February 2013 - Xymon - Xymon mailman web

Strange Client Behavior
by denicoloj＠gmail.com 06 Feb '13

06 Feb '13

Running the client with the --hostname= parameter worked like a charm. Thanks a lot! * * *Joseph De Nicolo* *Secure Database Administrator * *Center for Complex Network Research <http://www.barabasilab.com>* *Northeastern University* On Wed, Feb 6, 2013 at 11:31 AM, Joseph De Nicolo <denicoloj at gmail.com>wrote: > Yes "hostname" is in the ghosts clients page, but so is the other server > that I changed the name of and that one is fine. > > * * > *Joseph De Nicolo* > *Secure Database Administrator > * > *Center for Complex Network Research <http://www.barabasilab.com>* > *Northeastern University* > > > On Wed, Feb 6, 2013 at 11:02 AM, Carl Inglis <Carl.Inglis at rakon.com>wrote: > >> Have you checked your Ghost Clients page? **** >> >> ** ** >> >> If the hostname doesn’t match between what the server’s expecting and >> what the client’s sending, then the reports will land on the Ghost Clients >> page.**** >> >> ** ** >> >> Hope that helps.**** >> >> >> Carl**** >> >> ** ** >> >> Carl Inglis * >> Systems Administrator* >> >> *Rakon UK Limited* >> Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom >> Tel: +44 (0)1522 812630 | Fax:+44 (0) 1522 812664 | Mob: +44 (0) 7786 >> 552915 >> Carl.Inglis at rakon.com | www.rakon.com >> >> [image: The Queens Awards for Enterprise 2012] >> >> [image: Rakon Logo] >> >> We are an organisation committed to working towards accreditation for the >> Investors in People Standard. >> >> This message together with any attachments contains confidential >> information and may be >> subject to privilege. If you are not the intended recipient you may not >> distribute it in any >> way, you must notify the sender immediately and delete any copies of the >> message along >> with its attachments. >> >> *Rakon UK Ltd is a limited company registered in England and Wales. >> Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS >> Company Registration Number: 5128090. >> >> Please be aware that Rakon UK Limited may monitor email traffic data >> including the date, time, subject line, sender and recipients for the >> purposes of security and usage monitoring. Automated monitoring >> systems may also be applied to ascertain whether incoming/outgoing >> emails are likely to contain viruses, other destructive devices or >> inappropriate content. * >> >> *From:* xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] *On >> Behalf Of *Joseph De Nicolo >> *Sent:* 06 February 2013 15:45 >> *To:* xymon at xymon.com >> *Subject:* [Xymon] Strange Client Behavior**** >> >> ** ** >> >> Xymon users, >> >> >> Once upon a time I had a xymon client called "hostname". In all the xymon >> server config files(hosts.cfg, analysis.cfg, alerts.cfg) the client was >> written as "hostname" in the configs when setting its properties and >> behavior(alerts, warnings, ect..). Now I wish to change the way "hostname" >> appears on the xymon webpage to "hostname.example.org". >> >> Bear in mind this "hostname" has a xymon client install so I can receive >> all standard and custom reports & scripts. After changing all the server >> config files, keeping them constant but now replaced every instance of >> "hostname" to "hostname.example.org" the reports are not showing up on >> the webpage. I can still see icons and reports for conn, ssh, http, info.. >> but NOT the ones that are required by a client install(disk, cpu, memory, >> procs, ports, etc...) all those reports disappeared after the name change. >> >> XYmon server and client service restarts didn't help. I also hard >> rebooted the xymon server and that didn't help either. If I were to change " >> hostname.example.org" back to "hostname", all the reports and tests will >> show up again! I'm confused because I changed the names of another server >> and it was fine. So am I missing something stupid? Anybody have any ideas >> or experience this before? >> >> Appreciate all the responses, Thanks, >> * ***** >> >> *Joseph De Nicolo***** >> >> *Secure Database Administrator***** >> >> *Center for Complex Network Research <http://www.barabasilab.com>***** >> >> *Northeastern University***** >> >> **** >> > >

1 0

Strange Client Behavior
by denicoloj＠gmail.com 06 Feb '13

06 Feb '13

Xymon users, Once upon a time I had a xymon client called "hostname". In all the xymon server config files(hosts.cfg, analysis.cfg, alerts.cfg) the client was written as "hostname" in the configs when setting its properties and behavior(alerts, warnings, ect..). Now I wish to change the way "hostname" appears on the xymon webpage to "hostname.example.org". Bear in mind this "hostname" has a xymon client install so I can receive all standard and custom reports & scripts. After changing all the server config files, keeping them constant but now replaced every instance of "hostname" to "hostname.example.org" the reports are not showing up on the webpage. I can still see icons and reports for conn, ssh, http, info.. but NOT the ones that are required by a client install(disk, cpu, memory, procs, ports, etc...) all those reports disappeared after the name change. XYmon server and client service restarts didn't help. I also hard rebooted the xymon server and that didn't help either. If I were to change " hostname.example.org" back to "hostname", all the reports and tests will show up again! I'm confused because I changed the names of another server and it was fine. So am I missing something stupid? Anybody have any ideas or experience this before? Appreciate all the responses, Thanks, * * *Joseph De Nicolo* *Secure Database Administrator * *Center for Complex Network Research <http://www.barabasilab.com>* *Northeastern University*

4 4

Remove Column/Test
by mburger＠bubbanfriends.org 06 Feb '13

06 Feb '13

The hosts.cfg file: xxx.xxx.xxx.xxx hostname # disk,files,http,cpu,memory,msgs,procs http://wiki.fhmc.local/ NOCOLUMNS:inode,ports Note that in this case, I've removed "ports" from the list of tests, and added "ports" to the "NOCOLUMNS" field, along with inode. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1 > In which file? > > Do you have an example please? > > Regards, > > Nick Pettefar > > > On 5 February 2013 17:17, Mike Burger <mburger at bubbanfriends.org> wrote: >> You can place it at the end of your HOST line. >> -- >> Mike Burger >> http://www.bubbanfriends.org >> >> "It's always suicide-mission this, save-the-planet that. No one ever >> just >> stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1 >> >> >>> Hi, we do not check for any ports, how do we remove the Ports column >>> please? In the documentation >>> (https://en.wikibooks.org/wiki/System_Monitoring_with_Xymon) it says: >>> >>> I don't want to display column foo in my display. How do I do that ? >>> A. Add the entry NOCOLUMNS:foo,bar to hide column foo and bar. >>> >>> but it doesn't say where and it also mentions (in other answers) bb >>> files that don't exist so I guess it is out of date. (Is there an >>> uptodate version of this document t cover the latest Xymon?) >>> >>> Regards, >>> >>> Nick Pettefar >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >> >

3 2

Xymonlaunch pid file location error
by xserv4real＠hotmail.com 06 Feb '13

06 Feb '13

Hello Hobbit Devels I have been working on getting Xymon to work on Raspberry Pi, but ran into some trouble with xymonlaunch. And reloading the config file. It seems that the xymonlaunch does not correctly read tasks.cfg for the XYMONSERVERLOGS env variable, because trying to change the directory from default to another, I wanted to update configuration. Using “sudo service xymon reload” which starts the reload script, but gives the error: ----[info] Reloading xymond config.cat: /var/run/xymon/xymond.pid: No such file or directory/etc/init.d/xymon: 91: kill: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... orkill -l [exitstatus]---- Which made me look into xymonlaunch and found it uses pidfile “--pidfile=/var/run/xymon/xymonlaunch.pid” and this is not what is used by the ENV variable or anything I can find, but it is however in the xymon.init ? shouldn’t this change from the tasks.cfg file? Also made the gdb trace, but I am not sure this the relative to the problem. ---------Reading symbols from /usr/lib/xymon/server/bin/xymond...(no debugging symbols found)...done.[New LWP 3996][Thread debugging using libthread_db enabled]Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".Core was generated by `xymond --pidfile=/var/log/xymon/xymond.pid --restart=/usr/lib/xymon/server/tmp/'.Program terminated with signal 6, Aborted.#0 0xb6c12bfc in raise () from /lib/arm-linux-gnueabihf/libc.so.6(gdb) bt#0 0xb6c12bfc in raise () from /lib/arm-linux-gnueabihf/libc.so.6#1 0xb6c1697c in abort () from /lib/arm-linux-gnueabihf/libc.so.6#2 0x00009304 in ?? ()#3 0x00009304 in ?? ()Backtrace stopped: previous frame identical to this frame (corrupt stack?)(gdb) quit--------- Kind regards Mark

1 0

BBWin hanging on Server 2008R2 SP1
by david.baldwin＠ausport.gov.au 06 Feb '13

06 Feb '13

I have noticed a few of my monitored servers running BBWin having BBWin.exe wedging recently - so all the client tests go purple. Maybe triggered by a recent Windows update? The process cannot be killed, so the service cannot restart without rebooting the server. Has anyone else noticed this? Some are running 0.12 and others 0.13. All central mode. We have also recently deployed SCEP AV so possibly some interaction there? Recent versions of SCEP also make the MsMpSvc service (Microsoft Antimalware Service) "invisible" to BBWin so it does not get reported in the svcs section. Any suggestions appreciated! Thanks, David. -- David Baldwin - Senior Systems Administrator (Datacentres + Networks) Information and Communication Technology Services Australian Sports Commission http://ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617 ------------------------------------------------------------------------------------- Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender. -------------------------------------------------------------------------------------

1 0

SSL Error
by dhaycurrie＠leisurefitness.com 05 Feb '13

05 Feb '13

This is another problem I am having checking some remote sites. When checking the https I get a SSL Error. I tried doing curl -I https:hosttocheck:8080 And I get curl: (35) error:14077417:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert illegal parameter I am guessing that it might be that the SSL level is not 3? These are tomato firmware Linksys routers. If I try to do curl -sslv2 hosttocheck:8080 I get an error that OpenSSL was built without SSLv2 support. If I add SSLv2 to OpenSSL will the checks work? How would I go about using apt to do this in Ubuntu 12.04? I try not to build anything from source to make it easier to keep up to date, and so that the apt check do not fail. David Hay-Currie IT Manager Leisure Fitness Equipment LLC 231 Executive Dr. Suite 15 Newark, DE 19702 Phone: (302) 224-5018 [cid:image002.png at 01CE03CE.97895830]<http://www.leisurefitness.com/?referrer=dhaycurrie>

1 0

Easy upgrade from 4.3.7 > 4.3.10 ?
by tsztur＠gmail.com 05 Feb '13

05 Feb '13

What's a quick of way upgrading without overwriting my current configs? Is there a specific upgrade option during/after compiling? I would like to keep ssl support, etc. tia

3 3

Memory usage issue
by sdculver＠purdue.edu 05 Feb '13

05 Feb '13

We are having an issue with xymon on two of our servers. These two servers are 2008 r2. What we have discovered is happening is that about every 5 minutes something tries to load a large file to the event log. It is not able to do this. The memory usage spikes to near 100% for about 10 seconds until it fails and then drops back down. It is something associated with the xymon service doing this. If we turn of the server and reboot the server, it goes away and returns when we start the service. Has anyone seen this, or a similar issue before? How did you address it? The software on these servers is Blackboard Transact. These are the only two servers in a large environment that are having issues. Thanks, Scott PURDUE BOILERMAKERS PURDUE BOILERMAKERS PURDUE BOILERMAKERS PURDUE BOILERMAKERS Scott D. Culver ITIS Application Administrator (765) 494-9012<tel:%28765%29%20494-9012> Freehafer Hall 401 S. Grant Street West Lafayette, IN 47907 PURDUE BOILERMAKERS PURDUE BOILERMAKERS PURDUE BOILERMAKERS PURDUE BOILERMAKERS "If I find in myself a desire which no experience in this world can satisfy, the most probable explanation is that I was made for another world." - C.S. Lewis

1 0

Question about parsing a process memory use and alerting on threshold
by Don.Kuhlman＠schawk.com 05 Feb '13

05 Feb '13

Hi folks. The list seems to be quiet lately, so I figured I would stir up some traffic :) I've been looking but haven't found too much info on the following question: Can I alert on a specific process if it's memory use exceeds a value ? Here's the line coming to the xymon server from the bbwin .9 client on a Windows server: 01.2% 3868 java.exe 8 3:12:21 NT AUTHORITY\SYSTEM 635048k I would like to set alerts if the mem used exceeds 985000 K and go red if it's over 1 gig. Any thoughts appreciated. Thanks Don K

1 0

Permanently remove tests
by Nick＠Pettefar.com 05 Feb '13

05 Feb '13

At xymon.com/xymon/help/xymon-tips.html it states: I accidentally added an 'ftp' check. Now I cannot get it off the webpage! Use the command ~/server/bin/xymon 127.0.0.1 "drop HOSTNAME ftp" to permanenly remove all traces of a test. Note that you need the quotes around the "drop HOSTNAME ftp". However this only works for a while and then the test re-appears. Is there a way to make it permanent? Regards, Nick Pettefar

2 3