October 2013 - Xymon - Xymon mailman web

what words to monitor for in /var/log/messages?
by bakgat8＠hotmail.com 10 Oct '13

10 Oct '13

I have moved over the stuff (words) we look for on HP-UX. Mainly for hardware errors. But I don't have anything readily at hand for a Linux server. What sort of stuff should I look for? I found a post on line that said panic and error. Seems fair enough - so I stuffed those in. Bakkies

1 0

Question about "all non-green view" and edit critical systems
by ken.shackelford＠siemens.com 09 Oct '13

09 Oct '13

Hello, I was wondering if there was a way to control which systems were summarized in the "all non-green view" window. I'd like to use this as a sort of front end for our operations staff to monitor and don't need to have them calling about every little thing. Also, I can't seem to find the correct user/pass to use when trying to run the "edit critical systems" or "acknowledge alert" pages. I'm running on Red Hat ES 5.9 and using Firefox for my browser. Keeps saying the password is invalid. I've tried the "xymon" account, "root" and even added a password to the "apache" account, but no success. What is expected here? Thanks, Ken Ken Shackelford Information Technology Siemens Industry Sector Siemens Product Lifecycle Management Software Inc. 2000 Eastman Drive Milford, OH 45150 United States Tel. :+1 (513) 576-2556 Fax :+1 (513) 576-2998 Mobile :+1 (513) 253-5508 ken.shackelford at siemens.com <mailto:ken.shackelford at siemens.com> www.siemens.com/plm

4 3

can one delay alert during specific hours?
by bakgat8＠hotmail.com 09 Oct '13

09 Oct '13

Pardon me if this is answered somewhere. Occasionally we have servers that miss a ping at night - probably due to backups going over production network (there are a few). I want to not get emailed on the first bad ping - be really bad before you wake me up - say between midnight and 6am. But it is not DOWNTIME as in never tell me. Can I do this? Can I say delayed red between specific hours. For now I just delayed the whole thing. Thanks Bakkies

2 1

What is the default propagation behavior?
by john.thurston＠alaska.gov 08 Oct '13

08 Oct '13

My acknowledgment status does not seem to be propagating up the page levels (and I want it to). On the host's originating page, I see a yellow check box. But on the parent page, I still see a yellow ball. I'm trying to figure out if it _should_ be propagating and something is wrong, or it should _not_ be propagating and I need to figure out how to change the default behavior. This is a pre-production 4.3.12 so not very much has been changed from stock. -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 2

Anyone doing anything interesting with Xymon and Splunk?
by betsy.schwartz＠gmail.com 08 Oct '13

08 Oct '13

We're ramping up Splunk in a big way. thinking about how to build xymon alerts from Splunk events and also how to use xymon to monitor Splunk performance (in particular, picking up when server logs are not updating in a timely manner) Wondering if anyone here is further down that path

1 0

showgraph.cgi on Xymon 4.3.12
by novosirj＠ca.rutgers.edu 07 Oct '13

07 Oct '13

Hi all, I was hoping you might be able to help me with a problem with showgraph.cgi. It works, but lately it's been taking an inordinate amount of time to complete. I did a truss on the process when it runs, and it looks like what it's doing is opening an endless list of fonts: stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiBold.ttf", 0xFFBF6F28) = 0 open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiBold.ttf", O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, 0xFFBF6D60) = 0 mmap(0x00000000, 317896, PROT_READ, MAP_PRIVATE, 7, 0) = 0xFE170000 close(7) = 0 munmap(0xFE170000, 317896) = 0 stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiOblique.ttf", 0xFFBF6F28) = 0 open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiOblique.ttf", O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, 0xFFBF6D60) = 0 mmap(0x00000000, 91352, PROT_READ, MAP_PRIVATE, 7, 0) = 0xFE1A0000 close(7) = 0 munmap(0xFE1A0000, 91352) = 0 stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansOblique.ttf", 0xFFBF6F28) = 0 open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansOblique.ttf", O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, 0xFFBF6D60) = 0 mmap(0x00000000, 253724, PROT_READ, MAP_PRIVATE, 7, 0) = 0xFE180000 close(7) = 0 munmap(0xFE180000, 253724) = 0 stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansRegular.ttf", 0xFFBF6F28) = 0 open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansRegular.ttf", O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, 0xFFBF6D60) = 0 mmap(0x00000000, 486132, PROT_READ, MAP_PRIVATE, 7, 0) = 0xFE140000 close(7) = 0 munmap(0xFE140000, 486132) = 0 ...and so on. Any idea why this might have started happening and what I can do about it? The server OS is Solaris 10 (probably relatively recently upgraded from S10u10 to S10u11. The graph gets created immediately at the end of these font openings. -- ____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Sr. Systems Programmer || \\ and Health | novosirj at rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIT/EI-Academic Svcs. - ADMC 450, Newark `'

3 7

proc : multiple alerts?
by bakgat8＠hotmail.com 07 Oct '13

07 Oct '13

I want to have a system procs (cron ntpd) alert and a dba procs (weblogic blah blah) alert. Based on my current understanding this is not possible under 4.3 ? I can write code to do this - I just do not want to do unnecessary work! -- Bakkies

6 9

admin and oper status, for xymon icons
by andreas.kunberger＠ditf-denkendorf.de 07 Oct '13

07 Oct '13

Hi, I'd suggest for (admin=down) blue as the apropriate color. Regards Andreas Kunberger -- ZD/EDV Tel.: 258

1 0

Wildcard/regexes for hostnames in client-local.cfg
by mburger＠bubbanfriends.org 04 Oct '13

04 Oct '13

I've looked over the client-local.cfg man page, and don't see anything either allowing or disallowing this, so I figured I'd ask before trying it out. I have a group of servers where I'm going to be doing file presence monitoring (alarm if the file exists). These servers will have fairly similar names, so I'd like to be able use a regex in the hostname field ( [hostname] ) rather than have to create a separate entry for each server. Is this possible? Failing that, could I list the hostnames in one [...] similar to the alerts.cfg file? Thank you. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

2 2

Dynamic "normal" thresholds for CPU, disk, network, etc
by jlaidman＠rebel-it.com.au 03 Oct '13

03 Oct '13

(It's generally considered bad form to hijack a thread by changing topic mid-way. I'm posting my response with a new subject, so that the original thread can continue undiluted.) On 3 October 2013 09:48, Adam Goryachev <mailinglists at websitemanagers.com.au > wrote: > PS, not relevant to this entire discussion, but one thing I've been > battling with is trying to define a "normal" status. eg, I can set the CPU > load to 5, which normally means the status is always green, but one day the > cpu load might be 4 at 2pm, and that is abnormal, even though a load of 4 > at 2am is normal. Does anyone use/do anything to automatically watch the > current values, and learn what range is "normal" on this day/time? For me, > this especially applies to counters related to network performance, disk > performance, etc. RRDs can handle this using Holt-Winters aberrant behaviour detection. I set this up once on an MRTG system, but as yet have not tried to get it working for Xymon-derived RRD files. On my list of things to do. I think it's fairly easy to add the 6 extra consolidation functions (HWPREDICT, SEASONAL, etc) into the RRD file using rrdtune, or add them to the rrddefinitions.cfg file and recreate the RRD files. Then you just need to adjust the graph definitions to show the expected ranges. I think the tricky part is to specify the consolidation function parameters required to produce useful predications for "normal" based on the nature of the data being collected. The seminal paper (AFAIK) on this was written by Brutlag and presented at the Usenix "LISA 2000" sysadmin conference. It has example graphs and RRDtool definitions to do this, as well as a complete explanation (deeper than I can grok) of how it all works. https://www.usenix.org/legacy/events/lisa00/full_papers/brutlag/brutlag_htm… Also, people have described their adventures previously on The List. For example: http://lists.xymon.com/pipermail/xymon/2012-October/035810.html If you can get this going to your satisfaction, perhaps you could document what you did and share it with us. Cheers Jeremy

1 0