October 2013 - Xymon - Xymon mailman web

[xymon] combostatus --quiet bug?
by david.gore＠verizon.com 15 Oct '13

15 Oct '13

Hi, It would appear that when you add the --quiet option to combostatus like such: [combostatus] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEEDS xymond CMD $XYMONHOME/bin/combostatus --quiet LOGFILE $XYMONSERVERLOGS/combostatus.log INTERVAL 5m It removes all the combostatus information from the alert page, to include all the colored status gifs and resultant lines of host.service? I was expecting it to just remove the Boolean expression at the top of the page under the timestamp? Perhaps I am not reading the man page correctly? --quiet Normally, the test status sent by combostatus includes information about the underlying test results used to determine the current value of the combined test. "--quiet" eliminates this information from the test status page. Running the latest version of Xymon 4.3.12 on RHEL 6.4. If you get something other than what I have described please let me know? Perhaps I am doing something wrong? ~David

1 0

Does maint-senders work as advertised?
by john.thurston＠alaska.gov 14 Oct '13

14 Oct '13

In xymond.8.html is written: > --maint-senders=IP[/MASK][,IP/MASK] > Controls which hosts may send maintenance commands to xymond. Maintenance commands are the "enable", "disable", "ack" and "notes" commands. Format of this option is as for the --status-senders option. It is strongly recommended that you use this to restrict access to these commands, so that monitoring of a host cannot be disabled by a rogue user - e.g. to hide a system compromise from the monitoring system. I am able to make '--status-senders' work as advertised, but I am unable to make '--maint-senders' work the way I think it should. The xmond segment of my tasks.cfg is: >CMD xymond --pidfile=$XYMONSERVERLOGS/xymond.pid \ > --restart=$XYMONTMP/xymond.chk --checkpoint-file=$XYMONTMP/xymond.chk --checkpoint-interval=600 \ > --log=$XYMONSERVERLOGS/xymond.log \ > --maint-senders=$XYMONSERVERIP \ > --no-download \ > --store-clientlogs=!msgs but I can still send disable-messages for an arbitrary hosts-test combination from an arbitrary windows machine with: BBWinCmd.exe xymon.example.com disable foo.example.com ssh 10 Text When I change the tasks.cfg to contain an arbitrary ip address (of a non-existent host): > --maint-senders=10.10.10.10 \ I am still able to send disable-messages from arbitrary machines. But, my log file then shows errors for attempts by the xymon server to handle alerts: > 2013-10-14 12:34:27 Refused message from 10.200.10.24: notify foo,example,com.ssh So I see --maint-senders being evaluated by the alert-handling process, but ignored by the client-listener. Does anyone else have --main-senders working correctly? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

1 0

Status not avalable
by Lucas.Wang＠ehealth-china.com 14 Oct '13

14 Oct '13

Hi, I am encountering this problem "Status not avalable" when I click on green icon like http,cpu etc. What's the issue please? I got error info in file cgierror.log: 2013-10-14 05:58:38 hobbit-nkview Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice Best regards, Lucas Wang Sr. Unix Administrator Xiamen IT Operations 24x7 Siteops Hotline: +86 13616020670 eHealth | 9F, Chuangxin Building, Software Park, Xiamen, Fujian, P.R. China 361005 (SP) T 650.210.3511 | M 189.0592.1566 | Lucas.Wang at ehealth-china.com<mailto:Henk.Wang at ehealth-china.com> | www.ehealth-china.com<http://www.ehealth-china.com/> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information or may otherwise be protected by law. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

http alert mail as octet-stream
by dirk.kastens＠uni-osnabrueck.de 12 Oct '13

12 Oct '13

Hi, I'm using xymon 4.3.11 on Scientific Linux 6.4 I discovered a weird phenomenon with the alert mails that xymon is sending. Most mails are coded as text/ascii by my postfix MTA. Only the mails about http alerts are sent base64 encoded, because the content is regarded as an octet-stream. I had no idea why this happened, because the mails look normal as being ascii code. But when I used a script to store the message, I found out, that all lines of the http message are terminated by a ctrl-m character: ------------------------------- BBALPHAMSG=myhost.xyz.de:http red [621842] red Fri Oct 11 09:43:45 2013: Not Found &red http://myhost.xyz.de/myurl - Not Found HTTP/1.1 404 Not Found^M Date: Fri, 11 Oct 2013 07:43:45 GMT^M Server: Apache/2.2.22 (Ubuntu)^M Vary: Accept-Encoding^M Content-Length: 308^M Connection: close^M Content-Type: text/html; charset=iso-8859-1^M Seconds: 0.00 -------------------------------- Where does this happen and how can I change the behaviour? Thanks, Dirk

2 1

Cannot load host configuration error
by kspringer＠innovateteam.com 12 Oct '13

12 Oct '13

My server got a reboot and the public IP got changed. Now whenever I click any colored dot on my Xymon homepage it gives me this error. Cannot load host configuration All the suggestions I've found say that Xymon may not actually be running. There are Start scripts in the /etc/rc#.d folders, and also I can manually start and restart it from the command line with no troubles. What's going on? I suspected a DNS issue but I left it overnight and it still has the same issue this morning. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

4 4

override CLASS(LOG) for one host
by bakgat8＠hotmail.com 11 Oct '13

11 Oct '13

I have this and it is good CLASS=linux PROC ntpd PROC sshd 1 PROC cron FILE /var/log/messages red MODE=644 LOG /var/log/messages %panic|error|Critical LOAD 25.0 35.0 except for the splunk server on that ONE server I don't want above LOG to apply. How can I do that? Gonda

2 1

Can anyone confirm unexpected behavior of DISPLAYGROUP in alerts.cfg ?
by john.thurston＠alaska.gov 11 Oct '13

11 Oct '13

I see inconsistency between the documentation for the DISPLAYGROUP rule in alerts.cfg and the behavior of the rule. In the alerts.cfg.5.html on my server (Updated: Version 4.3.12: 24 Jul 2013) says: > DISPLAYGROUP=groupstring Rule matching an alert by the text of the display-group (text following the group, group-only, group-except heading) in the hosts.cfg file. "groupstring" is the text for the group, stripped of any HTML tags. > . . . . the database servers can be matched with DISPLAYGROUP="Production databases" The first inconsistency is there is no mention of this rule in the xymon-alerts.html file. That's understandable as the xymon-alerts.html is probably an older file. But since this rule offers me significant business advantage, I went ahead and gave it a shot. The real problem is that DISPLAYGROUP does not appear to handle spaces and double quotes as advertised. When I try to use the rule in my alert.cfg, my alert.log contains lines telling me of unknown tokens. From my hosts.cfg > page ETS ETS Enterprise > title Solaris Hosts > subparent ETS SolHostsAll All > group Solaris T3 Servers > 0.0.0.0 argon.example.com # client:argon !ftp From my alerts.cfg > DISPLAYGROUP="Solaris T3 Servers" > MAIL foo at alaska.gov REPEAT=1m SERVICE=ssh Results in alert.log > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'T3' at line 130 > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'Servers"' at line 130 If, however, I change the group name to be the single word "Solaris" (withoug quotes) and change the line in alerts.cfg to be: DISPLAYGROUP=Solaris then it works without complaint. It also works if I leave the original group name and change the line in alerts.cfg to use regex: DISPLAYGROUP=%Solaris[[:space:]]T3[[:space:]]Servers Can anyone confirm this behavior? It appears I can work around it with the regex, but it is going to make my alerts.cfg a lot more difficult to maintain and read. fwiw, I am running my xymon server on Solaris 10 SPARC. -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 2

Anyone doing anything interesting with Xymon and Splunk?
by A.Chervonets＠cominder.eu 11 Oct '13

11 Oct '13

Not yet, but in few months we are going to investigate Splunk features and definitely integrate it with XyMon monitoring. So, we can merge efforts or at least share usefull information. Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/ mobile: +371 26517848 > > ---------------------------------------------------------------------- > Message: 1 > Date: Tue, 8 Oct 2013 09:27:42 -0400 > From: Betsy Schwartz <betsy.schwartz at gmail.com> > To: "xymon at xymon.com" <xymon at xymon.com> > Subject: [Xymon] Anyone doing anything interesting with Xymon and > Splunk? > Message-ID: > <CAAVLHR2XkFQnDcN9Fiqt9uf6qCFv4uFLakgjkLkmNPJy+r-+jw at mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > We're ramping up Splunk in a big way. thinking about how to build xymon > alerts from Splunk events and also how to use xymon to monitor Splunk > performance (in particular, picking up when server logs are not updating in > a timely manner) > > Wondering if anyone here is further down that path >

1 0

Content check question
by SKreien＠la-z-boy.com 11 Oct '13

11 Oct '13

Hey guys, I'm trying to build a content check to one of our internal servers. Here's what I've specified in the content check: cont=http-content;http://192.168.10.110 /Main/login.do\?userName=*****\&userPass=*****\&pcno=***;true I know the URL works, I can do it from the command line: [hobbit at retv6100 bb-hosts-includes]$ curl http://192.168.10.110/Main/login.do\?userName=*****\&userPass=*****\&pcno=*… And it returns: <loginResult loggedin='true' userloginid='1070002' pcid='****' address=******' session='ACAEB9D8C0C6D8D32824F977A1AEB2E3' /> But the test on Xymon returns "No output received from server". I'm stumped how it can be getting no output? Can anyone enlighten me? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Incorporated 1284 N. Telegraph Rd. | Monroe, MI 48162 | scot.kreienkamp at la-z-boy.com<mailto:scot.kreienkamp at la-z-boy.com> | www.la-z-boy.com<http://www.la-z-boy.com/> This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 3

can't fully clear conn history
by kspringer＠innovateteam.com 10 Oct '13

10 Oct '13

Hi, I've got a list of websites that we host that I put in a nice 'group-compress' list in my hosts file. I have 'noconn' set for each one so xymon doesn't show any ping results on the display page. On one of my sites I had 'noping' set instead of 'noconn' and now it shows a single icon in the 'conn' column that I want to make go away. I've gone in and manually removed all the 'hist', 'histlogs', and 'rrd' data for that site but the lonely icon is still there and won't go away. What am I missing? My goal is to not have a 'conn' column for the sites in that list. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

3 2