiar problem? Regards, Nick Pettefar

2 2

Email format
by kconnell＠ryerson.ca 28 May '12

28 May '12

Not sure is this is a devmon question, or xymon, but figured I try here first. I have a table built/displayed on xymon via devmon for temperature on our L2 stacks. The issue is when a "red" event happens and an email is sent, the format of the email is just horrible. I've tried adding "FORMAT=PLAIN" within the alerts.cfg for that particular event, but I don't really see a change. Is there any way to make the email body a little nicer ?? Below is an example of the email content: red Thu May 24 17:57:23 2012 Alarming on (53.50,53.50,49.00,49.00,49.00,49.00,49.50,49.50,45.50,45.50,46.50) Alarming on (46.50,46.50,46.50) <table border=1 cellpadding=5> <tr><td>Unit Temperature</td></tr> <tr><td>&red 53.50</td></tr> <tr><td>&yellow 49.00</td></tr> <tr><td>&yellow 49.00</td></tr> <tr><td>&yellow 49.50</td></tr> <tr><td>&yellow 45.50</td></tr> <tr><td>&yellow 46.50</td></tr> <tr><td>&yellow 46.50</td></tr> </table> Operating temperature: 0Â° to 45Â°C (32Â° to 113Â°F) Ken Connell Intermediate Network Engineer Computer & Communication Services Ryerson University 350 Victoria St RM AB50 Toronto, Ont M5B 2K3 416-979-5000 x6709

2 1

Most number of hosts
by Michael.Beatty＠sherwin.com 26 May '12

26 May '12

Is there any close proximity number available as to how many clients Xymon can handle? I've seen in the wiki pages that one user is advertising over 10,000 however, that seems to be in a "clustered" setting. I see a few more users suggesting over 2,000. My concern lies in that my plans stand at some where in the middle of that, and also, there really is no gauge as to what hardware and network topology those systems are running. My environment will be in the ball park of about 5,000 systems and many of them are on satellite bands with some latency concerns, pings tests come back at around 3 seconds. I'm hoping to get some confidence that going into this project, I'm not going to be hit with a realization that Xymon simply cannot handle this type of environment. Its a lot of research and development that I would be flushing down the drain. I do have experience with my previous organization where we monitored about 1500 clients under the Hobbit project.... so I know the capabilities... I just don't know what the boundaries are. -- Michael Beatty Sherwin-Williams IT Analyst/Developer michael.beatty at sherwin.com 216-515-7374

5 5

noconn in hosts.cfg not working properly? turns all 'conn''s purple
by tsztur＠gmail.com 25 May '12

25 May '12

So our XYMON host ISP seems to be having ICMP issues. conn requests are randomly failing causing false alarms. I added 'noconn' : 2.2.2.2. test.host # noconn ssh ssh-tunnel - However what happens is, it stops the test which is fine, but it holds the 'red' status, or the last status it recorded. After about 30 minutes it turns purple. How can I get rid of the conn test altogether? TIA! tom.

5 4

Xymonlaunch died - no alert
by john.horne＠plymouth.ac.uk 25 May '12

25 May '12

Hello, I'm running Xymon 4.3.7 on a test server, and found this morning that the 'xymonlaunch' process had died. The server is a bit flaky, so I very much suspect that this is due to a server memory fault and not the code :-) The xymonlaunch log file shows it starting up a few days ago, then nothing. What is a concern is that Xymon itself gave no indication that xymonlaunch had died. The 'non-green' page shows one local test ('msgs') as red due to some other event, but 'xymond', 'xymongen' and 'xymonnet' show green. However, if I click on the xymongen or xymonnet page then it shows a purple background. Is xymonlaunch not itself monitored as a process by Xymon? John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 1

Show trends graph as test?
by john.horne＠plymouth.ac.uk 25 May '12

25 May '12

Hello, Using Xymon 4.3.7 I see that the 'trends' column can show graphs for the host network interface (network traffic/bits per second) and disk I/O utilisation (from iostat). My understanding is that the information comes from each host via the client data. My question is, is it possible to get these two items reported as separate tests? That is, as a test named (say) 'iostat' which shows the disk I/O utilisation graph as seen in 'trends'. And another test called 'netstat' (or 'ifstat') for the network traffic graph? The data is already being collected (as evidenced by the trends column), but I'm not sure how to breakout these graphs so that they can be reported as individual specific tests with their own column. Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

1 1