November 2013 - Xymon - Xymon mailman web

All Services not showing up in Services List
by MMulligan＠llbean.com 07 Nov '13

07 Nov '13

We are currently upgrading our Windows environment to the latest version of Symantec. For some reason when we upgrade a server or a test PC from Sep 11 to Sep 12 we are no longer able to monitor the service Symantec Endpoint Protection. The name of this service does change from Symantec_AntiVirus to SepMasterService and I have updated my services configuration to look for either but the problem is that the service is not listed within the client data being reported and therefore we cannot monitor it with Xymon. I could monitor the proc CCSvcHst.exe but there are several services that run as Symantec so I don't think that is an effective way to monitor that SEP12 is up and active as that proc may be up but the service may be down. I have seen some other posts on this topic but have not seen a good answer so far and am looking for a bit of help. For our production server we are running Xymon 4.3.7 and have BBWin 0.13 on the clients. Thanks, Mark Mulligan Associate Operations Engineer - Splunk and Xymon Admin

1 0

Quick question - delayred with named content columns?
by betsy.schwartz＠gmail.com 06 Nov '13

06 Nov '13

Suppose I am monitoring some URL's with named content columns like so 0.0.0.0 webservice1 # noconn cont=web; https://foo.example.com/servlet?status;200 cont=mobile; https://foo.example.com/servlet?status;200 If I want to add a delayred, is it delayred=http:5 or delayred=web:5,mobile:5 ?

3 4

Windows service monitoring
by Neil.Simmonds＠express-gifts.co.uk 04 Nov '13

04 Nov '13

Is there any possibility of getting the reporting of Windows service stares fixed. Looking at the svsc page on Xymon, BBWin is correctly reporting the current state of the agent in the [svcs] data but Xymon is (although correctly flagging it) reporting it incorrectly in the message. As can be seen below, the Startup Type is Automatic and the Status is Stopped but Xymon reports AdobeARMservice is started/automatic. This is causing us issues in that on-call personnel aren't always aware of this discrepancy and have left these alerts until morning assuming it's a Xymon issue. This is when running the BBWin agent in central mode so all the service checking is being done by Xymon, the agent is merely supplying the data to be checked. red AdobeARMservice is started/automatic - want started/Any Name StartupType Status DisplayName AdobeARMservice automatic stopped Adobe Acrobat Update Service AdobeFlashPlayerUpdateSvc manual stopped Adobe Flash Player Update Service AeLookupSvc manual started Application Experience ALG manual stopped Application Layer Gateway Service Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0

Is there a way to add eventlog to custom pages
by ozkrumpet＠gmail.com 04 Nov '13

04 Nov '13

Hi, I was wondering if there was a way to add an eventlog summary, similar to what is available at the bottom of the "non-green view" to one of the pages I have set up in Xymon. Essentially I want a summarised event log for a custom subset of the monitoring items. I have taken a quick look in the mail archive and couldn't find a similar request. Is such a thing possible? Alex

2 2

I just can't figure out a data channel feed
by scoile＠mcclatchyinteractive.com 03 Nov '13

03 Nov '13

I'm trying to write a data collector to deliver data to Xymon through the data channel. From my reading, it should be as simple as (from *xymoncmd*): $XYMON --merge $XYMSRV "data $MACHINE.mytest" <<EOD x:3 y:7 EOD But I can't find a corresponding *mytest.rrd* file on my server. I haven't found any documentation that indicates I need to prepare the server to receive the new data feed, nor that the collector must be run from *xymonlauncher*. I'd like to prove the script before I attempt to add it as a client task. Help? -- *Steve Coile *Senior Network and Systems Engineer, McClatchy Interactive<http://www.mcclatchyinteractive.com/> Office: 919-861-1247 | Mobile: 919-622-5369 | Fax: 919-861-1300

2 1

make install bug?
by scoile＠mcclatchyinteractive.com 03 Nov '13

03 Nov '13

Downloaded *xymon-4.3.12.tar.gz*, unpacked it, checked it in to SVN, *./configure*, *make*, *make install*, tried to check-in resulting installation, found copies of *.svn* directories from the source tree under the installed *server/www/help/manpages*. This strikes me as a bug, no? -- *Steve Coile*Senior Network and Systems Engineer, McClatchy Interactive<http://www.mcclatchyinteractive.com/> Office: 919-861-1247 | Mobile: 919-622-5369 | Fax: 919-861-1300

2 1

c-ares
by feld＠feld.me 01 Nov '13

01 Nov '13

On Fri, Nov 1, 2013, at 13:03, Japheth Cleaver wrote: > > > On Fri, November 1, 2013 10:35 am, Mark Felder wrote: > > Is there any hope of getting xymon to compile against the system > > provided c-ares, or is xymon always going to bundle it? Just seems like > > it would be more efficient to use the system-provided c-ares if it's > > there... > > The xymon build process ends up making a library which the various > binaries incorporate, and I don't think it's dynamic or would pull in the > live system version in this case. I know there's a make option to do a > dynamic lib, but IIRC it's experimental. > > That being said, with a few patches for CFLAGS/CPPFLAGS, xymon compiles > fine with the current version of c-ares... The Terabithia RPMs all use > 1.10.0, for example. > Thanks for the info. I was hoping to be able to change the build process for FreeBSD so it can pull in c-ares from the ports tree.

1 0

best way to check amazon ec2 instance's availability
by deepakdeore2004＠gmail.com 01 Nov '13

01 Nov '13

As ec2 instances by default doesn't respond icmp and I dont want to enable icmp and ssh access to xymon server, what could be the best way to check the instance's availability. Currently in my env i m doing following to check the availability: 1. Created server ext script which connects to bastion host and from there it checks the ssh connection to the server. ssh -n bastion_host "nc -w 5 -vz ec2_instance 22" 2>&1 if [ $? -eq 0 ]; then COLOR=green else COLOR=red fi 2. hosts.conf has "1.2.3.4 ec2_instance # noconn ext_script ...." It works well but it has single point of failure i.e. if bastion host has some problem then all the instances will start alerting. The other thing in my mind is use amazon api for checking server status. Anybody has any suggestion here?

3 3

LDAP Check causes xymonnet to hand
by vachon＠sessionm.com 01 Nov '13

01 Nov '13

Jeremy, It seems LDAP surely is the issue. The check has no settable timeout in hosts.cfg. As for what happens to our LOVELY OpenDirectory, it just hangs both SSL and plain text. All ports remain open, ping even still works. I caught it this time and it does seem that the lack of a timeout is the problem here (the check only terminated because we rebooted the box) > Error output: > WARNING: Runtime 521 longer than time limit (300) > > TIME SPENT > Event Start time > Duration > xymonnet startup 1383315414.744906 > - > Service definitions loaded 1383315414.746373 > 0.001467 > Tests loaded 1383315414.815137 > 0.068764 > DNS lookups completed 1383315414.815838 > 0.000701 > Test engine setup completed 1383315414.839164 > 0.023326 > TCP tests completed 1383315426.045943 > 11.206779 > PING test completed (104 hosts) 1383315434.035841 > 7.989898 > PING test results sent 1383315434.036641 > 0.000800 > Test result collection completed 1383315434.037506 > 0.000865 > LDAP test engine setup completed 1383315434.037568 > 0.000062 > LDAP tests executed 1383315935.053479 > 501.015911 > LDAP tests result collection completed 1383315935.053491 > 0.000012 > Test results transmitted 1383315935.055777 > 0.002286 > xymonnet completed 1383315935.062680 > 0.006903 > TIME TOTAL > 520.317774 In the host.cfg we have: $IP commander.example.com # ldap:// commander.example.com:389/dc=commander,dc=example,dc=com It is our only ldap check (its over a IPsec S2S link with 50/50 connection) Xymonnet is standard install "CMD xymonnet --report --ping --checkresponse", the proc only exits when we reboot the server or it passes normally. I couldn't get the command to just do the one server, will try again in a bit. I think the ultimate problem is ldap check never times out, so how can one be set? -- Thomas Vachon On Thu, Oct 31, 2013 at 12:31 AM, Jeremy Laidman <jlaidman at rebel-it.com.au>wrote: > Thomas > > In what way is the LDAP server in a "bad state"? > > Are you using LDAP or LDAPS? > > Can you connect to the server on the LDAP port using telnet? > > What does your hosts.cfg file entry look like? > > What parameters do you have for xymonnet in tasks.cfg? > > Does the xymonnet process eventually exit? > > Can you run xymonnet manually (as the xymon user, under a xymoncmd shell), > such as: > > $ xymonnet --debug --timeout=1 <name-of-server> > > If this fails in the same way, perhaps you can tweak some parameters, such > as adding "--dns=ip" or "--noping" or other options. > > J > > > > On 31 October 2013 00:01, Thomas Vachon <vachon at sessionm.com> wrote: > >> We are having issues with xymonnet handing on 4.3.12 (happened on 4.3.10 >> too). As soon as we added an ldap check which can hang (due to the ldap >> server being in a bad state), xymonnet hangs and goes purple on all remote >> checks. >> >> Nothing shows in the logs. Here is the historical xymonnet info from the >> last purple: >> >> Wed Oct 30 12:12:10 2013 >> >> >> xymonnet version 4.3.12 >> SSL library : OpenSSL 1.0.1e 11 Feb 2013 >> LDAP library: OpenLDAP 20431 >> >> Statistics: >> Hosts total : 70 >> Hosts with no tests : 1 >> Total test count : 183 >> Status messages : 183 >> Alert status msgs : 0 >> Transmissions : 3 >> >> DNS statistics: >> # hostnames resolved : 115 >> # succesful : 69 >> # failed : 0 >> # calls to dnsresolve : 182 >> >> TCP test statistics: >> # TCP tests total : 113 >> # HTTP tests : 45 >> # Simple TCP tests : 68 >> # Connection attempts : 113 >> # bytes written : 7192 >> # bytes read : 528667 >> >> >> TIME SPENT >> Event Start time >> Duration >> xymonnet startup 1383135130.081755 >> - >> Service definitions loaded 1383135130.089141 >> 0.007386 >> Tests loaded 1383135130.147247 >> 0.058106 >> DNS lookups completed 1383135130.147712 >> 0.000465 >> Test engine setup completed 1383135130.159468 >> 0.011756 >> TCP tests completed 1383135142.406914 >> 12.247446 >> PING test completed (69 hosts) 1383135149.073309 >> 6.666395 >> PING test results sent 1383135149.074005 >> 0.000696 >> Test result collection completed 1383135149.075192 >> 0.001187 >> LDAP test engine setup completed 1383135149.075263 >> 0.000071 >> LDAP tests executed 1383135151.403612 >> 2.328349 >> LDAP tests result collection completed 1383135151.403621 >> 0.000009 >> Test results transmitted 1383135151.405148 >> 0.001527 >> xymonnet completed 1383135151.407244 >> 0.002096 >> TIME TOTAL >> 21.325489 >> >> >> >> -- >> Thomas Vachon >> >> >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon >> >> >

1 0

Send apache /server-status page to server via client.
by jlaidman＠rebel-it.com.au 01 Nov '13

01 Nov '13

On 31 October 2013 18:10, deepak deore <deepakdeore2004 at gmail.com> wrote: > One problem coming is the graphs are coming 2 times under trends. However > they are getting updated, I tried : - > > 1. Remove apache.rrd, waited for some time and checked after the rrd is > generated, still 2 graphs for each stats i.e. apache utilizaition, aapche > workers, apache cpu utilization, apache requests/ Second. > You shouldn't need to delete the rrd file. > 2. Removed "|apache:apache|apache1|apache2|apache3" from hosts.cfg which > shows only one graph of apache utilizaition. > Is the first bar (ie "|") supposed to be a comma? Like so: ",apache:apache|apache1|apache2|apache3" I'm assuming this is in your TRENDS definiton for the host. I don't know what the default would be (when you don't specify), but I would have guessed it would be to only include the [apache] graph definition. To list more than one graph, you add ",apache:apache|apache1|apache2|apache3" as you described. So by removing that, I would expect the trends page to only show the one graph: [apache]. (And do so without having to delete the apache.rrd file.) You might want to change your TRENDS definition in hosts.cfg to include one fewer graphs, instead of removing the definition altogether, something like: ",apache:apache|apache1" Then reload the trends page and see if you only get two apache graphs. J

2 1