October 2013 - Xymon - Xymon mailman web

Can anyone confirm unexpected behavior of DISPLAYGROUP in alerts.cfg ?
by john.thurston＠alaska.gov 11 Oct '13

11 Oct '13

I see inconsistency between the documentation for the DISPLAYGROUP rule in alerts.cfg and the behavior of the rule. In the alerts.cfg.5.html on my server (Updated: Version 4.3.12: 24 Jul 2013) says: > DISPLAYGROUP=groupstring Rule matching an alert by the text of the display-group (text following the group, group-only, group-except heading) in the hosts.cfg file. "groupstring" is the text for the group, stripped of any HTML tags. > . . . . the database servers can be matched with DISPLAYGROUP="Production databases" The first inconsistency is there is no mention of this rule in the xymon-alerts.html file. That's understandable as the xymon-alerts.html is probably an older file. But since this rule offers me significant business advantage, I went ahead and gave it a shot. The real problem is that DISPLAYGROUP does not appear to handle spaces and double quotes as advertised. When I try to use the rule in my alert.cfg, my alert.log contains lines telling me of unknown tokens. From my hosts.cfg > page ETS ETS Enterprise > title Solaris Hosts > subparent ETS SolHostsAll All > group Solaris T3 Servers > 0.0.0.0 argon.example.com # client:argon !ftp From my alerts.cfg > DISPLAYGROUP="Solaris T3 Servers" > MAIL foo at alaska.gov REPEAT=1m SERVICE=ssh Results in alert.log > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'T3' at line 130 > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'Servers"' at line 130 If, however, I change the group name to be the single word "Solaris" (withoug quotes) and change the line in alerts.cfg to be: DISPLAYGROUP=Solaris then it works without complaint. It also works if I leave the original group name and change the line in alerts.cfg to use regex: DISPLAYGROUP=%Solaris[[:space:]]T3[[:space:]]Servers Can anyone confirm this behavior? It appears I can work around it with the regex, but it is going to make my alerts.cfg a lot more difficult to maintain and read. fwiw, I am running my xymon server on Solaris 10 SPARC. -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 2

win32 svcs monitoring
by feld＠feld.me 11 Oct '13

11 Oct '13

On Fri, Oct 11, 2013, at 8:36, Mark Felder wrote: > Sometimes windows svc monitoring does strange things like report that > there's an issue with a service when there really isn't. > > See attached image > > > Is this something that can be fixed on the xymon-server side? Is there a > parsing error? Wow, something strange happened to that pic. I won't pollute the list with another attachment. You can view it here: http://i.imgur.com/rGw6jWj.png

1 0

Anyone doing anything interesting with Xymon and Splunk?
by A.Chervonets＠cominder.eu 11 Oct '13

11 Oct '13

Not yet, but in few months we are going to investigate Splunk features and definitely integrate it with XyMon monitoring. So, we can merge efforts or at least share usefull information. Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/ mobile: +371 26517848 > > ---------------------------------------------------------------------- > Message: 1 > Date: Tue, 8 Oct 2013 09:27:42 -0400 > From: Betsy Schwartz <betsy.schwartz at gmail.com> > To: "xymon at xymon.com" <xymon at xymon.com> > Subject: [Xymon] Anyone doing anything interesting with Xymon and > Splunk? > Message-ID: > <CAAVLHR2XkFQnDcN9Fiqt9uf6qCFv4uFLakgjkLkmNPJy+r-+jw at mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > We're ramping up Splunk in a big way. thinking about how to build xymon > alerts from Splunk events and also how to use xymon to monitor Splunk > performance (in particular, picking up when server logs are not updating in > a timely manner) > > Wondering if anyone here is further down that path >

1 0

Content check question
by SKreien＠la-z-boy.com 11 Oct '13

11 Oct '13

Hey guys, I'm trying to build a content check to one of our internal servers. Here's what I've specified in the content check: cont=http-content;http://192.168.10.110 /Main/login.do\?userName=*****\&userPass=*****\&pcno=***;true I know the URL works, I can do it from the command line: [hobbit at retv6100 bb-hosts-includes]$ curl http://192.168.10.110/Main/login.do\?userName=*****\&userPass=*****\&pcno=*… And it returns: <loginResult loggedin='true' userloginid='1070002' pcid='****' address=******' session='ACAEB9D8C0C6D8D32824F977A1AEB2E3' /> But the test on Xymon returns "No output received from server". I'm stumped how it can be getting no output? Can anyone enlighten me? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Incorporated 1284 N. Telegraph Rd. | Monroe, MI 48162 | scot.kreienkamp at la-z-boy.com<mailto:scot.kreienkamp at la-z-boy.com> | www.la-z-boy.com<http://www.la-z-boy.com/> This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 3

can't fully clear conn history
by kspringer＠innovateteam.com 10 Oct '13

10 Oct '13

Hi, I've got a list of websites that we host that I put in a nice 'group-compress' list in my hosts file. I have 'noconn' set for each one so xymon doesn't show any ping results on the display page. On one of my sites I had 'noping' set instead of 'noconn' and now it shows a single icon in the 'conn' column that I want to make go away. I've gone in and manually removed all the 'hist', 'histlogs', and 'rrd' data for that site but the lonely icon is still there and won't go away. What am I missing? My goal is to not have a 'conn' column for the sites in that list. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

3 2

what words to monitor for in /var/log/messages?
by bakgat8＠hotmail.com 10 Oct '13

10 Oct '13

I have moved over the stuff (words) we look for on HP-UX. Mainly for hardware errors. But I don't have anything readily at hand for a Linux server. What sort of stuff should I look for? I found a post on line that said panic and error. Seems fair enough - so I stuffed those in. Bakkies

1 0

Question about "all non-green view" and edit critical systems
by ken.shackelford＠siemens.com 09 Oct '13

09 Oct '13

Hello, I was wondering if there was a way to control which systems were summarized in the "all non-green view" window. I'd like to use this as a sort of front end for our operations staff to monitor and don't need to have them calling about every little thing. Also, I can't seem to find the correct user/pass to use when trying to run the "edit critical systems" or "acknowledge alert" pages. I'm running on Red Hat ES 5.9 and using Firefox for my browser. Keeps saying the password is invalid. I've tried the "xymon" account, "root" and even added a password to the "apache" account, but no success. What is expected here? Thanks, Ken Ken Shackelford Information Technology Siemens Industry Sector Siemens Product Lifecycle Management Software Inc. 2000 Eastman Drive Milford, OH 45150 United States Tel. :+1 (513) 576-2556 Fax :+1 (513) 576-2998 Mobile :+1 (513) 253-5508 ken.shackelford at siemens.com <mailto:ken.shackelford at siemens.com> www.siemens.com/plm

4 3

can one delay alert during specific hours?
by bakgat8＠hotmail.com 09 Oct '13

09 Oct '13

Pardon me if this is answered somewhere. Occasionally we have servers that miss a ping at night - probably due to backups going over production network (there are a few). I want to not get emailed on the first bad ping - be really bad before you wake me up - say between midnight and 6am. But it is not DOWNTIME as in never tell me. Can I do this? Can I say delayed red between specific hours. For now I just delayed the whole thing. Thanks Bakkies

2 1

What is the default propagation behavior?
by john.thurston＠alaska.gov 08 Oct '13

08 Oct '13

>> John Thurston asked: >> My acknowledgment status does not seem to be propagating up the page levels (and I want it to). On the host's originating page, I see a yellow check box. But on the parent page, I still see a yellow ball. I'm trying to figure out if it _should_ be propagating and something is wrong, or it should _not_ be propagating and I need to figure out how to change the default behavior. >> >> This is a pre-production 4.3.12 so not very much has been changed from stock. > On 10/8/2013 10:58 AM, Root, Paul T wrote: > The check has never propagated up for me. I don't know if that's changeable. I think it would be nice as well, at least at first glance. I now see that the checkbox propagates to nongreen.html but not to any of the host's parent pages. Maybe this is by design? Maybe I've misunderstood the meaning of NOPROPACK? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

1 0

What is the default propagation behavior?
by john.thurston＠alaska.gov 08 Oct '13

08 Oct '13

My acknowledgment status does not seem to be propagating up the page levels (and I want it to). On the host's originating page, I see a yellow check box. But on the parent page, I still see a yellow ball. I'm trying to figure out if it _should_ be propagating and something is wrong, or it should _not_ be propagating and I need to figure out how to change the default behavior. This is a pre-production 4.3.12 so not very much has been changed from stock. -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 1