October 2013 - Xymon - Xymon mailman web

analysis.cfg and TIME=
by gatis.anee＠gmail.com 29 Oct '13

29 Oct '13

Hi, Is it possible to monitor a file on a specific day of month? Thanks!

2 3

win32 svcs monitoring
by malcolm.hunter＠gmx.com 29 Oct '13

29 Oct '13

Corrected. However, these messages are in the local mode code, not central. I have a feeling this is a Xymon issue. Malcolm ----- Original Message ----- From: Neil Simmonds Sent: 10/28/13 09:25 AM To: xymon at xymon.com Subject: Re: [Xymon] win32 svcs monitoring I've just been looking at this again as this is still causing confusion. I've been looking at the svcs.cpp part of the BBWin code and while I'm not a programmer, I noticed that in 2 places the word "stopped" is actually spelt "stoppped". It's just a feeling but it might be that it is causing the false status to be reported. > -----Original Message----- > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Mark Felder > Sent: 11 October 2013 15:48 > To: xymon at xymon.com > Subject: Re: [Xymon] win32 svcs monitoring > > On Fri, Oct 11, 2013, at 9:21, Neil Simmonds wrote: > > Actually in my experience if it reports this, there is an issue but > > it's just not reporting it correctly. If you look at the list below > > you will probably find that it's actually stopped. > > > > This has been a major bugbear of mine for quite some time but I've not > > been able to find a solution. It seems that it always reports the > > status as whatever the "want" value is but when you look at the actual > > process then there really is an issue. > > > > This causes confusion for our operators as they are left wondering why > > Xymon is reporting red for a service that appears at first look to be > > in exactly the state required. > > > > > > I can't login to this specific server to confirm your suspicions, but I'll pass this info > to the other techs here _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ----------------------------------------------------------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences ar ising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net

2 1

Metrics report on Xymon 4.3.10
by Paul.Jacobs＠lchclearnet.com 29 Oct '13

29 Oct '13

Hi I have noticed that if you pick multiple hosts on the metrics report and choose "ALL" you see the reports fine but if you pick say 3 clients and then "CPU load and RAM/Swap" you get the CPU graph fine but the "RAM/Swap" just displays a box with a red cross in it? To make sure this wasn't just our installation I tried it on http://xymon.com/xymon-cgi/hostgraphs.sh?start-mon=10&start-day=29&start-yr… But this also fails and they are using 4.3.13 The individual "RAM/Swap" reports for the clients works fine , it's just when combining into the 1 graph. Also the "Disk" report does the same. http://xymon.com/xymon-cgi/hostgraphs.sh?start-mon=10&start-day=29&start-yr… Any help appreciated Thanks Paul Jacobs | Unix Support, SwapClear | LCH.Clearnet | Tel. + 44 (0) 20 73928289 | Mob. + 44 (0) 7799893009 | Email.Paul.Jacobs at lchclearnet.com<mailto:xxxx.xxxxx at lchclearnet.com>| Website: www.lchclearnet.com<http://www.lchclearnet.com> A copy of the LCH.Clearnet e-mail disclaimer can be found at: www.lchclearnet.com/disclaimer/email LCH.Clearnet Limited, Registered Office: Aldgate House, 33 Aldgate High Street, London EC3N 1EA. Recognised as a Clearing House under the Financial Services & Markets Act 2000. Reg. in England No. 25932. LCH.Clearnet SA, Siège Social: 18 rue du Quatre Septembre, 75002 Paris, Chambre de Compensation conformément au Code Monétaire et Financier. LCH.Clearnet LLC, Principal Office: 17 State Street, New York, NY 10004. Registered with the U.S. Commodity Futures Trading Commission as a derivatives clearing organization under the U.S. Commodity Exchange Act.

1 0

Housekeeping on /xymon/data/hostdata
by Neil.Simmonds＠express-gifts.co.uk 28 Oct '13

28 Oct '13

We've been getting some space issues recently on our /xymon filesystem. We don't really want to add more space so I am looking at implementing some housekeeping on the /xymon/data/hostdata folder. If I run a find command there are nearly 58000 files over 180 days old and I don't really think we need to keep client data from alerts older than that. Is there a built in way to manage this or is it a case of writing a script to manage it? Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

3 5

[Bbwin-help] win32 svcs monitoring
by malcolm.hunter＠gmx.com 28 Oct '13

28 Oct '13

Good spot. I'll fix these typos tonight and run a build. ----- Original Message ----- From: Neil Simmonds Sent: 10/28/13 09:25 AM To: xymon at xymon.com Subject: Re: [Bbwin-help] [Xymon] win32 svcs monitoring I've just been looking at this again as this is still causing confusion. I've been looking at the svcs.cpp part of the BBWin code and while I'm not a programmer, I noticed that in 2 places the word "stopped" is actually spelt "stoppped". It's just a feeling but it might be that it is causing the false status to be reported. > -----Original Message----- > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Mark Felder > Sent: 11 October 2013 15:48 > To: xymon at xymon.com > Subject: Re: [Xymon] win32 svcs monitoring > > On Fri, Oct 11, 2013, at 9:21, Neil Simmonds wrote: > > Actually in my experience if it reports this, there is an issue but > > it's just not reporting it correctly. If you look at the list below > > you will probably find that it's actually stopped. > > > > This has been a major bugbear of mine for quite some time but I've not > > been able to find a solution. It seems that it always reports the > > status as whatever the "want" value is but when you look at the actual > > process then there really is an issue. > > > > This causes confusion for our operators as they are left wondering why > > Xymon is reporting red for a service that appears at first look to be > > in exactly the state required. > > > > > > I can't login to this specific server to confirm your suspicions, but I'll pass this info > to the other techs here _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ----------------------------------------------------------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences ar ising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net

1 0

win32 svcs monitoring
by feld＠feld.me 28 Oct '13

28 Oct '13

Sometimes windows svc monitoring does strange things like report that there's an issue with a service when there really isn't. See attached image Is this something that can be fixed on the xymon-server side? Is there a parsing error?

2 4

XyMon 4.3.12 - what about HTTPS problems reported for 4.3.11 ?
by A.Chervonets＠cominder.eu 27 Oct '13

27 Oct '13

Problem is for some sites with valid certificates too. I had checked to access page with wget or lynx - and it is working. So I do not see reason why Xymon should get "Server Timeout" for the same target. Here is the debug of wget. Please, advice how to diagnose/debug Xymon to find the solution. I am a bit confused why nobody reporting the same problem: * nobody using new openssl libraries? * nobody do https tests for some, may a bot non-standard SSL certificates or web-sites? Anyway, my opinion - if this is working for all other tools like lynx, wget, browsers, this could also work in Xymon. Test case: both URL get Server Timeout in Xymon, but working with wget: URL1: https://epak.pmlp.gov.lv/ (here is redirect - I had found Xymon may have trouble with redirects over https) URL2: https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx (no redirects here, certificate valid, but XyMon can not access it) ========= URL1: =========== [xymon at myhost~]$ wget --debug https://epak.pmlp.gov.lv/ DEBUG output created by Wget 1.12 on linux-gnu. --2013-10-23 13:02:52-- https://epak.pmlp.gov.lv/ Resolving epak.pmlp.gov.lv... 195.234.144.230 Caching epak.pmlp.gov.lv => 195.234.144.230 Connecting to epak.pmlp.gov.lv|195.234.144.230|:443... connected. Created socket 3. Releasing 0x0000000001606440 (new refcount 1). Initiating SSL handshake. Handshake successful; connected socket 3 to SSL handle 0x0000000001607570 certificate: subject: /C=LV/ST=Riga/L=Riga/O=Office of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv issuer: /C=US/O=Thawte, Inc./CN=Thawte SSL CA X509 certificate successfully verified and matches host epak.pmlp.gov.lv ---request begin--- GET / HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 301 Moved Permanently Content-Length: 179 Content-Type: text/html Location: https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Wed, 23 Oct 2013 10:02:45 GMT Connection: keep-alive ---response end--- 301 Moved Permanently Registered socket 3 for persistent reuse. Location: https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx [following] Skipping 179 bytes of body: [<head><title>Document Moved</title></head> <body><h1>Object Moved</h1>This document may be found <a HREF=" https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx">here</a></body>] done. --2013-10-23 13:02:52-- https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx Reusing existing connection to epak.pmlp.gov.lv:443. Reusing fd 3. ---request begin--- GET /NYX.Nyx001.WebSite/Default.aspx HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Connection: keep-alive Date: Wed, 23 Oct 2013 10:02:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=xpwkktquphtyv02va2ms1ejv; path=/; HttpOnly Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 7365 ---response end--- 200 OK Stored cookie epak.pmlp.gov.lv -1 (ANY) / <session> <insecure> [expiry none] ASP.NET_SessionId xpwkktquphtyv02va2ms1ejv Length: 7365 (7.2K) [text/html] Saving to: `Default.aspx.2' 100%[====================================================================================================================>] 7,365 --.-K/s in 0s 2013-10-23 13:02:52 (832 MB/s) - `Default.aspx.2' saved [7365/7365] ========= URL2 ========================= [xymon at myhost~]$ wget --debug https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx DEBUG output created by Wget 1.12 on linux-gnu. --2013-10-23 13:03:58-- https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx Resolving epak.pmlp.gov.lv... 195.234.144.230 Caching epak.pmlp.gov.lv => 195.234.144.230 Connecting to epak.pmlp.gov.lv|195.234.144.230|:443... connected. Created socket 3. Releasing 0x00000000013ae4d0 (new refcount 1). Initiating SSL handshake. Handshake successful; connected socket 3 to SSL handle 0x00000000013af620 certificate: subject: /C=LV/ST=Riga/L=Riga/O=Office of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv issuer: /C=US/O=Thawte, Inc./CN=Thawte SSL CA X509 certificate successfully verified and matches host epak.pmlp.gov.lv ---request begin--- GET /NYX.Nyx002.WebSite/Default.aspx HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Connection: keep-alive Date: Wed, 23 Oct 2013 10:03:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=pecngh45oqe2sk45vhthua55; path=/; HttpOnly Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 8619 ---response end--- 200 OK Stored cookie epak.pmlp.gov.lv -1 (ANY) / <session> <insecure> [expiry none] ASP.NET_SessionId pecngh45oqe2sk45vhthua55 Registered socket 3 for persistent reuse. Length: 8619 (8.4K) [text/html] Saving to: `Default.aspx.3' 100%[====================================================================================================================>] 8,619 --.-K/s in 0s 2013-10-23 13:03:58 (1007 MB/s) - `Default.aspx.3' saved [8619/8619] ------------------- this is output from: User-Agent: Wget/1.12 (linux-gnu) output from host with older ssl and wget is the same (except User-Agent: Wget/1.11.4 Red Hat modified) From: Andrey Chervonets/Cominder/LV To: henrik at hswn.dk, Cc: xymon at xymon.com Date: 31.07.2013 18:15 Subject: Re: XyMon 4.3.12 - what about HTTPS problems repoirted for 4.3.11 ? Yes, there may be some specific or expired certificate, but workaround not working anyway, Tested, using http3 does not help for CentOS and OpenSUSE 12.3 tested with URL: https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx and some others. Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/ From: henrik at hswn.dk To: Andrey Chervonets <a.chervonets at cominder.eu>, Cc: <xymon at xymon.com> Date: 25.07.2013 13:07 Subject: Re: XyMon 4.3.12 - what about HTTPS problems repoirted for 4.3.11 ? Hi, all indications are that this is an OpenSSL library problem (present in OpenSSL 1.x, but not in the older 0.9.x versions). Debian has this bug report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702635 SuSE has this: http://lists.opensuse.org/opensuse-bugs/2013-05/msg01048.html It appears that the problem only shows up when testing sites with specific SSL implementations; e.g. I've seen it when connecting to some IIS versions. Apparently, a work-around is to force the use of SSLv3 instead of TLSv1; you can do that by changing the URL in hosts.cfg so it has "https3" instead of just "https". Regards, Henrik Den 25.07.2013 07:54, Andrey Chervonets skrev: > Good day! > > I still not received any reply for my previous messages about https > tests problems in 4.3.11 or due openssl-1.0.nnnn. > Does 4.3.12 have fixes for that? > > Or what should be the steps to find root cause and fix? > Just tell me in which direction should I go, I am not going to tale > much of Your time. > > P.S. Really, I am surprised nobody else reported similar problems. I > fill I have done something wrong. :( >

4 7

Untidy e-Mails
by Nick＠Pettefar.com 25 Oct '13

25 Oct '13

We just use crummy Outlook. It's set to text only. Can the e-mail generator of Xymon put a CR/LF in front of each colour? That would improve things enormously. Regards, Nick Pettefar On 22 October 2013 23:49, Ford, Alan <Alan.FORD at stanwell.com> wrote: > Hi, > Can your email readers handle HTML (eg most smartphones) > -----Original Message----- > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Nick Pettefar > Sent: Wednesday, 23 October 2013 2:14 AM > To: xymon > Subject: [Xymon] Untidy e-Mails > > Hi, we have various alert e-mails which look something like this: > > yellow Tue Oct 22 17:05:54 IST 2013 - Ports NOT ok &green PUCA (found 2, req. 2 or more) &green ITouch (found 0, req. none) &green Ericsson (found 2, req. 2 or more) &green TMI (found 2, req. 2 or more) &green Revenue (found 2, req. 2 or more) &green OpenSky (found 1, req. 1 or > more) &green OpenMarket (found 1, req. 1 or more) &green XIAM (found 1, req. 1 or more) &green Zamano (found 2, req. 2 or more) &green Tango (found 0, req. none) &green Opera (found 0, req. none) &green BT (found 0, req. none) &yellow Modeva (found 0, req. 1 or more) &green Gemalto (found 2, req. none) &green Biogiorno (found 0, req. none) &green Phonovation (found 3, req. 2 or more) &green Phonovation1 (found 1, req. 1 or more) &green Conductor_acnsvr1 (found 7, req. 1 or > more) &green Conductor_aaxsvr1 (found 8, req. 1 or more) > > Is there a way to tidy them up so that the individual coloured alerts can easily be discerned? > > Regards, > > Nick Pettefar > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > This email is to be read subject to the email disclaimer located at http://www.stanwell.com/email-disclaimer.aspx

4 5

Untidy e-Mails
by Nick＠Pettefar.com 22 Oct '13

22 Oct '13

Hi, we have various alert e-mails which look something like this: yellow Tue Oct 22 17:05:54 IST 2013 - Ports NOT ok &green PUCA (found 2, req. 2 or more) &green ITouch (found 0, req. none) &green Ericsson (found 2, req. 2 or more) &green TMI (found 2, req. 2 or more) &green Revenue (found 2, req. 2 or more) &green OpenSky (found 1, req. 1 or more) &green OpenMarket (found 1, req. 1 or more) &green XIAM (found 1, req. 1 or more) &green Zamano (found 2, req. 2 or more) &green Tango (found 0, req. none) &green Opera (found 0, req. none) &green BT (found 0, req. none) &yellow Modeva (found 0, req. 1 or more) &green Gemalto (found 2, req. none) &green Biogiorno (found 0, req. none) &green Phonovation (found 3, req. 2 or more) &green Phonovation1 (found 1, req. 1 or more) &green Conductor_acnsvr1 (found 7, req. 1 or more) &green Conductor_aaxsvr1 (found 8, req. 1 or more) Is there a way to tidy them up so that the individual coloured alerts can easily be discerned? Regards, Nick Pettefar

1 0

Graphs
by Neil.Simmonds＠express-gifts.co.uk 22 Oct '13

22 Oct '13

Hi all, I've got a test running which is collecting firewall connections for various web sites. I have values of "current connections" and "High Water Mark". These are both being successfully collected into an RRD database but I've got an issue with graphing. What I'd like to be able to do is have 2 graphs showing on the same page, 1 showing the "current connections" and 1 showing the "High Water Mark". I've successfully had them on the same graph but that gives me issues with the scale as it flattens the "current connections" graph too much. At the moment, the only way I can think of to get round this is to have the external script send the same data to 2 different columns so I can define the different graphs to the different columns but I'd really like to be able to do this on 1 page. Has anyone any idea of how I might do this? Regards, Neil Simmonds Senior Operations Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk<mailto:neil.simmonds at Express-Gifts.co.uk> Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

3 3