October 2013 - Xymon - Xymon mailman web

Anyone doing anything interesting with Xymon and Splunk?
by betsy.schwartz＠gmail.com 08 Oct '13

08 Oct '13

We're ramping up Splunk in a big way. thinking about how to build xymon alerts from Splunk events and also how to use xymon to monitor Splunk performance (in particular, picking up when server logs are not updating in a timely manner) Wondering if anyone here is further down that path

1 0

showgraph.cgi on Xymon 4.3.12
by novosirj＠ca.rutgers.edu 07 Oct '13

07 Oct '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Any ideas? Sorry to repost, but there was nothing but silence the first time. On 09/30/2013 04:04 PM, Novosielski, Ryan wrote: > Hi all, > > I was hoping you might be able to help me with a problem with > showgraph.cgi. It works, but lately it's been taking an inordinate > amount of time to complete. I did a truss on the process when it > runs, and it looks like what it's doing is opening an endless list > of fonts: > > stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiBold.ttf", > 0xFFBF6F28) = 0 > open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiBold.ttf", > O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, > 0xFFBF6D60) = 0 mmap(0x00000000, 317896, PROT_READ, MAP_PRIVATE, > 7, 0) = 0xFE170000 close(7) = 0 munmap(0xFE170000, 317896) = > 0 > stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiOblique.ttf", > 0xFFBF6F28) = 0 > open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansDemiOblique.ttf", > O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, > 0xFFBF6D60) = 0 mmap(0x00000000, 91352, PROT_READ, MAP_PRIVATE, > 7, 0) = 0xFE1A0000 close(7) = 0 munmap(0xFE1A0000, 91352) = > 0 stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansOblique.ttf", > 0xFFBF6F28) = 0 > open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansOblique.ttf", > O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, > 0xFFBF6D60) = 0 mmap(0x00000000, 253724, PROT_READ, MAP_PRIVATE, > 7, 0) = 0xFE180000 close(7) = 0 munmap(0xFE180000, 253724) = > 0 stat("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansRegular.ttf", > 0xFFBF6F28) = 0 > open("/usr/openwin/lib/X11/fonts/TrueType/LucidaSansRegular.ttf", > O_RDONLY) = 7 fcntl(7, F_SETFD, 0x00000001) = 0 fstat(7, > 0xFFBF6D60) = 0 mmap(0x00000000, 486132, PROT_READ, MAP_PRIVATE, > 7, 0) = 0xFE140000 close(7) = 0 munmap(0xFE140000, 486132) = > 0 > > ...and so on. Any idea why this might have started happening and > what I can do about it? The server OS is Solaris 10 (probably > relatively recently upgraded from S10u10 to S10u11. The graph gets > created immediately at the end of these font openings. - -- ____*Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Sr. Systems Programmer || \\ and Health | novosirj at rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIT/EI-Academic Svcs. - ADMC 450, Newark `' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJO5dkACgkQmb+gadEcsb4oYwCffRXJN/fAOGTfP7scvKW7KBMW /xUAoNAE6PilW4JYVVoIv5yKh8OrUE+W =M4Fl -----END PGP SIGNATURE-----

3 6

proc : multiple alerts?
by bakgat8＠hotmail.com 07 Oct '13

07 Oct '13

I want to have a system procs (cron ntpd) alert and a dba procs (weblogic blah blah) alert. Based on my current understanding this is not possible under 4.3 ? I can write code to do this - I just do not want to do unnecessary work! -- Bakkies

6 9

<something> in log file on web
by a_s_y＠sama.ru 07 Oct '13

07 Oct '13

Hello. Can I escape "<>" in log messages ? For example I setup to analize /var/log/maillog for "Over quota" message. Displayed string is: Oct 7 15:28:22 sendmail[4183]: r974LtLZ002344: to=, delay=07:06:27, xdelay=00:00:00, mailer=cyrusv2, pri=2116609, relay=localhost, dsn=4.2.2, stat=Deferred: 452 4.2.2 Over quota E-Mail is missing but it should be in "to=<somemail at mydom.tld>,". -- Regards, Sergey

1 0

admin and oper status, for xymon icons
by andreas.kunberger＠ditf-denkendorf.de 07 Oct '13

07 Oct '13

Hi, I'd suggest for (admin=down) blue as the apropriate color. Regards Andreas Kunberger -- ZD/EDV Tel.: 258

1 0

Wildcard/regexes for hostnames in client-local.cfg
by mburger＠bubbanfriends.org 04 Oct '13

04 Oct '13

I've looked over the client-local.cfg man page, and don't see anything either allowing or disallowing this, so I figured I'd ask before trying it out. I have a group of servers where I'm going to be doing file presence monitoring (alarm if the file exists). These servers will have fairly similar names, so I'd like to be able use a regex in the hostname field ( [hostname] ) rather than have to create a separate entry for each server. Is this possible? Failing that, could I list the hostnames in one [...] similar to the alerts.cfg file? Thank you. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

2 2

Dynamic "normal" thresholds for CPU, disk, network, etc
by jlaidman＠rebel-it.com.au 03 Oct '13

03 Oct '13

(It's generally considered bad form to hijack a thread by changing topic mid-way. I'm posting my response with a new subject, so that the original thread can continue undiluted.) On 3 October 2013 09:48, Adam Goryachev <mailinglists at websitemanagers.com.au > wrote: > PS, not relevant to this entire discussion, but one thing I've been > battling with is trying to define a "normal" status. eg, I can set the CPU > load to 5, which normally means the status is always green, but one day the > cpu load might be 4 at 2pm, and that is abnormal, even though a load of 4 > at 2am is normal. Does anyone use/do anything to automatically watch the > current values, and learn what range is "normal" on this day/time? For me, > this especially applies to counters related to network performance, disk > performance, etc. RRDs can handle this using Holt-Winters aberrant behaviour detection. I set this up once on an MRTG system, but as yet have not tried to get it working for Xymon-derived RRD files. On my list of things to do. I think it's fairly easy to add the 6 extra consolidation functions (HWPREDICT, SEASONAL, etc) into the RRD file using rrdtune, or add them to the rrddefinitions.cfg file and recreate the RRD files. Then you just need to adjust the graph definitions to show the expected ranges. I think the tricky part is to specify the consolidation function parameters required to produce useful predications for "normal" based on the nature of the data being collected. The seminal paper (AFAIK) on this was written by Brutlag and presented at the Usenix "LISA 2000" sysadmin conference. It has example graphs and RRDtool definitions to do this, as well as a complete explanation (deeper than I can grok) of how it all works. https://www.usenix.org/legacy/events/lisa00/full_papers/brutlag/brutlag_htm… Also, people have described their adventures previously on The List. For example: http://lists.xymon.com/pipermail/xymon/2012-October/035810.html If you can get this going to your satisfaction, perhaps you could document what you did and share it with us. Cheers Jeremy

1 0

admin and oper status, for xymon icons
by blevin＠seven.com 02 Oct '13

02 Oct '13

hi Adam, You covered the cases where admin and oper are equal or not equal and those make sense. Suppose that a service is shut down (admin=down). In that case, I won't even poll for any other variables in that mib-group and I won't poll for the oper-status of that object, either. This is not an error, its what the manager wanted (that thing being administratively shut down). Given that it was shut down on purpose, green is not right for this icon, red is not right, yellow is not right. I have choices of blue (not quite right) or clear/white color. Maybe that's the best we can do. So, its not just if admin!=oper; but you check admin first and if admin is up, you continue testing for oper. If admin is down, it would not make sense to check further (I guess its possible that you shut something down and yet its still running, but given that our devices are snmp-based, when we send an admin=down request, we can be pretty sure that oper will also follow. At least in the case of our devices. I'm curious if others have done anything to show the dual status, in some way? Not sure I'd want to do this - but it could be possible to patch xymon and show half circles, with admin color on the left side and oper color on the right ;) Maybe that's too strange? From: Adam Goryachev [mailinglists at websitemanagers.com.au] Sent: Wednesday, October 02, 2013 3:56 PM To: Bryan Levin Subject: Re: [Xymon] admin and oper status, for xymon icons On 03/10/13 04:17, Bryan Levin wrote: In snmp (I realize xymon is not native snmp-based) there is a common concept of admin status and oper status. Briefly, admin status is what the manager set for an object and oper status is its current status. The classic example is Ethernet where the manager can ifconfig an interface down or up (that would be the admin status) while the current link status would be oper. I’m having trouble mapping this set of status values to the single color that xymon allows. At first, I was marking some objects (manually, via my own snmp-based poller) as blue if the object was a ‘controlled down’ and red if it was supposed to be up but its current status was down. However, I’m not sure this is the best way to do this. I’m considering using ‘clear’ as the color for unknown or unpolled or not-yet-polled values but also for controlled-down objects. Using red for ‘admin==up, oper==down’ seems to be a good use of red in xymon. And blue is an ‘on-hold’ status where you have turned off polling or you want to ignore a certain object and not have its value change (also not have it appear in the ‘non-greens’ display). But if an object is blue, I will never change it to non-blue until the mgmt interface (in xymon or via messages sent to xymon server) specifically take that object off the on-hold list. Has there been any thought to evolving the xymon color and status concepts to include the duality of admin and oper? It seems that trying to compress the 2 states into one is problematic and not very clean in architecture. I’m curious what people have done in this regard. I can't say I've done anything with those SNMP values in xymon, but I think you are trying to do something like this: Admin Oper Xymon Up Up Green Up Down Red Down Up Red Down Down Green At least, that's the way I'd map it, if Admin == Oper, then everything is good (green), if Admin != Oper, then it's very bad (red). It's very similar to the service monitoring in xymon, if you specify a service should be up, and it is down, you get a red. Equally, if you specify a service should not be running (eg telnet), and it is running, then you get a red. Hope that helps. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au<http://www.websitemanagers.com.au>

2 1

admin and oper status, for xymon icons
by blevin＠seven.com 02 Oct '13

02 Oct '13

In snmp (I realize xymon is not native snmp-based) there is a common concept of admin status and oper status. Briefly, admin status is what the manager set for an object and oper status is its current status. The classic example is Ethernet where the manager can ifconfig an interface down or up (that would be the admin status) while the current link status would be oper. I'm having trouble mapping this set of status values to the single color that xymon allows. At first, I was marking some objects (manually, via my own snmp-based poller) as blue if the object was a 'controlled down' and red if it was supposed to be up but its current status was down. However, I'm not sure this is the best way to do this. I'm considering using 'clear' as the color for unknown or unpolled or not-yet-polled values but also for controlled-down objects. Using red for 'admin==up, oper==down' seems to be a good use of red in xymon. And blue is an 'on-hold' status where you have turned off polling or you want to ignore a certain object and not have its value change (also not have it appear in the 'non-greens' display). But if an object is blue, I will never change it to non-blue until the mgmt interface (in xymon or via messages sent to xymon server) specifically take that object off the on-hold list. Has there been any thought to evolving the xymon color and status concepts to include the duality of admin and oper? It seems that trying to compress the 2 states into one is problematic and not very clean in architecture. I'm curious what people have done in this regard.

1 0

How do you handle simultaneous disk-alerts from the same host?
by Carl.Melgaard＠STAB.RM.DK 02 Oct '13

02 Oct '13

Hi, How do you guys handle multiple disk-alerts - for example 2 simultaneous C and D-drive critical alerts on the same host? AFAIK when the C-drive reaches critical level, the "disk"-column turns red, alerts get sent etc. But when the D-drive also reaches a critical level, the "disk"-column is already red, thus its not a status-change and alerts wont get sent. How do you guys handle this situation? Regards, Carl Melgaard

2 3