July 2012 - Xymon - Xymon mailman web

holiday as planned downtime
by Jurgen.Claessens＠cegeka.be 11 Dec '12

11 Dec '12

Hey all, I'm running xymon 4.3.7 and I have been trying to find a way so that the holidays are being showed as what would be the same for the alerting. For me this would mean that if it's a holiday they would show as planned downtime and not show up in the allnongreen window. The alerting itself works without problems, but I cannot find a way for the planned downtime act the same way. Can anyone point me in the right direction? This e-mail and all files transmitted as attachment(s) thereto are confidential and solely intended for the individual to whom or the organization to which they are addressed. If you received this e-mail by mistake, please notify Cegeka's Service Desk at cegeka.support at cegeka.be or call +32 (0)11 240 363. We thank you in advance. Cegeka hereby confirms that this message has been swept by Sophos for the presence of viruses.

2 3

diskstat.sh/RRD oddity
by sholmes42＠mac.com 18 Oct '12

18 Oct '12

This is just a comment on an oddity with respect to diskstat.sh and RRD. We make pretty heavy use of the diskstat.sh script, which I believe I downloaded from xymonton. When I installed it I used the standard clientlaunch.cfg stanza for the configuration and everything worked great. I was called to task today because we have been having some disk io issues on the RHEL VMs and someone was looking at the trend graphs for some servers to see if there was anything they could learn and they noticed that beginning at about 4pm local time on Monday the graphs for the number of sectors written per second on a couple of file systems on several VMs jumped from the 10 to 20 range to the 300 to 340 range and stayed there. The graph for number of disk writes per second had a corresponding jump up to about 40 or 50 from close to zero. In analyzing the data I discovered that the file system that was displaying this behavior is the same file system to which the diskstat.sh script is writing its temp files. It appears that for some reason, starting at 4pm on Monday the 5 minute test interval and the 5 minute average for RRD got in sync and all it was seeing was the data point that corresponded to its own writing activity and RRD was using it for the entire 5 minute average (of course, that's what RRD does). I 'fixed' it by changing the test interval to something less than 5 minutes. I tried 2, 3, and 4 minutes and they all had the effect of reducing the data in the plot back to the expected level, i.e. to the level it was before 4pm on Monday. The mystery remains why it suddenly started seeing and using its own disk activity at the same time on several different servers. Steve Holmes ITaP/Purdue University -- If they give you ruled paper, write the other way. -Juan Ramon Jimenez, poet, Nobel Prize in literature (1881-1958) I prayed for freedom for twenty years, but received no answer until I prayed with my legs. -Frederick Douglass, Former slave, abolitionist, editor, and orator (1817-1895)

5 10

Event History
by kconnell＠ryerson.ca 04 Oct '12

04 Oct '12

I built a new Xymon server this week with v4.3.7 and all looks good. Can I copy event history from my current Xymon/Hobbit v4.2.2 server to the new ? I did try copying files/directories over from /xymon/data/<hist>&<histlogs>, but that didn't seem to work... Ken Connell Intermediate Network Engineer Computer & Communication Services Ryerson University 350 Victoria St RM AB50 Toronto, Ont M5B 2K3 416-979-5000 x6709

3 2

Question on df processing for xymonclient-linux.sh
by Mark.Deiss＠acs-inc.com 04 Sep '12

04 Sep '12

In looking df processing in the Linux Xymon client module in client/xymonclient-linux.sh: echo "[df]" EXCLUDES=`cat /proc/filesystems | grep nodev | awk '{print $2}' | xargs echo | sed -e 's! ! -x !g'` df -Pl -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' A bit concerned that the df line can have a dangling "-x" option if the EXCLUDES variable is not populated. With a dangling "-x", the df command will abort with a syntax error and the df status will probably end up with a green status with no rrd history being populated. Users would not be aware unless they specifically brought up the green disk display or were reviewing disk trends and noticing the gap. The EXCLUDES variable can become null if the xymon client account loses read access to /proc/filesystems, for some reason the Linux flavor quit using the nodev tag (maybe started using NODEV or Nodev after a patch update....) or the xymon client went onto an (older) Linux version that did not use the /proc system. Suggest a revision either using sed or awk to build the EXCLUDES variable and a modification of the df command to eliminate the dangling "-x" option EXCLUDES=`cat /proc/filesystems 2>/dev/null | awk ' $1 ~ /nodev/ { printf("-x %s ", $2) }'` Or EXCLUDES=`cat /proc/filesystems 2>/dev/null | sed -ne ' /nodev/{ s/nodev[ ]*/ -x / H } ${ x s/\n//g p }'` df -Pl -x iso9660 $EXCLUDES 2>/dev/null | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' If the parsing for nondev entries in /proc/filesystems now blows up for whatever reason (EXCLUDES is null), the df command will be capturing more than is desired which I believe would be preferred over missing the important file systems. Would like to use "2>&1" rather than "2>/dev/null" in the df line except any captured error lines may cause some downstream havoc with the rrd database processing.

4 5

OverSize status message and network tests
by joea＠j4computers.com 06 Aug '12

06 Aug '12

Recently moved to xymon 4.3.7 from hobbit 4.2 All seems reasonable except for two things. - Due to firewall issues, some net tests do not work. The firewall lets the "old" IP thru, but not the new servers IP. Go an answer to this some weeks back, which stated change ~server/etc/tasks.cfg to specify --source-ip=old.ip. This I took to go in [xymonnet] as an add on to the CMD line. retired old box and added IP to new box, as secondary IP, edited the file and restarted xymon server. No go. I can ping the destination successfully by telling ping to use the added IP as its source IP. I can see tcpdump tell me the source is still the original for the new server. ?? Th - While looking for clues, stumbled upon a oversize status message in xymond.log. It is oversize (!), but is being sent in the form (echo "status . . blah"; cat mymessage_file | blah formatting stuff | /home/xymon/client/bin/xymon my_server_name "@" -- Which someone on this list (Henrik ?) turned me on to a year or so ago. Anyway . . . Some assistance?

3 10

Custom test- stats graphs and verbose text displayed on one page?
by betsy.schwartz＠gmail.com 03 Aug '12

03 Aug '12

I'm writing a custom test, call it "ABC", with a fair amount of verbose output. The test works fine. When I send just the colon-separated statistics to a separate test page, call it ABC_stats, the ABC_stats RRD graphs work fine. But I'm wondering, is there a way to get the ABC_stats graphs onto the ABC output page? I tried sending it all together but RRDtool choked on the unexpected data. Sample ABC output: Total : 460599 Success : 450123 Failed : 10472 Files examined /data/foo/bar/yadda.20120725.log /data/foo/bar/yadda.20120726.log Errors: /data/foo/bar/yadda.20120725.log had value XYZ outside the expected range /data/foo/bar/yadda.20120725.log had value ABC with incomplete data

4 7

Xymon Monitor for Vmware ESXi
by gudm00＠gmail.com 02 Aug '12

02 Aug '12

Well there is a new version online now which includes Stevens changes. I've also updated the SVN with the code so that is online now. regards Gudmo > ----- Original Message ----- > From: Svenni > Sent: 02/18/12 06:25 PM > To: xymon > Subject: Re: [Xymon] Xymon Monitor for Vmware ESXi > > Thanks Steve. > > I hope submitting patches can be made easier through SourceForge in > the future. But I will let my college Gudmo decide how he goes about > this since he is the one currently developing and maintaining the script. > > Until then post patches here or send directly to me or Gudmo. It would be good if you could use SourceForge's subversion too. Regards, Malcolm -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

3 2

PATCH - do_ifstat.c
by john.horne＠plymouth.ac.uk 31 Jul '12

31 Jul '12

Hello, I noticed that one of our clients was not showing a trends 'Network Traffic' graph produced from the client 'ifconfig' data. The client is running Fedora 17, and it seems that the xymond/rrd/do_ifstat.c code detects the interface but not the receive/transmit data. The ifconfig output from Fedora 17 looks like: ======================================== em1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 141.163.6.4 netmask 255.255.0.0 broadcast 141.163.255.255 inet6 fe80::219:d1ff:fe80:83ed prefixlen 64 scopeid 0x20<link> ether 00:19:d1:80:83:ed txqueuelen 1000 (Ethernet) RX packets 20450819 bytes 11344298271 (10.5 GiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 17144411 bytes 19407350261 (18.0 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 device interrupt 20 memory 0xe0400000-e0420000 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 16436 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10<host> loop txqueuelen 0 (Local Loopback) RX packets 1542160 bytes 419850208 (400.4 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1542160 bytes 419850208 (400.4 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255 ether 52:54:00:2b:92:84 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ======================================== Attached is a patch which detects the RX and TX 'bytes' values. It also strips the trailing colon character from the interface name if it is present. This then allows the 'lo:' interface to be detected as the loopback interface (and so ignored). The patch has been tested with Xymon 4.3.7 and seems to work fine. I have checked the 4.3.9 code, and although the code has changed a little, it has not changed in this area of the code. John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 1

Any way to log the critical system view ack’s?
by wrichardson＠llbean.com 31 Jul '12

31 Jul '12

I was looking at a way to log the critical system view ack’s. Looking thru the archives I found this thread back in 2007: http://lists.xymon.com/archive/2007-November/015949.html Issue: Missing a Log/Report from Critical view. A Report with information about the alerts and acknowledgeds information that were made in Critical systems would be helpful. Response: Right now it isn't even being logged, except inside the Hobbit daemon. A reporting tool is needed, I agree. Any update on if this is now possible? Any way to get the Xymon daemon to output the critical view ack logs? Thanks Bill

1 0

xymond_alert / alerts.cfg duration bugs or documentation issues
by spah＠syntec.co.uk 31 Jul '12

31 Jul '12

2 possible bugs or documentation errors... Summary: 1. xymond_alert interprets duration as minutes although the documentation says it is specified as seconds. 2. > is interpreted as >= (greater than or equal to) instead of > (greater than) in alerts.cfg. Version affected: 4.3.7 Steps to reproduce: alerts.cfg: HOST=CS1 MAIL $pg-sebsms SERVICE=svcs COLOR=red DURATION>10m REPEAT=30 RECOVERED Also tried without the the m for minutes, as this is supposed to be the default. /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=11 | grep Mail 00009396 2012-05-28 14:09:46 Mail alert with command '/var/spool/mail/root "Xymon [12345] CS1:svcs CRITICAL (RED)" <mailto:syntecseb at sms2email.com'> <email address removed>' <mailto:syntecseb at sms2email.com'> /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=10 | grep Mail 00009483 2012-05-28 14:09:50 Mail alert with command '/var/spool/mail/root "Xymon [12345] CS1:svcs CRITICAL (RED)" <mailto:syntecseb at sms2email.com'> <email address removed>' <mailto:syntecseb at sms2email.com'> /home/hobbit/server/bin/xymond_alert --test CS1 svcs --color=red --duration=9 | grep Mail <nothing> But man xymond_alert says: --duration=SECONDS The SECONDS parameter is the duration of the alert in seconds. However, as you can see above, the xymond_alert parameter is behaving as if it was in minutes (or the alerts.cfg rule is behaving as if it was in seconds). And the > is behaving as if it were >=. Expected behaviour: 1. xymond_alert interprets duration as seconds. 2. > is interpreted as > (greater than) in alerts.cfg. Other Suggestion: alerts.cfg should accept durations specified in seconds (with an s suffix) so that alert parameters can be more accurately defined as some tests or status changes may be occurring more often than once a minute. Kind regards, SebA

2 2