January 2013 - Xymon - Xymon mailman web

Problem with NOTICE rule in alerts.cfg
by waa-hobbitml＠revpol.com 24 May '13

24 May '13

I noticed that the xymon_alerts docs show there is a NOTICE keyword which is described as: NOTICE Rule matches if the message is a "notify" message. This type of message is sent when a host or test is disabled or enabled. I wanted to be alerted via a custom SMS script of any test as soon as it is enabled or disabled. So in the alerts.cfg file I had initially set up a line that I thought would trigger whenever a test was enabled or disabled like so: HOST=* SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS NOTICE As I was testing enabling and disabling, it appeared that I had gotten the syntax correct and I was off to the next thing. However, when a normal test went yellow, I received two SMS alerts for it. My logs shows that the CFID environment variable was showing that my new alert listed above was triggering the SMS as well as the PAGE=%firewalls/* alert that was supposed to trigger it. I then tried NOTICE SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS as well as NOTICE=* SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS and finally HOST=* NOTICE SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS But it seems that ANY status change including normal green, yellow, red, purple triggers this alert as well as any other correctly matching alert. I did some additional testing with all three above configurations using: xymond_alert --test fw.example.com testname And each of them showed (in order): *** Match with 'HOST=*' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS NOTICE' *** *** Match with 'NOTICE' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' *** *** Match with 'NOTICE=*' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' *** *** Match with 'HOST=* NOTICE' *** *** Match with 'SCRIPT $xymon-sms-alert $waaphone TIME=$smsalerthours FORMAT=SMS' *** Would love to get this working correctly and appreciate any help! -- Bill Arlofski Reverse Polarity, LLC http://www.revpol.com/

2 2

Duplicate email Recipients in Info page
by Don.Kuhlman＠schawk.com 10 May '13

10 May '13

Hi folks. Still working on cleaning up my xymon infrastructure. I believe I'm getting a better handle on things with my analysis.cfg and alerts.cfg settings now. I made some more changes to the analysis and alerts files to add other groups for emails. So now, I think I've duplicated a notify group in one or the other places. When I click on a certain host's info link on an application page, I'm seeing the same target recipient for things like conn, cpu, disk, memory, etc. What's the best way to troubleshoot my rules/settings to figure out where I'm setting the duplicated target recipients at? PS – I can send along the alerts and analysis files if that helps. Thanks much! Don K

5 13

xymon e-mail alerts show up as attachments instead of e-mail
by icepickjazz＠gmail.com 29 Mar '13

29 Mar '13

Not a wild thought. Yes you are correct. I was getting ready to post my findings. We recently moved our xymon server from fedora core 3 to SLES 11. Fedora used mail and SLES 11 mail is linked to mailx. The windows clients are sending carriage returns in the status ^M (carriage return). The problem occured on SuSe server but not on redhat server, because mailx expects input text to be in Unix format, with lines separated by *newline*(^J, \n) characters only. Non-Unix text files that use *carriage return* (^M, \r) characters in addition will be treated as binary data. Hence the reason we get notifications that show up as attachments. Also explains why AIX servers don't have the problem and the windows servers do. Thanks On Mon, Sep 19, 2011 at 9:36 PM, Scott Pfister <icepickjazz at gmail.com>wrote: > Not a wild thought. Yes you are correct. I was getting ready to post my > findings. We recently moved our xymon server from fedora core 3 to SLES > 11. Fedora used mail and SLES 11 mail is linked to mailx. The windows > clients are sending carriage returns in the status ^M (carriage return). > The problem occured on SuSe server but not on redhat server, because mailx > expects input text to be in Unix format, with lines separated by *newline*(^J, \n) characters only. Non-Unix text files that use > *carriage return* (^M, \r) characters in addition will be treated as > binary data. Hence the reason we get notifications that show up as > attachments. Also explains why AIX servers don't have the problem and the > windows servers do. > > Thanks > > > On Mon, Sep 19, 2011 at 8:08 PM, Ralph Mitchell <ralphmitchell at gmail.com>wrote: > >> Wild thought - could the Windows reports be turned into attachments in >> your email server and/or client because the line-ends are <cr><lf> instead >> of just <lf> ?? >> >> Ralph Mitchell >> >> >> On Mon, Sep 19, 2011 at 6:06 PM, Scott Pfister <icepickjazz at gmail.com>wrote: >> >>> Good day, >>> >>> We are running xymon 4.2.3 and are experiencing some particularities with >>> e-mail alerts showing up as attachments like att00001.bin instead of the >>> normal message. The problem is sporadic. For example windows server throws >>> CPU alter. E-mail sent shows up as an attachment in the recipient e-mail. >>> AIX servers throw cpu alerts don't experience this problem. Client >>> shouldn't matter. Any tips for troubleshooting this issue? If we open the >>> attachment in the editor it shows what should be in the body of the email. >>> Hobbit server is running postfix. >>> >>> red Mon Sep 19 15:07:50 EDT 2011 [indyctx8.companyname.com] up: 10:12, 1 >>> users, 224 procs, load=100%, PhysicalMem: 3072MB(74%) >>> >>> >>> >>> Memory Statistics >>> Total Physical memory: 3220598784 bytes (3.00GB) >>> Available Physical memory: 850558976 bytes (812.00MB) >>> Total PageFile size: 4294967295 bytes (4.00GB) >>> Available PageFile size: 4294967295 bytes (4.00GB) >>> Total Virtual memory size: 2147352576 bytes (2.00GB) >>> Available Virtual memory size: 2106589184 bytes (1.96GB) >>> >>> Most active processes >>> 96.23% oexplore (0x26a4 [9892]) >>> 00.60% svchost (0xbf0 [3056]) >>> 00.32% lsass (0x23c [572]) >>> 00.26% oexplore (0x29c8 [10696]) >>> 00.25% oexplore (0x255c [9564]) >>> 00.21% Smc (0x3c4 [964]) >>> 00.20% SmcGui (0x3230 [12848]) >>> 00.19% oexplore (0x20dc [8412]) >>> 00.16% oexplore (0x14d0 [5328]) >>> 00.13% XTE (0xfc4 [4036]) >>> >>> See >>> http://hobbit.companyname.docm/hobbit-cgi/bb-hostsvc.sh?HOST=indyctx8&SERVI… >>> >>> >>> thanks, >>> >>> Scott >>> >>> >>> >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >>> >> >

3 2

upcoming release / trunk / ipv6
by s.seitz＠secretresearchfacility.com 14 Feb '13

14 Feb '13

Hi! I'm currently going to setup some "cloud" infrastructure as a training platform to get a deeper insight into very recent developments, like nested virtualization, storage failover and a lot of IPv6. Since my fellow hobbit did very well over the last couple of years, I'ld really like to stay with xymon. My question targets the proposed IPv6 capabilities in the upcoming release. Is it worth to give a try to the code in trunk? Or is it too early for resiliant statements? Also, should I expect big configuration differences between 4.3.10 and the cutting edge? Thanks for your suggestions! Cheers, - Stephan

3 2

SSL Error after upgrading to Fedora 18
by Jason.Chambers＠geosoft.com 08 Feb '13

08 Feb '13

Hi all, I just upgraded to Fedora 18, and now servers that have SSL signed by our internal CA is failing. The http test simply shows "SSL error" meanwhile our public (GoDaddy) certs aren't causing issues. Is there a log file I can peer into to find out why I'm getting these error messages all of a sudden? Jason Chambers Network Administrator | Geosoft geosoft.com<http://www.geosoft.com/> | blog<http://blogs.geosoft.com/> | twitter<http://twitter.com/geosoft> | linkedIn<http://www.linkedin.com/company/geosoft-inc.> | facebook<http://www.facebook.com/GeosoftInc> | T +1 416.369.0111 #344 | M +1 416.508.1410 Trending topic on Earth Explorer: VOXI Earth Modelling<http://www.earthexplorer.com/2012/Introduction_of_VOXI_Earth_Modelling_tech…>

5 13

No graph for xymonnet
by vadud3＠gmail.com 08 Feb '13

08 Feb '13

Hi I am not getting any graph for xymonnet. I am running xymon 4.3.10 I do have a xymonnet.rrd file -rw-r--r-- 1 xymon xymon 20K 2013-01-23 14:49 xymonnet.rrd It's name is runtime and type is GAUGE per rrdtool dump When I tried to draw a graph it did not like GAUGE type. # rrdtool graph /tmp/test.png DEF:p1=xymonnet.rrd:runtime:GAUGE LINE2:p1#ff00ff ERROR: Unknown CF 'GAUGE' in 'DEF:p1=xymonnet.rrd:runtime:GAUGE' So I changed it to AVERAGE type, but the graph is empty. # rrdtool graph /tmp/test.png DEF:p1=xymonnet.rrd:runtime:AVERAGE LINE2:p1#ff00ff481x149 # ls -lh /tmp/test.png -rw-r--r-- 1 root root 6.1K 2013-01-23 15:18 /tmp/test.png # display /tmp/test.png shows empty graph. What gives? -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

3 4

ISO documentation on flapping status?
by betsy.schwartz＠gmail.com 05 Feb '13

05 Feb '13

We've got a bunch of servers showing as "flapping". I understand that this is a new feature but haven't found the docs on how to tweak it. Where and how can this be changed? thanks Betsy

3 3

Bug report: Crash xymond_rrd
by nloyau.ext＠orange.com 01 Feb '13

01 Feb '13

Hello Xymon team, I discovered a bug in xymond_rrd module present in release 4.3.7 and after. Some times function update_rrd in do_rrd.c msg pointer (*msg) can be null. That cause an segfault at strchr call. Following the coredump analyse #0 0xb775e424 in __kernel_vsyscall () #1 0xb741e781 in raise () from /lib/i686/cmov/libc.so.6 #2 0xb7421bb2 in abort () from /lib/i686/cmov/libc.so.6 #3 0x08070723 in sigsegv_handler (signum=11) at sig.c:57 #4 <signal handler called> #5 0xb7466a83 in strchr () from /lib/i686/cmov/libc.so.6 #6 0x08050b80 in do_ncv_rrd (hostname=0xb6c847af "lvmpitg-sql02o.lvm93.cvf", testname=0xb6c847c8 "mbs_oracle1", classname=0x807fc0d "", pagepaths=0x807fc0d "", msg=0x0, tstamp=1359477166) at rrd/do_ncv.c:54 #7 0x0805a45f in update_rrd (hostname=0xb6c847af "lvmpitg-sql02o.lvm93.cvf", testname=0xb6c847c8 "mbs_oracle1", msg=0x0, tstamp=1359477166, sender=0xb6c847a1 "10.193.26.14", ldef=0x9f5d608, classname=0x807fc0d "", pagepaths=0x807fc0d "") at do_rrd.c:712 #8 0x0804a90f in main (argc=3, argv=0xbfadf744) at xymond_rrd.c:369 I have modified source code to control msg content. See the attachement. I suppose that isn't the best way to procede but that work better now. Best regards, *Nicolas LOYAU* _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, France Telecom - Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 1

Disabling History
by C.Simmons＠criflending.com 31 Jan '13

31 Jan '13

Is there any way to pull history of disabled reasons for host? Once a host is enabled I don't see a way to find out why it was originally disabled. I also do not see a way to add additional notes to the disabled host once the host has been disabled initially. Is this possible or maybe a feature request for a future version? v4.3.10 Thanks in advance, Clint This e-mail (and any attachment) is strictly confidential and for use only by intended recipient(s). The opinions therein expressed are those of the author. Its contents, therefore, do not represent any commitment between the company and the recipient(s) and no liability or responsibility is accepted by the company for the above mentioned content. If you are not an intended recipient(s), please notify the author promptly and delete this message.

1 0

Problem disabling large groups of hosts
by C.Simmons＠criflending.com 31 Jan '13

31 Jan '13

I'm having a problem trying to disable over 1000+ hosts and tests at one time for maintenance windows. I've even tried disabling in groups of 100-200 but it will still miss a group of servers here and there. It seems that when I click "apply" and once the screen refreshes could possibly stop running the enadis.sh/cgi script in the background (??) Is there a way to debug this or modify the refresh time/interval? The reason we want to disable all these hosts/tests for maintenance windows is to keep SLA during the reboots and service outages for patching etc.. Does anyone have other recommendations or suggest using REPORTTIME globally instead? FreeBSD 9.0 Apache 2.2.22 Xymon v4.3.10 Thanks in advance, Clint This e-mail (and any attachment) is strictly confidential and for use only by intended recipient(s). The opinions therein expressed are those of the author. Its contents, therefore, do not represent any commitment between the company and the recipient(s) and no liability or responsibility is accepted by the company for the above mentioned content. If you are not an intended recipient(s), please notify the author promptly and delete this message.

4 4