October 2013 - Xymon - Xymon mailman web

Untidy e-Mails
by Nick＠Pettefar.com 22 Oct '13

22 Oct '13

Hi, we have various alert e-mails which look something like this: yellow Tue Oct 22 17:05:54 IST 2013 - Ports NOT ok &green PUCA (found 2, req. 2 or more) &green ITouch (found 0, req. none) &green Ericsson (found 2, req. 2 or more) &green TMI (found 2, req. 2 or more) &green Revenue (found 2, req. 2 or more) &green OpenSky (found 1, req. 1 or more) &green OpenMarket (found 1, req. 1 or more) &green XIAM (found 1, req. 1 or more) &green Zamano (found 2, req. 2 or more) &green Tango (found 0, req. none) &green Opera (found 0, req. none) &green BT (found 0, req. none) &yellow Modeva (found 0, req. 1 or more) &green Gemalto (found 2, req. none) &green Biogiorno (found 0, req. none) &green Phonovation (found 3, req. 2 or more) &green Phonovation1 (found 1, req. 1 or more) &green Conductor_acnsvr1 (found 7, req. 1 or more) &green Conductor_aaxsvr1 (found 8, req. 1 or more) Is there a way to tidy them up so that the individual coloured alerts can easily be discerned? Regards, Nick Pettefar

1 0

Graphs
by Neil.Simmonds＠express-gifts.co.uk 22 Oct '13

22 Oct '13

Hi all, I've got a test running which is collecting firewall connections for various web sites. I have values of "current connections" and "High Water Mark". These are both being successfully collected into an RRD database but I've got an issue with graphing. What I'd like to be able to do is have 2 graphs showing on the same page, 1 showing the "current connections" and 1 showing the "High Water Mark". I've successfully had them on the same graph but that gives me issues with the scale as it flattens the "current connections" graph too much. At the moment, the only way I can think of to get round this is to have the external script send the same data to 2 different columns so I can define the different graphs to the different columns but I'd really like to be able to do this on 1 page. Has anyone any idea of how I might do this? Regards, Neil Simmonds Senior Operations Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk<mailto:neil.simmonds at Express-Gifts.co.uk> Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

3 3

not receiving alerts
by kspringer＠innovateteam.com 19 Oct '13

19 Oct '13

I'm not receiving alerts on red and yellow's. I set up my server a while ago and received many alerts during setup and even after. But about a week ago I stopped receiving the emails. They're not going to spam, and I am able to send emails via command line from the Xymon server with no trouble. I've looked in the logs and am not seeing anything. Xymon is running on an Ubuntu v13 box hosted on AWS. Ideas? Thank you. ------------------------------------------------ *Kris Springer* * *

3 2

[xymon] combostatus --quiet bug?
by david.gore＠verizon.com 15 Oct '13

15 Oct '13

Hi, It would appear that when you add the --quiet option to combostatus like such: [combostatus] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEEDS xymond CMD $XYMONHOME/bin/combostatus --quiet LOGFILE $XYMONSERVERLOGS/combostatus.log INTERVAL 5m It removes all the combostatus information from the alert page, to include all the colored status gifs and resultant lines of host.service? I was expecting it to just remove the Boolean expression at the top of the page under the timestamp? Perhaps I am not reading the man page correctly? --quiet Normally, the test status sent by combostatus includes information about the underlying test results used to determine the current value of the combined test. "--quiet" eliminates this information from the test status page. Running the latest version of Xymon 4.3.12 on RHEL 6.4. If you get something other than what I have described please let me know? Perhaps I am doing something wrong? ~David

1 0

Does maint-senders work as advertised?
by john.thurston＠alaska.gov 14 Oct '13

14 Oct '13

In xymond.8.html is written: > --maint-senders=IP[/MASK][,IP/MASK] > Controls which hosts may send maintenance commands to xymond. Maintenance commands are the "enable", "disable", "ack" and "notes" commands. Format of this option is as for the --status-senders option. It is strongly recommended that you use this to restrict access to these commands, so that monitoring of a host cannot be disabled by a rogue user - e.g. to hide a system compromise from the monitoring system. I am able to make '--status-senders' work as advertised, but I am unable to make '--maint-senders' work the way I think it should. The xmond segment of my tasks.cfg is: >CMD xymond --pidfile=$XYMONSERVERLOGS/xymond.pid \ > --restart=$XYMONTMP/xymond.chk --checkpoint-file=$XYMONTMP/xymond.chk --checkpoint-interval=600 \ > --log=$XYMONSERVERLOGS/xymond.log \ > --maint-senders=$XYMONSERVERIP \ > --no-download \ > --store-clientlogs=!msgs but I can still send disable-messages for an arbitrary hosts-test combination from an arbitrary windows machine with: BBWinCmd.exe xymon.example.com disable foo.example.com ssh 10 Text When I change the tasks.cfg to contain an arbitrary ip address (of a non-existent host): > --maint-senders=10.10.10.10 \ I am still able to send disable-messages from arbitrary machines. But, my log file then shows errors for attempts by the xymon server to handle alerts: > 2013-10-14 12:34:27 Refused message from 10.200.10.24: notify foo,example,com.ssh So I see --maint-senders being evaluated by the alert-handling process, but ignored by the client-listener. Does anyone else have --main-senders working correctly? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

1 0

Status not avalable
by Lucas.Wang＠ehealth-china.com 14 Oct '13

14 Oct '13

Hi, I am encountering this problem "Status not avalable" when I click on green icon like http,cpu etc. What's the issue please? I got error info in file cgierror.log: 2013-10-14 05:58:38 hobbit-nkview Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice Best regards, Lucas Wang Sr. Unix Administrator Xiamen IT Operations 24x7 Siteops Hotline: +86 13616020670 eHealth | 9F, Chuangxin Building, Software Park, Xiamen, Fujian, P.R. China 361005 (SP) T 650.210.3511 | M 189.0592.1566 | Lucas.Wang at ehealth-china.com<mailto:Henk.Wang at ehealth-china.com> | www.ehealth-china.com<http://www.ehealth-china.com/> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information or may otherwise be protected by law. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

http alert mail as octet-stream
by dirk.kastens＠uni-osnabrueck.de 12 Oct '13

12 Oct '13

Hi, I'm using xymon 4.3.11 on Scientific Linux 6.4 I discovered a weird phenomenon with the alert mails that xymon is sending. Most mails are coded as text/ascii by my postfix MTA. Only the mails about http alerts are sent base64 encoded, because the content is regarded as an octet-stream. I had no idea why this happened, because the mails look normal as being ascii code. But when I used a script to store the message, I found out, that all lines of the http message are terminated by a ctrl-m character: ------------------------------- BBALPHAMSG=myhost.xyz.de:http red [621842] red Fri Oct 11 09:43:45 2013: Not Found &red http://myhost.xyz.de/myurl - Not Found HTTP/1.1 404 Not Found^M Date: Fri, 11 Oct 2013 07:43:45 GMT^M Server: Apache/2.2.22 (Ubuntu)^M Vary: Accept-Encoding^M Content-Length: 308^M Connection: close^M Content-Type: text/html; charset=iso-8859-1^M Seconds: 0.00 -------------------------------- Where does this happen and how can I change the behaviour? Thanks, Dirk

2 1

Cannot load host configuration error
by kspringer＠innovateteam.com 12 Oct '13

12 Oct '13

My server got a reboot and the public IP got changed. Now whenever I click any colored dot on my Xymon homepage it gives me this error. Cannot load host configuration All the suggestions I've found say that Xymon may not actually be running. There are Start scripts in the /etc/rc#.d folders, and also I can manually start and restart it from the command line with no troubles. What's going on? I suspected a DNS issue but I left it overnight and it still has the same issue this morning. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

4 4

favicon location?
by kspringer＠innovateteam.com 12 Oct '13

12 Oct '13

I'd like to find out the html code to use inside an iframe so I can display the live favicon pulled from my xymon server. I want to add it onto another site I have that others can quickly glance at and see the color of Xymon without going there. This is useful for those who are not in the email alerts list. Does anyone have any suggestions about a simple little html code that pulls that data? Thank you. ------------------------------------------------ *Kris Springer* * *

2 1

override CLASS(LOG) for one host
by bakgat8＠hotmail.com 11 Oct '13

11 Oct '13

I have this and it is good CLASS=linux PROC ntpd PROC sshd 1 PROC cron FILE /var/log/messages red MODE=644 LOG /var/log/messages %panic|error|Critical LOAD 25.0 35.0 except for the splunk server on that ONE server I don't want above LOG to apply. How can I do that? Gonda

2 1