July 2013 - Xymon - Xymon mailman web

http test
by martin.flemming＠desy.de 28 Jul '13

28 Jul '13

Hi ! Can somebody tell me how the http-check work ? .. i see nothing like "curl, etc." in the source xymonnet/httptest.c The reason ist, that after a normal http-check on a windows-server, the application craches .. .i can't believe that the xymon-http-test should be the reason, but i've to tell how does xymon test a webside ... thank & cheers Martin

2 2

Xymon 4.3.10 holidays.cfg and Thanksgiving
by novosirj＠umdnj.edu 27 Jul '13

27 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, Saw a mention on the list previously about Thanksgiving winding up early on the calendar even though it theoretically is configured correctly in holidays.cfg. This issue still exists on 4.3.10, which I'm now running in pre-production. I have holidays.cfg set thusly: Thanksgiving:type=thu month=11 offset=4 Day after Thanksgiving:type=fri month=11 offset=4 ...the result is the following: Thanksgiving 11/21/12 Day after Thanksgiving 11/22/12 ...but, of course, 11/21 and 11/22 of 2012 is Wednesday and Thursday, not Thursday and Friday. I'm assuming this is a bug, not a misconfig. And to add a little nudge: > I've seen the issues described with Thanksgiving, but haven't had a > chance to look into the problem yet. If you don't hear anything > about it, it would be OK to send me a reminder in a months time or > so :-) > > Regards, Henrik Thanks in advance, and I'm really happy with 4.3.x and think my colleagues that rely on it will be too! - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlC2bSYACgkQmb+gadEcsb7shQCeKmhquWVNAry6sy7itT1um7S+ cUkAoMzAuJ6TPbOJ/mhyrgxJ6vPzb/4Q =hrXl -----END PGP SIGNATURE-----

3 3

Xymon Systems and Network Monitor - remote file deletion vulnerability
by henrik＠hswn.dk 26 Jul '13

26 Jul '13

Hi, a security vulnerability has been found in version 4.x of the Xymon Systems & Network Monitor tool (https://sourceforge.net/projects/xymon/) Impact ------ The error permits a remote attacker to delete files on the server running the Xymon trend-data daemon "xymond_rrd". File deletion is done with the privileges of the user that Xymon is running with, so it is limited to files available to the userid running the Xymon service. This includes all historical data stored by the Xymon monitoring system. Vulnerable versions ------------------- All Xymon 4.x versions prior to 4.3.12 with the xymond_rrd module enabled (this is the default configuration). Note that Xymon was called "Hobbit" from version 4.0 to 4.2; all of the "Hobbit" versions are also vulnerable. Mitigating factors ------------------ The attack requires access to the xymond network port (default: tcp port 1984). If access to administrative commands is limited by use of the "--admin-senders" option for the "xymond" daemon, then the attack is restricted to the commands sent from the IP-adresses listed in the --admin-senders access list. However, the default configuration permits these commands to be sent from any IP. Systems where xymond_rrd is disabled are not vulnerable, but this is not the default configuration. Details ------- Xymon stores historical data, trend-data etc. for each monitored host in a set of directories below the Xymon "server/data/" directory. Each monitored host has a set of directories named by the hostname. When a host is no longer monitored, the data stored for the host can be removed by sending a "drop HOSTNAME" command to the Xymon master daemon. This is forwarded to xymond_rrd and other modules which then handle deleting various parts of the stored data, essentially by performing the equivalent of "rm -rf <xymondatadirectory>/rrd/HOSTNAME". In the vulnerable versions of Xymon, the hostname sent to xymond was used without any checking, so a hostname could include one or more "../" sequences to delete files outside the intended directory. There are other modules that delete files in response to a "drophost" command, but for various reasons these are not vulnerable to the attack. Credit and timeline ------------------- The bug was discovered by "cleaver" during investigation of a bug originally reported to the Xymon mailing list on July 17 - http://lists.xymon.com/archive/2013-July/037838.html - and I was notified via private e-mail on July 21st when it was realized to be a security related issue. A bugfix - r7199 - was committed to the Sourceforge SVN code repository on July 23rd, and version 4.3.12 was released on July 24th. Henrik Størner Xymon developer

3 2

Installing 4.3.12 Solaris make install error
by everett.vernon＠gmail.com 26 Jul '13

26 Jul '13

Hi all Anybody seen this yet? Any workaround? Regards Vernon # make install make: Fatal error in reader: build/Makefile.SunOS, line 11: Unexpected end of line seen # cat build/Makefile.SunOS # Xymon compile-time settings for SunOS / Solaris OSDEF = -DSunOS # Solaris need this NETLIBS = -lresolv -lsocket -lnsl # Compile flags for normal build CC = gcc GCCVER := $(shell gcc -dumpversion|cut -d. -f1) ifeq ($(GCCVER),4) CFLAGS = -g -O2 -Wall -Wno-unused -Wno-pointer-sign -D_REENTRANT $(LFSDEF) $(OSDEF) else CFLAGS = -g -O2 -Wall -Wno-unused -D_REENTRANT $(LFSDEF) $(OSDEF) endif # This guesswork doesnt work on a lot of systems. # Better have a run-time issue that can easily be fixed with "crle" # or by setting LD_LIBRARY_PATH, than a build-time problem. #LDTYPE := $(shell ld -V 2>&1|head -1|cut -d' ' -f1) #ifeq ($(LDTYPE),GNU) # RPATH=-Wl,--rpath, #else # RPATH=-Wl,-R #endif # Compile flags for debugging # CFLAGS = -g -DDEBUG -Wall -D_REENTRANT $(LFSDEF) $(OSDEF) # Mail program: This must support "CMD -s SUBJECT ADDRESS" to send out a mail with a subject # Typically, this will be "mail" or "mailx" MAILPROGRAM="mailx" -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

5 6

xymon xymonlog command
by Phil.Crooker＠orix.com.au 25 Jul '13

25 Jul '13

Probably a lame question, but I'm unable to get anything from the xymonlog parameter (or xymonboard for that matter) with the xymon command: $XYMONHOME/bin/xymon 127.0.0.1 "xymonlog hostname,com.msgs" I do get the expected return for the query command and hostinfo, eg: $XYMONHOME/bin/xymon 127.0.0.1 "query hostname,com.msgs" green Thu Jul 25 10:55:24 2013 - System logs ok What I'm wanting to get is the lastchange info for a test. Could someone help, please? I'm pretty stumped... thanks, Phil

2 2

raid bbwin monitoring
by jkokino＠gmail.com 25 Jul '13

25 Jul '13

Hello I read many posts about raid, hp raid and etc. http://lists.xymon.com/archive/2010-February/027413.html This pages says CheckHpRaid 1.1.4: http://developer.sysco.ch/hobbit/ http://developer.sysco.ch/hobbit/CheckHpRaid.cmd When I open it, it is 1.1.3 I found 1.1.4 @ http://xymonton.org/ and works well however I dont know how to completely make it automatic Few issues: 1. It seems that the cmd file will not be leaded automatically. If I execute it manually, then all is ok, and the xymon server receives this info. Then it will not receive more automatically. I placed the cmd file in C:\Program Files\BBWin\ext\ I also tried by placing the cmd file in the root folder I edited the the BBWIN.cfg file <load value="cmd /c C:\CheckHpRaid_1.1.4.cmd" timer="5m"/> or <load value="cmd /c CheckHpRaid_1.1.4.cmd" timer="5m"/> I took cmd /c from the bbwin manual chm file which comes with 0.12 version 2. Second problem is that the logical disk is reported ok and all individual physical disk are ok, and yet I get color red for the logical disk. :) I am still trying to figure the source code where the if cases and statuses are wrong? And of course it says "At least one logical volume is in a failure state." Is anyone able to help? Specially the first question - point 1. The other one I think I will figure it out sooner or later. Thank you

3 6

Xymon Tool
by Prachi.Nawale＠ge.com 25 Jul '13

25 Jul '13

Hello Xymon Support team, Need your help in getting xymon up2date as per our requirements. Let me brief you here for the current setup. We have various sites/datacenters across the globe which includes servers (windows / Linux/Solaris physical servers and VMs, VMware ESX hosts) and network devices like switches, routers and firewall. We need to monitor critical servers/VMs and network devices here. In initial phase we could install, configure xymon older version ie 4.3.10 on a linux node at Hyderabad site. We have added couple of windows and linux clients as of now. Currently it is monitoring following components: connection, cpu, disk, memory, messages, netstats (ports), processes, services, uptime, user-logins I also tried to add a network switch device in xymon, however it shows conn is the only parameter to monitor. Refer below screenshot, inhydswt3a is the network switch that we added. Figure 2 shows: the trend it captured for switch. Figure 3 shows the trend metrics report for TCP connections. However, we are looking for more specific usage of xymon as a tool to monitor the virtual machines (windows and linux both) and the connection from other sites to find potentials problems and tracking of latency and throughput and provide a visible dashboard of that connection (and available latency/bandwidth if possible). Kindly assist further how to achieve this. Is there any custom graphs/trends can be captured through xymon. Figure1: Figure 2: inhydswt3a is the network switch Figure 3: hydmap01 is windows VM Thanks, Prachi From: Nawale, Prachi (GE Energy, Non-GE) Sent: Tuesday, July 09, 2013 6:18 PM To: 'Henrik Størner' Cc: Khan, Sahil (GE Energy Management) Subject: RE: RE: FW: Hej Henrik Hi Henrik, I could manage installing xymon older version ie 4.3.10 on a linux node. And it is working now. However I am facing following error while monitoring Conn and xymonnet parameters. Below is the error/screenshot. Conn: Xymonnet: Thanks, Prachi From: Nawale, Prachi (GE Energy, Non-GE) Sent: Tuesday, July 09, 2013 1:50 PM To: 'Henrik Størner' Subject: RE: RE: FW: Hej Henrik Hi Henrik, I have applied the patch. [root at hydxymon01 xymon-4.3.11]# patch -p0 < /tmp/attachment.diff patching file xymongen/loaddata.c Reversed (or previously applied) patch detected! Assume -R? [n] y [root at hydxymon01 xymon-4.3.11]# Then restarted httpd and xymon services. Tried to access http://3.185.120.18/xymon Or http://3.185.120.18/xymon/ Webpages, but getting PAGE not found error. I altered the DocumentRoot in /etc/httpd/conf/httpd.conf to use following. [root at hydxymon01 logs]# grep DocumentRoot /etc/httpd/conf/httpd.conf #DocumentRoot "/var/www/html" DocumentRoot "/home/xymon/server/www" [root at hydxymon01 logs]# Again restarted xymon and httpd services and launched the URL. Getting following error now. [root at hydxymon01 logs]# tail -f error_log [Tue Jul 09 13:45:07 2013] [error] [client 3.185.141.56] (13)Permission denied: access to /xymon denied [Tue Jul 09 13:46:32 2013] [error] [client 3.185.141.56] (13)Permission denied: access to /xymon/ denied Kindly advise. Thanks, Prachi From: Henrik Størner [mailto:henrik at hswn.dk] Sent: Tuesday, July 09, 2013 1:35 PM To: Nawale, Prachi (GE Energy, Non-GE) Subject: SV: RE: FW: Hej Henrik Hi, you use the 'patch' utility. Go to the xymon-4.3.11 directory and run 'patch -p0 < /tmp/attachment.diff'. Then run make and make install. Regards, Henrik "Nawale, Prachi (GE Energy, Non-GE)" <Prachi.Nawale at ge.com> skrev: Hi Henrik, Thank you for your response.

3 3

libs: cannot check kernel uptodateness
by r＠pil.as 24 Jul '13

24 Jul '13

My last servers installed with Debian wheezy or Ubuntu precise has started to show a yellow alarm at libs with message: *One of /proc/config.gz and /boot/config-3.2.0-4-amd64 was not found, cannot check kernel uptodateness * However ls -l /boot/config-3.2.0-4-amd64 -rw-r--r-- 1 root root 129065 Jun 9 15:47 /boot/config-3.2.0-4-amd64 A search at Google shows me several xymon monitor with the same yellow alarm active but I can found references about it. Any comments will be appreciated. Regards, Rodolfo Pilas

3 3

Bug in xymond/client/freebsd.c
by estassen＠gmail.com 24 Jul '13

24 Jul '13

Hi, I just discovered this one - it prevents the CLOCK test in analysis.cfg from working with freeBSD hosts. Patch below: --- freebsd.c.orig 2013-07-03 16:22:15.276935512 +0200 +++ freebsd.c 2013-07-03 16:22:36.208868573 +0200 @@ -47,7 +47,7 @@ timestr = getdata("date"); uptimestr = getdata("uptime"); - clockstr = getdata("clockstr"); + clockstr = getdata("clock"); msgcachestr = getdata("msgcache"); whostr = getdata("who"); psstr = getdata("ps"); Regards, Eddie

4 4

Windows Client
by malcolm.hunter＠gmx.com 24 Jul '13

24 Jul '13

Ah, the last update wasn't committed. It's up-to-date now. ----- Original Message ----- From: Malcolm Hunter Sent: 07/24/13 02:17 PM To: xymon at xymon.com Subject: Re: [Xymon] Windows Client Did you follow the instructions in the help Development -> Building BBWin? ----- Original Message ----- From: Neil Simmonds Sent: 07/24/13 01:38 PM To: xymon at xymon.com Subject: Re: [Xymon] Windows Client I’m currently looking at the code for BBWin (I’m checking out some ways of possibly finding memory leaks), I’ve checked it out from sourceforge SVN but when trying to build I’m getting the following error. 4> SubWCRev : E155036: The working copy at 'F:\BBWin Code\Trunk\Core' 4> is too old (format 10) to work with client version '1.8.0 (r1490375)' (expects format 31). You need to upgrade the working copy first. I’m using Visual Studio 2010 express which I thought was the version that the current BBWin was created in but this looks like I might be wrong. Can anyone help with this? From: Xymon [mailto:xymon-bounces at xymon.com] *On Behalf Of *Malcolm Hunter *Sent:* 24 July 2013 12:27 *To:* xymon at xymon.com *Subject:* Re: [Xymon] Windows Client A C# client is defintely the way to go. Unfortunately my C# knowledge isn't sufficient for a project on this scale. I could only assist with debugging, etc. ----- Original Message ----- From: Neil Simmonds Sent: 07/24/13 12:11 PM To: xymon at xymon.com Subject: Re: [Xymon] Windows Client Unfortunately we use quite a lot of External scripts and we also can't use Powershell. We have scripting disabled on all servers and while we might be able to get signed scripting allowed, we would require to run the client as a service which would have to run under the Local System account. Experience has shown us that this causes significant problems when trying to run signed scripts. The last time we had a requirement to run a Powershell script as an external on BBWin, I ended up having to rewrite it in VBScript as we couldn't get the PS script to work as a signed script under the Local System account. Unfortunately I don't make the rules under which I have to work, I just have to make the best of them and work within those rules for monitoring. > -----Original Message----- > From: Xymon [ xymon-bounces at xymon.com ] On Behalf Of Dugan, Darin D > [ITSYS] > Sent: 23 July 2013 17:06 > To: xymon at xymon.com > Subject: Re: [Xymon] Windows Client > > I'm a fan of WinPSClient and would like to see that become more widely utilized. > The chief drawback I have is no great way to run external scripts. > > Been working a lot with PowerShell lately so I might dive in one of these days.... > > Cheers. > Darin > > -----Original Message----- > From: Xymon [ xymon-bounces at xymon.com ] On Behalf Of Henrik Størner > Sent: Tuesday, July 23, 2013 10:53 AM > To: xymon at xymon.com > Subject: Re: [Xymon] Windows Client > > On 22-07-2013 15:20, Neil Simmonds wrote: > > > it appears that BBWin > > may not be fit for purpose in the near future. I've looked at MrBig > > and WinPSClient but MrBig seems to have no one maintaining the code > > and WinPSClient hasn't been changed in 2 ¼ years. > > > > Is anyone aware of any other options or has anyone considered perhaps > > writing something? I'd look into it myself but I'm not a programmer so > > although my VBScript and Shell script abilities are reasonable > > If you are not too scared to delve into Powershell, then I would really like you to > dig into the WinPSClient. > > It does work - despite not having been changed for quite some time. The main > problem with it appears to be that it is a bit ressource-consuming; Powershell is > not the most effective scripting language. > > But it is one that is supported on all current versions of Windows ... > and it does provide you with hooks into all of the Microsoft monitoring interfaces. > As I understand, getting data with Powershell is just as "easy" as doing it in C#. > > Regards, > Henrik > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ----------------------------------------------------------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences ar ising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ----------------------------------------------------------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences ar ising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net

1 0