May 2012 - Xymon - Xymon mailman web

LOG alert with GROUP?
by Nick＠Pettefar.com 28 May '12

28 May '12

I am trying to use the GROUP keyword in a LOG alert to send an e-mail when "Warning" is in a certain log file and it isn't working. Is it possible? client-local.cfg [acnsvr1-ge1] log:/data/conductor/log/checkExtractDelivery.log:10240 analysis.cfg HOST=acnsvr1-ge1 LOG /data/conductor/log/checkExtractDelivery.log Warning COLOR=red GROUP=checkExtractDelivery alerts.cfg GROUP=checkExtractDelivery HOST=acnsvr1-ge1 MAIL nick at xxxx.com SERVICE=log COLOR=red No mail is sent. The server can send e-mails (checked using the same address with mailx). What does the "group not in include list" Failed message mean? ../bin/xymond_alert --debug --test acnsvr1-ge1 GROUP=checkExtractDelivery 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/hosts.cfg 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/alerts.cfg 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/holidays.cfg 6485 2012-05-28 17:33:42 send_alert acnsvr1-ge1:GROUP=checkExtractDelivery state 0 00006485 2012-05-28 17:33:42 send_alert acnsvr1-ge1:GROUP=checkExtractDelivery state Paging 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 127 00006485 2012-05-28 17:33:42 Failed 'GROUP=checkExtractDelivery HOST=acnsvr1-ge1' (group not in include list) 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 143 00006485 2012-05-28 17:33:42 *** Match with 'HOST=*' *** 6485 2012-05-28 17:33:42 Found a first matching rule 00006485 2012-05-28 17:33:42 Matching host:service:page 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule line 144 00006485 2012-05-28 17:33:42 *** Match with 'MAIL qtnoc at xxxx.com COLOR=red REPEAT=4h' *** 6485 2012-05-28 17:33:42 repeat acnsvr1-ge1|GROUP=checkExtractDelivery|mail|qtnoc at xxxx.com at 0 6485 2012-05-28 17:33:42 Alert for acnsvr1-ge1:GROUP=checkExtractDelivery to qtnoc at xxxx.com 00006485 2012-05-28 17:33:42 Mail alert with command '/var/spool/mail/root "Xymon [12345] acnsvr1-ge1:GROUP=checkExtractDelivery CRITICAL (RED)" qtnoc at xxxx.com' 6485 2012-05-28 17:33:42 No more secondary matching rule Regards, Nick Pettefar

2 1

xymond_alert / alerts.cfg duration bugs or documentation issues
by spah＠syntec.co.uk 28 May '12

28 May '12

2 possible bugs or documentation errors... Summary: 1. xymond_alert interprets duration as minutes although the documentation says it is specified as seconds. 2. > is interpreted as >= (greater than or equal to) instead of > (greater than) in alerts.cfg. Version affected: 4.3.7 Steps to reproduce: alerts.cfg: HOST=CS1 MAIL $pg-sebsms SERVICE=svcs COLOR=red DURATION>10m REPEAT=30 RECOVERED Also tried without the the m for minutes, as this is supposed to be the default. /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=11 | grep Mail 00009396 2012-05-28 14:09:46 Mail alert with command '/var/spool/mail/root "Xymon [12345] CS1:svcs CRITICAL (RED)" <mailto:syntecseb at sms2email.com'> <email address removed>' <mailto:syntecseb at sms2email.com'> /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=10 | grep Mail 00009483 2012-05-28 14:09:50 Mail alert with command '/var/spool/mail/root "Xymon [12345] CS1:svcs CRITICAL (RED)" <mailto:syntecseb at sms2email.com'> <email address removed>' <mailto:syntecseb at sms2email.com'> /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=9 | grep Mail <nothing> But man xymond_alert says: --duration=SECONDS The SECONDS parameter is the duration of the alert in seconds. However, as you can see above, the xymond_alert parameter is behaving as if it was in minutes (or the alerts.cfg rule is behaving as if it was in seconds). And the > is behaving as if it were >=. Expected behaviour: 1. xymond_alert interprets duration as seconds. 2. > is interpreted as > (greater than) in alerts.cfg. Other Suggestion: alerts.cfg should accept durations specified in seconds (with an s suffix) so that alert parameters can be more accurately defined as some tests or status changes may be occurring more often than once a minute. Kind regards, SebA

1 0

One client alerts and a (seemingly) identical client doesn't.
by Nick＠Pettefar.com 28 May '12

28 May '12

I have two servers being monitored, a specific log file is monitored on each and the alerts, client-local and analysis file entries are identical for each. And yet one works (shows a reg MSGS dot and sends an e-mail) and one doesn't. It did for a while and then stopped. I have restarted xymon client on the server to no avail. What tools ara available and what should I be looking for in order to solve this peculiar problem? Regards, Nick Pettefar

2 2

Email format
by kconnell＠ryerson.ca 28 May '12

28 May '12

Not sure is this is a devmon question, or xymon, but figured I try here first. I have a table built/displayed on xymon via devmon for temperature on our L2 stacks. The issue is when a "red" event happens and an email is sent, the format of the email is just horrible. I've tried adding "FORMAT=PLAIN" within the alerts.cfg for that particular event, but I don't really see a change. Is there any way to make the email body a little nicer ?? Below is an example of the email content: red Thu May 24 17:57:23 2012 Alarming on (53.50,53.50,49.00,49.00,49.00,49.00,49.50,49.50,45.50,45.50,46.50) Alarming on (46.50,46.50,46.50) <table border=1 cellpadding=5> <tr><td>Unit Temperature</td></tr> <tr><td>&red 53.50</td></tr> <tr><td>&yellow 49.00</td></tr> <tr><td>&yellow 49.00</td></tr> <tr><td>&yellow 49.50</td></tr> <tr><td>&yellow 45.50</td></tr> <tr><td>&yellow 46.50</td></tr> <tr><td>&yellow 46.50</td></tr> </table> Operating temperature: 0Â° to 45Â°C (32Â° to 113Â°F) Ken Connell Intermediate Network Engineer Computer & Communication Services Ryerson University 350 Victoria St RM AB50 Toronto, Ont M5B 2K3 416-979-5000 x6709

2 1

Most number of hosts
by Michael.Beatty＠sherwin.com 26 May '12

26 May '12

Is there any close proximity number available as to how many clients Xymon can handle? I've seen in the wiki pages that one user is advertising over 10,000 however, that seems to be in a "clustered" setting. I see a few more users suggesting over 2,000. My concern lies in that my plans stand at some where in the middle of that, and also, there really is no gauge as to what hardware and network topology those systems are running. My environment will be in the ball park of about 5,000 systems and many of them are on satellite bands with some latency concerns, pings tests come back at around 3 seconds. I'm hoping to get some confidence that going into this project, I'm not going to be hit with a realization that Xymon simply cannot handle this type of environment. Its a lot of research and development that I would be flushing down the drain. I do have experience with my previous organization where we monitored about 1500 clients under the Hobbit project.... so I know the capabilities... I just don't know what the boundaries are. -- Michael Beatty Sherwin-Williams IT Analyst/Developer michael.beatty at sherwin.com 216-515-7374

5 5

noconn in hosts.cfg not working properly? turns all 'conn''s purple
by tsztur＠gmail.com 25 May '12

25 May '12

So our XYMON host ISP seems to be having ICMP issues. conn requests are randomly failing causing false alarms. I added 'noconn' : 2.2.2.2. test.host # noconn ssh ssh-tunnel - However what happens is, it stops the test which is fine, but it holds the 'red' status, or the last status it recorded. After about 30 minutes it turns purple. How can I get rid of the conn test altogether? TIA! tom.

5 4

Xymonlaunch died - no alert
by john.horne＠plymouth.ac.uk 25 May '12

25 May '12

Hello, I'm running Xymon 4.3.7 on a test server, and found this morning that the 'xymonlaunch' process had died. The server is a bit flaky, so I very much suspect that this is due to a server memory fault and not the code :-) The xymonlaunch log file shows it starting up a few days ago, then nothing. What is a concern is that Xymon itself gave no indication that xymonlaunch had died. The 'non-green' page shows one local test ('msgs') as red due to some other event, but 'xymond', 'xymongen' and 'xymonnet' show green. However, if I click on the xymongen or xymonnet page then it shows a purple background. Is xymonlaunch not itself monitored as a process by Xymon? John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 1

Show trends graph as test?
by john.horne＠plymouth.ac.uk 25 May '12

25 May '12

Hello, Using Xymon 4.3.7 I see that the 'trends' column can show graphs for the host network interface (network traffic/bits per second) and disk I/O utilisation (from iostat). My understanding is that the information comes from each host via the client data. My question is, is it possible to get these two items reported as separate tests? That is, as a test named (say) 'iostat' which shows the disk I/O utilisation graph as seen in 'trends'. And another test called 'netstat' (or 'ifstat') for the network traffic graph? The data is already being collected (as evidenced by the trends column), but I'm not sure how to breakout these graphs so that they can be reported as individual specific tests with their own column. Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

1 1

SMS alerts
by sofronie_emil＠yahoo.com 25 May '12

25 May '12

Hello, I just enable the SMS alerts for a SERVICE but seems that something it's not ok because I get the alert even when the SERVICE it's GREEN. If I add the option REPEAT=5m I get the SMS every 5 minutes even if the services it's ok. SCRIPT /home/xymon/server/bin/sms/sms.sh SERVICE=instance_demo COLOR=red or SCRIPT /home/xymon/server/bin/sms/sms.sh SERVICE=instance_demo COLOR=red REPEAT=5m I was not able to use $RCPT "$BBALPHAMSG" inside the script /home/xymon/server/bin/sms/sms.sh. Seems that the these variables has not been exported at the run time. ./sendsms.sh $RCPT "$BBALPHAMSG" . The email alert it's working properly for the same service. MAIL xxx at xxx.com.au SERVICE=instance_demo REPEAT=1m RECOVERED Thanks Constantin

1 0

test
by jawood＠employers.com 24 May '12

24 May '12

James Wood | EMPLOYERS Information Technology Infrastructure Support - Unix Administrator Office 775-327-2522 Cell 775-742-3207 [Description: Description: Description: http://sharepoint/SiteCollectionImages/EMPSigLogo.jpg] --------------------------------------------------------------------- ********************************************************************************************* Notice: This e-mail, including any attachment(s), is confidential and intended solely for the above named individual(s). It constitutes non-public information and may contain information subject to certain legal privileges. If you are the intended recipient, your use of any confidential or personal information may be restricted by federal and state privacy laws. Any use of this communication by others is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify me immediately by replying to sender and delete this e-mail and any attachment(s). Thank you. ********************************************************************************************* ---------------------------------------------------------------------

1 0