March 2013 - Xymon - Xymon mailman web

BBWin issue
by Neil.Simmonds＠express-gifts.co.uk 19 Mar '13

19 Mar '13

Hi all, I wondered if anyone had noticed anything unusual in the memory usage of BBWin 0.13. We've a number of servers running this version of the client and also a number running BBWin 0.12. All the 0.12 clients are using less than 10Mb of memory, however some of the 0.13 clients are using a lot more (a large number using between 250Mb and 400Mb and even one that was using over 1Gb). Has anyone seen this behaviour on their systems? I've asked on the BBWin mailing list but it's very quiet on there so I thought I'd ask here as well. Regards, Neil Simmonds Senior Operations Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0

problem with setting time window for alerts
by Ejones＠egov.com 18 Mar '13

18 Mar '13

I'm apparently doing something extremely wrong trying to set a time window for alerts for a specific server. This server burns up cpu every night and we don't want to see alarms for it, so I tried doing this to block those alarms in my hosts.cfg file - IP servername # conn NKTIME=*:0800:2200 I thought this was working but all of a sudden this weekend we got a ton of alarms from it again during the night.

4 3

is there a possibility to use regexp in file analysis.cfg when configuring SVC for windows machines ?
by tomas.andersson＠sca.com 17 Mar '13

17 Mar '13

Hi ! I'm running xymon 4.3.7 server running on HP-UX 11.31 ia64 using central mode. We have configured the analysis.cfg for windows clients like: ... SVC "DNS" status=started color=yellow SVC "Dfs" status=started color=yellow SVC "Dhcp" status=started color=yellow SVC "Dnscache" status=started color=yellow SVC "HealthService" status=started color=yellow SVC "IsmServ" status=started color=yellow SVC "LanmanServer" status=started color=yellow ... Everything works OK But Now and then when the Windows servers are restarted then The service name starts up with a different Case !!! So typically the LanmanServer service suddenly shows lanmanserver or Lanmanserver !!! Or w32time suddenly shows itself as W32time ... is it possible to use regexp in file analysis.cfg when configuring SVC for windows machines ? like SVC [W|w]32time status=started color=yellow or SVC [L|l]anman[S|s]erver status=started color=yellow Best Regards, /Tomas Andersson Unix System Admin/Tech/Dev SCA IT Services This message may contain confidential, proprietary or legally privileged information and is intended for the addressee's use only. Any usage, disclosure, distribution, print or copying of any part of this message is prohibited unless you are the intended recipient. If you receive this message in error, please delete it from any computer and notify the sender. If you suspect that this message may have been altered, please notify the sender. SCA has taken every reasonable precaution to ensure that this e-mail and any attachments to this e-mail has been scanned for viruses. However, SCA does not accept liability for any damage caused by software viruses brought to you by this mail.

3 2

Xymon forgetting acks at reboot
by me＠tdiehl.org 17 Mar '13

17 Mar '13

Hi, I am running the 4.3.10 rpms from terabithia.org on a Centos 6 machine. Every time I reboot the machine xymon forgets all of the services that are either acked or disabled. Is this expected behavior and if not how do I go about troubleshooting it? Regards, Tom me at tdiehl.org Spamtrap address me123 at tdiehl.org

3 3

Monitoring multiple, disconnected sites
by ralphmitchell＠gmail.com 16 Mar '13

16 Mar '13

On the client side, the only change was in /home/xymon/client/bin/xymonclient.sh. See attached diff. You'll need to fill in the destination server name. On the server side, add the email alias to /etc/aliases and rebuild the db files: xymonmsg: |/usr/local/bin/xymonmsg.sh newaliases Install the attached xymonmsg.sh script to match the above path. Check permissions - it needs to be executable by your email receiver. This is just a basic configuration. Extra frills that could be added include: 1) encrypt the payload, especially if you send logs. 2) send a second message with a cryptographic signature for authentication 3) add sequence numbers to the subject, then only accept a report with a higher number than the last, because emails are not guaranteed to arrive in the same order as they're sent. Ralph Mitchell On Sat, Mar 16, 2013 at 4:51 AM, Vernon Everett <everett.vernon at gmail.com>wrote: > Yes, I can see it. > It's working perfectly. > I forgot about using pipes and mail aliases, and my mind was darting off > down the more difficult tracks. > This is too easy. > > So that Xymon server on you IP is receiving all it's status updates via > email? > Brilliant! > > If you have any code snippets you can send me, it would be appreciated. > Thanks for bringing me back to the simple way of doing things. > > Regards > Vernon > > > > On 16 March 2013 15:16, Ralph Mitchell <ralphmitchell at gmail.com> wrote: >> >> my laptop, running the xymon client, delivering the standard status >> report via email to my server. Both systems are on my home network. The >> laptop is on a wifi link. >> >> The status message is about 80Kb, but I'm base64-encoding in-flight >> because there seems to be a line-length limit, probably enforced by mailx. >> >> Details tomorrow, if you're interested. It's past 3am, and I need >> sleep... >> >> Ralph Mitchell >> >> >> On Fri, Mar 15, 2013 at 10:56 PM, Ralph Mitchell <ralphmitchell at gmail.com >> > wrote: >> >>> 1) the xymon client script assembles the status report into a file, then >>> transmits that to the server over port 1984 using the xymon client program. >>> You could pipe it through mailx instead, to send it to the xymon server. >>> >>> 2) on the Xymon server, use an email alias to pipe the incoming mail >>> through a script. Or use something like procmail to handle it. Add an >>> alias like this to /etc/aliases: >>> >>> xymonmsg: |/usr/local/bin/xymonmsg.sh >>> >>> then run "newaliases" to recreate the alias db files. Any email >>> addressed to xymonmsg at your.server.com will be piped through that script. >>> >>> In the email, everything up to the first blank line is a header. After >>> that blank line, the remainder is the body of the email, which would be the >>> xymon report. That can be broken out and passed through the xymon command. >>> >>> I've done this to deliver logs, but the principal is sound for xymon >>> reports as well. >>> >>> Ralph Mitchell >>> >>> >>> On Fri, Mar 15, 2013 at 9:30 PM, Vernon Everett < >>> everett.vernon at gmail.com> wrote: >>> >>>> Hi Adam and everybody >>>> >>>> You are of course completely correct, and confirmed what I knew, but >>>> didn't really want to accept. >>>> >>>> IT people love problem solving within defined limited parameters, so >>>> let's see if we can come up with an elegant solution to this one, because I >>>> am sure I am not the first to encounter this. >>>> >>>> The only "connection" I have between the sites, is email. >>>> Is there a way to get the clients to send data to the server via emails? >>>> Alternatively, we could get a local server instance to update the >>>> master server with consolidated data via email. >>>> >>>> I am thinking the core of the problem is 2-fold. >>>> 1. Send the data via email from client or local server. >>>> 2. Receive and interpret the data at server side by parsing the >>>> incoming emails. >>>> >>>> Unless I missed something, both these tasks are non-trivial. >>>> Any ideas? >>>> >>>> Regards >>>> Vernon >>>> >>>> >>>> >>>> On 15 March 2013 08:53, Adam Goryachev < >>>> mailinglists at websitemanagers.com.au> wrote: >>>> >>>>> On 15/03/13 11:19, Vernon Everett wrote: >>>>> > Hi all >>>>> > >>>>> > Here's an interesting problem that has been put to me. >>>>> > A potential customer has a number of independent IT installations, >>>>> > with no always-on link between them or central IT. >>>>> > If there is an issue at a site, support staff will connect using VPN >>>>> > or Citrix over the interwebs. >>>>> > Is it possible to set up a central Xymon server to monitor these >>>>> > remote sites? >>>>> > If yes, then how? >>>>> > Has anybody done this before? >>>>> >>>>> Do you mean the sites have no "always-on link" like a dial-up >>>>> connection >>>>> ? or do you mean there is no VPN always on, but they always have >>>>> working >>>>> Internet? >>>>> >>>>> At the end of the day, if you want to get data out of the network to a >>>>> remote location (whether you use xymon or any other widget), you will >>>>> need to decide how that information gets there. Whether that is via the >>>>> Internet or sneakernet is up to you, but obviously sneakernet will be >>>>> less frequent and a bit more time consuming. >>>>> >>>>> Once you decide on how the data can be transported, it is just a matter >>>>> of working out how to tell xymon to use that transport method. Let us >>>>> know what you come up with, and I'm sure someone will be able to offer >>>>> further advice. >>>>> >>>>> Regards, >>>>> Adam >>>>> >>>>> -- >>>>> Adam Goryachev >>>>> Website Managers >>>>> www.websitemanagers.com.au >>>>> >>>>> _______________________________________________ >>>>> Xymon mailing list >>>>> Xymon at xymon.com >>>>> http://lists.xymon.com/mailman/listinfo/xymon >>>>> >>>> >>>> >>>> >>>> -- >>>> "Accept the challenges so that you can feel the exhilaration of victory" >>>> - General George Patton >>>> >>>> _______________________________________________ >>>> Xymon mailing list >>>> Xymon at xymon.com >>>> http://lists.xymon.com/mailman/listinfo/xymon >>>> >>>> >>> >> > > > -- > "Accept the challenges so that you can feel the exhilaration of victory" > - General George Patton >

1 0

Monitoring multiple, disconnected sites
by everett.vernon＠gmail.com 16 Mar '13

16 Mar '13

Hi all Here's an interesting problem that has been put to me. A potential customer has a number of independent IT installations, with no always-on link between them or central IT. If there is an issue at a site, support staff will connect using VPN or Citrix over the interwebs. Is it possible to set up a central Xymon server to monitor these remote sites? If yes, then how? Has anybody done this before? Regards Vernon -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

3 3

Xymon flapping: network slowness reality or delusion?
by David.Mills＠ngc.com 15 Mar '13

15 Mar '13

Hi, All ... The other day, our Xymon (4.3.3) started sending out notifications due to flapping on various hosts, various network-based tests which lasted for a rather sharply-defined period. It caused a fair bit of angst and I was on the hot-seat to prove Xymon was functioning properly. Here are some of the summary facts: - The flapping is pretty well documented in Xymon as occurring due to connection times exceeding our 10-second threshold - most of the , as configured in tasks.cfg CMD xymonnet --report --ping --checkresponse \ --timeout=10 --dns-timeout=2 \ --dnslog=/var/log/xymon-4.3.3/dns.log \ --concurrency=5 INTERVAL 3m - Output from the "xymonnet" report (currently - not captured during the "storm") shows: xymonnet version 4.3.3 SSL library : OpenSSL 0.9.8l 5 Nov 2009 LDAP library: OpenLDAP 20416 Statistics: Hosts total : 2081 Hosts with no tests : 2 Total test count : 2864 Status messages : 2856 Alert status msgs : 0 Transmissions : 30 DNS statistics: # hostnames resolved : 3337 # succesful : 921 # failed : 1266 # calls to dnsresolve : 2850 TCP test statistics: # TCP tests total : 1769 # HTTP tests : 1244 # Simple TCP tests : 525 # Connection attempts : 1767 # bytes written : 235845 # bytes read : 2514747 TIME SPENT Event Start time Duration xymonnet startup 1040654.310651 - Service definitions loaded 1040654.319152 0.008501 Tests loaded 1040655.696733 1.377581 DNS lookups completed 1040656.213268 0.516534 Test engine setup completed 1040657.416739 1.203470 TCP tests completed 1040675.444183 18.027443 PING test completed (923 hosts) 1040699.991467 24.547283 PING test results sent 1040700.080247 0.088780 Test result collection completed 1040700.144033 0.063785 LDAP test engine setup completed 1040700.152852 0.008819 LDAP tests executed 1040700.360821 0.207968 LDAP tests result collection completed 1040700.360829 0.000007 DNS tests executed 1040700.441820 0.080991 NTP tests executed 1040722.413523 21.971702 Test results transmitted 1040723.295458 0.881935 xymonnet completed 1040723.313935 0.018476 TIME TOTAL 69.003284 - Rather sharply defined start-up / cut-off for the "storm": I can point to the 5-minute segment when it started / stopped - The Xymon server OS/NIC hardware check out diagnostically - According to our network team's records, the network connection bandwidth utilization coming in / out of the Xymon server was < 1% capacity (i.e. we have lots of bandwidth) - According to our network team there were no significant loss of packets or congestion at the switch level (there's only one hop between the Xymon server and the rest of the hosts) - The types of services affected seemed pretty random: mostly HTTP tests, but LOTs of SSH/ping/NTP/LDAP, etc. as well. Any initial thoughts? Thanks! david ~~~~~~~~~~~~~~~~~~~ David Mills Systems Administrator Northrop Grumman 512-595-1238 david.mills at ngc.com

2 2

first alert generated twice
by canghel＠cjh.org 14 Mar '13

14 Mar '13

Hello all, I'm having this issue where the first alert is sent twice since I added html_mail.pl script. The alert message is generated with mail -s and html_mail.pl script, after that the emails are generated only by the html_mail.pl script. When I run this command: bin/bbcmd hobbitd_alert --test myserver msg 00017758 2013-03-13 12:13:06 *** Match with 'HOST=myserver' *** 00017758 2013-03-13 12:13:06 Mail alert with command 'mail -s "Hobbit [12345] myserver:msgs CRITICAL (RED)" canghel at mymail' 00017758 2013-03-13 12:13:06 Matching host:service:page 'myserver:msgs:servers' against rule line 69 00017758 2013-03-13 12:13:06 *** Match with 'SCRIPT /xymon/server/ext/html_mail.pl canghel at mymail FORMAT=PLAIN SERVICE=msgs COLOR=red REPEAT=10m RECOVERED' *** 00017758 2013-03-13 12:13:06 Script alert with command '/xymon/server/ext/html_mail.pl' and recipient canghel at mymail 00017758 2013-03-13 12:13:06 Matching host:service:page myserver:msgs:servers' against rule line 71 The entries in the hobbit-alert.cfg look like this Host=myserver SCRIPT /xymon/server/ext/html_mail.pl canghel at mymail FORMAT=PLAIN SERVICE=msgs COLOR=red REPEAT=30m RECOVERED How do I disable the mail -s? Thank you, Camelia Anghel

1 0

client-local.cfg, bbwin, and ignore
by SKreien＠la-z-boy.com 14 Mar '13

14 Mar '13

Does anyone have any working examples of logfile ignore statements that are working? I'm struggling to get ignore statements working with BBWin. If you do, can you please post the contents of your client-local.cfg? Thanks! Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Incorporated 1284 N. Telegraph Rd. | Monroe, MI 48162 | scot.kreienkamp at la-z-boy.com<mailto:scot.kreienkamp at la-z-boy.com> | www.la-z-boy.com<http://www.la-z-boy.com/> This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

1 0

Windows text logs
by SKreien＠la-z-boy.com 14 Mar '13

14 Mar '13

Hey everyone, Any ideas for monitoring a text log on Windows? BBWin doesn't seem capable of doing it. I didn't want to reinvent the wheel if someone else had a solution or if I missed something. Thanks! Scot This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 2