July 2012 - Xymon - Xymon mailman web

holiday as planned downtime
by Jurgen.Claessens＠cegeka.be 11 Dec '12

11 Dec '12

Hey all, I'm running xymon 4.3.7 and I have been trying to find a way so that the holidays are being showed as what would be the same for the alerting. For me this would mean that if it's a holiday they would show as planned downtime and not show up in the allnongreen window. The alerting itself works without problems, but I cannot find a way for the planned downtime act the same way. Can anyone point me in the right direction? This e-mail and all files transmitted as attachment(s) thereto are confidential and solely intended for the individual to whom or the organization to which they are addressed. If you received this e-mail by mistake, please notify Cegeka's Service Desk at cegeka.support at cegeka.be or call +32 (0)11 240 363. We thank you in advance. Cegeka hereby confirms that this message has been swept by Sophos for the presence of viruses.

2 3

diskstat.sh/RRD oddity
by sholmes42＠mac.com 18 Oct '12

18 Oct '12

This is just a comment on an oddity with respect to diskstat.sh and RRD. We make pretty heavy use of the diskstat.sh script, which I believe I downloaded from xymonton. When I installed it I used the standard clientlaunch.cfg stanza for the configuration and everything worked great. I was called to task today because we have been having some disk io issues on the RHEL VMs and someone was looking at the trend graphs for some servers to see if there was anything they could learn and they noticed that beginning at about 4pm local time on Monday the graphs for the number of sectors written per second on a couple of file systems on several VMs jumped from the 10 to 20 range to the 300 to 340 range and stayed there. The graph for number of disk writes per second had a corresponding jump up to about 40 or 50 from close to zero. In analyzing the data I discovered that the file system that was displaying this behavior is the same file system to which the diskstat.sh script is writing its temp files. It appears that for some reason, starting at 4pm on Monday the 5 minute test interval and the 5 minute average for RRD got in sync and all it was seeing was the data point that corresponded to its own writing activity and RRD was using it for the entire 5 minute average (of course, that's what RRD does). I 'fixed' it by changing the test interval to something less than 5 minutes. I tried 2, 3, and 4 minutes and they all had the effect of reducing the data in the plot back to the expected level, i.e. to the level it was before 4pm on Monday. The mystery remains why it suddenly started seeing and using its own disk activity at the same time on several different servers. Steve Holmes ITaP/Purdue University -- If they give you ruled paper, write the other way. -Juan Ramon Jimenez, poet, Nobel Prize in literature (1881-1958) I prayed for freedom for twenty years, but received no answer until I prayed with my legs. -Frederick Douglass, Former slave, abolitionist, editor, and orator (1817-1895)

5 10

Event History
by kconnell＠ryerson.ca 04 Oct '12

04 Oct '12

I built a new Xymon server this week with v4.3.7 and all looks good. Can I copy event history from my current Xymon/Hobbit v4.2.2 server to the new ? I did try copying files/directories over from /xymon/data/<hist>&<histlogs>, but that didn't seem to work... Ken Connell Intermediate Network Engineer Computer & Communication Services Ryerson University 350 Victoria St RM AB50 Toronto, Ont M5B 2K3 416-979-5000 x6709

3 2

Duplicate email Recipients in Info page
by Don.Kuhlman＠schawk.com 14 Sep '12

14 Sep '12

Hi folks. Still working on cleaning up my xymon infrastructure. I believe I'm getting a better handle on things with my analysis.cfg and alerts.cfg settings now. I made some more changes to the analysis and alerts files to add other groups for emails. So now, I think I've duplicated a notify group in one or the other places. When I click on a certain host's info link on an application page, I'm seeing the same target recipient for things like conn, cpu, disk, memory, etc. What's the best way to troubleshoot my rules/settings to figure out where I'm setting the duplicated target recipients at? PS – I can send along the alerts and analysis files if that helps. Thanks much! Don K

2 4

Question on df processing for xymonclient-linux.sh
by Mark.Deiss＠acs-inc.com 04 Sep '12

04 Sep '12

In looking df processing in the Linux Xymon client module in client/xymonclient-linux.sh: echo "[df]" EXCLUDES=`cat /proc/filesystems | grep nodev | awk '{print $2}' | xargs echo | sed -e 's! ! -x !g'` df -Pl -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' A bit concerned that the df line can have a dangling "-x" option if the EXCLUDES variable is not populated. With a dangling "-x", the df command will abort with a syntax error and the df status will probably end up with a green status with no rrd history being populated. Users would not be aware unless they specifically brought up the green disk display or were reviewing disk trends and noticing the gap. The EXCLUDES variable can become null if the xymon client account loses read access to /proc/filesystems, for some reason the Linux flavor quit using the nodev tag (maybe started using NODEV or Nodev after a patch update....) or the xymon client went onto an (older) Linux version that did not use the /proc system. Suggest a revision either using sed or awk to build the EXCLUDES variable and a modification of the df command to eliminate the dangling "-x" option EXCLUDES=`cat /proc/filesystems 2>/dev/null | awk ' $1 ~ /nodev/ { printf("-x %s ", $2) }'` Or EXCLUDES=`cat /proc/filesystems 2>/dev/null | sed -ne ' /nodev/{ s/nodev[ ]*/ -x / H } ${ x s/\n//g p }'` df -Pl -x iso9660 $EXCLUDES 2>/dev/null | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' If the parsing for nondev entries in /proc/filesystems now blows up for whatever reason (EXCLUDES is null), the df command will be capturing more than is desired which I believe would be preferred over missing the important file systems. Would like to use "2>&1" rather than "2>/dev/null" in the df line except any captured error lines may cause some downstream havoc with the rrd database processing.

4 5

PATCH - do_ifstat.c
by john.horne＠plymouth.ac.uk 31 Jul '12

31 Jul '12

Hello, I noticed that one of our clients was not showing a trends 'Network Traffic' graph produced from the client 'ifconfig' data. The client is running Fedora 17, and it seems that the xymond/rrd/do_ifstat.c code detects the interface but not the receive/transmit data. The ifconfig output from Fedora 17 looks like: ======================================== em1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 141.163.6.4 netmask 255.255.0.0 broadcast 141.163.255.255 inet6 fe80::219:d1ff:fe80:83ed prefixlen 64 scopeid 0x20<link> ether 00:19:d1:80:83:ed txqueuelen 1000 (Ethernet) RX packets 20450819 bytes 11344298271 (10.5 GiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 17144411 bytes 19407350261 (18.0 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 device interrupt 20 memory 0xe0400000-e0420000 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 16436 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RX packets 1542160 bytes 419850208 (400.4 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1542160 bytes 419850208 (400.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255 ether 52:54:00:2b:92:84 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ======================================== Attached is a patch which detects the RX and TX 'bytes' values. It also strips the trailing colon character from the interface name if it is present. This then allows the 'lo:' interface to be detected as the loopback interface (and so ignored). The patch has been tested with Xymon 4.3.7 and seems to work fine. I have checked the 4.3.9 code, and although the code has changed a little, it has not changed in this area of the code. John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 1

Any way to log the critical system view ack’s?
by wrichardson＠llbean.com 31 Jul '12

31 Jul '12

I was looking at a way to log the critical system view ack’s. Looking thru the archives I found this thread back in 2007: http://lists.xymon.com/archive/2007-November/015949.html Issue: Missing a Log/Report from Critical view. A Report with information about the alerts and acknowledgeds information that were made in Critical systems would be helpful. Response: Right now it isn't even being logged, except inside the Hobbit daemon. A reporting tool is needed, I agree. Any update on if this is now possible? Any way to get the Xymon daemon to output the critical view ack logs? Thanks Bill

1 0

xymond_alert / alerts.cfg duration bugs or documentation issues
by henrik＠hswn.dk 31 Jul '12

31 Jul '12

On 28-05-2012 15:28, SebA wrote: > 2 possible bugs or documentation errors... > *Summary:* > 1. xymond_alert interprets duration as minutes although the > documentation says it is specified as seconds. Right, I'll correct the documentation so it is clear that the duration values are in minutes (in 4.3.9). > 2. > is interpreted as >= (greater than or equal to) instead of > > (greater than) in alerts.cfg. Fixed in 4.3.9, so you can explicitly use ">=" or "<=" instead of ">" and "<" behaving as such (you cannot actually specify ">=" in 4.3.x versions prior to 4.3.9). > *Other Suggestion:* > alerts.cfg should accept durations specified in seconds (with an s > suffix) so that alert parameters can be more accurately defined as some > tests or status changes may be occurring more often than once a minute. Not really meaningful, IMHO. Also, the alert handler only polls for new alerts every 30 seconds so it would increase the load significantly if we had to support per-second alerts. Regards, Henrik

2 1

OverSize status message and network tests
by joea＠j4computers.com 31 Jul '12

31 Jul '12

Recently moved to xymon 4.3.7 from hobbit 4.2 All seems reasonable except for two things. - Due to firewall issues, some net tests do not work. The firewall lets the "old" IP thru, but not the new servers IP. Go an answer to this some weeks back, which stated change ~server/etc/tasks.cfg to specify --source-ip=old.ip. This I took to go in [xymonnet] as an add on to the CMD line. retired old box and added IP to new box, as secondary IP, edited the file and restarted xymon server. No go. I can ping the destination successfully by telling ping to use the added IP as its source IP. I can see tcpdump tell me the source is still the original for the new server. ?? Th - While looking for clues, stumbled upon a oversize status message in xymond.log. It is oversize (!), but is being sent in the form (echo "status . . blah"; cat mymessage_file | blah formatting stuff | /home/xymon/client/bin/xymon my_server_name "@" -- Which someone on this list (Henrik ?) turned me on to a year or so ago. Anyway . . . Some assistance?

1 0

FW: BBwin Setup issue
by Venkatesh_S04＠infosys.com 31 Jul '12

31 Jul '12

Thanks Steve .I reverted the regedit change and it started to work . I knew you have the solution . Thank you for this and all the help you have provided me so far ! From: Steven Carr [mailto:sjcarr at gmail.com] Sent: Monday, July 30, 2012 8:13 PM To: Venkatesh Subbaramu Subject: Re: FW: BBwin Setup issue Not sure to be honest, I never had to change anything in the registry I just updated the XML file to include: <setting name="hostname" value="fully.qualified.domain.name<http://fully.qualified.domain.name>" /> But I'm also running in central mode, so not sure if that makes any difference? Steve On 30 July 2012 15:29, Venkatesh Subbaramu <Venkatesh_S04 at infosys.com<mailto:Venkatesh_S04 at infosys.com>> wrote: Hi Steve , just wondering if you can help ? I have posted this to the BBwin group aswell . Regards, Venky From: Venkatesh Subbaramu Sent: Monday, July 30, 2012 5:53 PM To: 'bbwin-help at lists.sourceforge.net<mailto:bbwin-help at lists.sourceforge.net>' Subject: BBwin Setup issue Hi All , I have installed BBWin on my host (server that needs monitoring that is running on 64 bit windows 2008) and have setup the BBWin.cfg as follows bbdisplay is the Xymon IP address and Port .I have added an additional setting called hostname that has a complete name of the host and have changed the regedit hostname value from %COMPUTERNAME% to %COMPUTERNAME%.%USERDNSDOMAIN% in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BBWin . However I do not see any counters being monitored on xymon page .Could you please point me to the troubleshooting steps or anything additional that I might have been required to do ? Any help is appreciated . I do not see any errors in the BBwin log . I did run the following test from the host machine and got the below results . But I was unable to see any change in the xymon display . C:\Program Files (x86)\BBWin\bin>bbwincmd XXX.XX.XX.XXX:1984 status WinsXXXXP.ad.infosys.com<http://WinsXXXXP.ad.infosys.com> cpu green Test bbdisplay defined to : XXX.XX.XX.XXX port defined to : 1984 hostname defined to: WinsXXXXP.ad.infosys.com<http://WinsXXXXP.ad.infosys.com> Sending status ... Sending to XXX.XX.XX.XXX: status WinsXXXXP.ad.infosys.com.cpu green Test Below is the BBwin.cfg <?xml version="1.0" encoding="utf-8" ?> <configuration> <bbwin> <setting name="bbdisplay" value="XXX.XX.XX.XXX:1984" /> <setting name=”hostname” value=”WinsXXXXP.ad.infosys.com<http://WinsXXXXP.ad.infosys.com>” />       <setting name="mode" value="local" /> <setting name="configclass" value="win32" /> <setting name="autoreload" value="true" /> <setting name="timer" value="5m" /> <load name="cpu" value="cpu.dll"/> <load name="disk" value="disk.dll"/> <load name="externals" value="externals.dll"/> <load name="filesystem" value="filesystem.dll"/> <load name="memory" value="memory.dll"/> <load name="msgs" value="msgs.dll"/> <load name="procs" value="procs.dll"/> <load name="stats" value="stats.dll"/> <load name="svcs" value="svcs.dll"/> <load name="uptime" value="uptime.dll"/> <load name="who" value="who.dll"/> <setting name="loglevel" value="3" /> <setting name="logpath" value="C:\Program Files (x86)\BBWin\logs\BBWin.log"/>  <setting name="logreportfailure" value="true" /> </bbwin> <cpu>  <setting name="alwaysgreen" value="false" /> <setting name="default" warnlevel="90" paniclevel="95" delay="3" /> </cpu> <disk>  <setting name="alwaysgreen" value="false" />  <setting name="default" warnlevel="85%" paniclevel="95%" />   <setting name="remote" value="false" />  <setting name="cdrom" value="false" /> </disk> <externals> <setting name="timer" value="3m" /> <setting name="logstimer" value="60s" />  </externals> <memory>  <setting name="alwaysgreen" value="false" /> <setting name="physical" warnlevel="78" paniclevel="98" /> <setting name="page" warnlevel="70" paniclevel="90" /> <setting name="virtual" warnlevel="78" paniclevel="90" /> </memory> <msgs> <setting name="alwaysgreen" value="false" /> <setting name="delay" value="1h" /> <match logfile="System" type="error" alarmcolor="red" /> <match logfile="System" type="warning" alarmcolor="yellow" /> <match logfile="Application" type="error" alarmcolor="red" /> <match logfile="Application" type="warning" alarmcolor="yellow" /> <match logfile="Security" type="fail" />  </msgs> <procs>  </procs> <svcs> <setting name="autoreset" value="true" /> <setting name="SQL Server (DOSSF)" value="stoppped" alarmcolor="red" /> <setting name="SQL Server Agent (DOSSF)" value="stoppped" alarmcolor="red" /> </svcs> <uptime> <setting name="delay" value="30m" /> <setting name="maxdelay" value="365d" /> </uptime> </configuration> **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

1 0