September 2013 - Xymon - Xymon mailman web

Combo tests
by hj.beckers＠kreis-steinfurt.de 30 Sep '13

30 Sep '13

I'm trying to get more then 1 combo test to show up on the status page. My definitions in combo.cfg: ps0898.apps = (ps0898.excel + ps0898.word) Win7\-hjb.apps = (Win7\-hjb.excel + Win7\-hjb.word) Only the first shows a value in the apps column. According to the combostatus.log file with --debug both get evaluated: 25563 2013-09-30 10:56:11 Symbolic '(ps0898.excel+ps0898.word)' converted to '(1+1)' 25563 2013-09-30 10:56:11 Symbolic '(Win7\-hjb.excel+Win7\-hjb.word)' converted to '(1+1)' 25563 2013-09-30 10:56:11 Adding to combo msg: status ps0898.apps green Mon Sep 30 10:56:11 2013 25563 2013-09-30 10:56:11 Adding to combo msg: status Win7\-hjb.apps green Mon Sep 30 10:56:11 2013 25563 2013-09-30 10:56:11 Flushing combo message status ps0898.apps green Mon Sep 30 10:56:11 2013 status Win7\-hjb.apps green Mon Sep 30 10:56:11 2013 25563 2013-09-30 10:56:11 Recipient listed as '10.45.x.y' 25563 2013-09-30 10:56:11 Standard protocol on port 1984 25563 2013-09-30 10:56:11 Will connect to address 10.45.x.y port 1984 25563 2013-09-30 10:56:11 Connect status is 0 25563 2013-09-30 10:56:11 Sent 556 bytes 25563 2013-09-30 10:56:11 Closing connection 25563 2013-09-30 10:56:11 2 status messages merged into 2 transmissions On friday I tried the second test without the backslashes; the result was (to be expected): (Win7-hjb.excel+Win7-hjb.word) = (0-1+0-1) = -2 clear Win7 clear hjb.excel clear Win7 clear hjb.word The Win7.apps column stays purple and clicking shows me the above status as of last friday. I stopped xymon and dropped all files under server/ with "Win7*" in the name. The status is still there. Differences between ps0898 and Win7-hjb: ps0898 is Windows XP and has an active bbwin client. Win7-hjb is Windows 7 and sends only the status and data line for both tests word and excel, which are shown in the corresponding columns. What am I doing wrong? Hermann-Josef Beckers

1 1

CLIENT and/or COMMENT in email alert
by cphillips.ia＠gmail.com 30 Sep '13

30 Sep '13

Is it possible to add the CLIENT or COMMENT tag of a host to the email alert?

2 1

Xymonnet bad tags
by cure4all＠gmail.com 28 Sep '13

28 Sep '13

Hello, I need help to find which file do I need to edit in order to fix this Warning. Nothing else shows up in the logs. Thank you. WARNING: The 'bad<TESTNAME>' syntax has been deprecated, please convert to 'delayred' and/or 'delayyellow' tags

2 1

Where does xymon store info on currently blue servers?
by betsy.schwartz＠gmail.com 28 Sep '13

28 Sep '13

I restarted xymon and apache after emptying /usr/local/xymon/server/tmp, among other things A few minutes later, received a cascade of messages because every signle server that had been signed out was now signed back in. Where does xymon get the information, on restart, about what is currently signed out? Is that stored in the server's tmp dir? (if not, what could have happened to cause everything to be signed in? ) thanks Betsy (losing the battle to keep xymon in production here, and this did not help)

2 2

Xymon data into other tools.
by dan＠linder.org 27 Sep '13

27 Sep '13

I'd like to work with the data that the Xymon system is collecting, ultimately providing a CSV file or SysLog stream that others within my team could ingest with their tool of choice. I know I could write an rrdtool command to periodically dump the last 5 minutes of data, but I was hoping there was a cleaner way to hook into the server. I have checked the Xymon documentation on both SourceForge.net and at WikiBooks.org, but I don't seem to find this documented. Anyone have any pointers or thoughts on this? Thanks, DanL -- ***************** ************* *********** ******* ***** *** ** "Quis custodiet ipsos custodes?" (Who can watch the watchmen?) -- from the Satires of Juvenal "I do not fear computers, I fear the lack of them." -- Isaac Asimov (Author) ** *** ***** ******* *********** ************* *****************

4 3

logfetch max
by bakgat8＠hotmail.com 27 Sep '13

27 Sep '13

By all means somebody prove me wrong - but by experimentation and debug lines added to logfetch I am stating that the MAX chunk of a logfile that will ever be examined is #define MAXCHECK 102400 /* When starting, dont look at more than 100 KB of data */ The man page says - The log:FILENAME:SIZE line defines the filename of the log, and the maximum amount of data (in bytes) to send to the Xymon server. and that may be true. I did not investigate how much of the 102400 was sent to the xymon server. My trigger string was not in the lower 102400 bytes of the file and no matter what I made SIZE the trigger was never found. Also note the chunk of the file inspected never changed, no matter what the SIZE was. It seems to me the lower 102400 bytes (or how ever much you have?) is inspected - no matter what the SIZE value is. The chunk inspected seems to include ignored lines. So you don't get more file inspected if you have ignore lines, I guess you just have less crud in the data going to the xymon server. Given a test case where log:/home/devtestge/fake.log:202400 when I increased MAXCHECK and recompiled, the chunk examined increased. The was the only way the the chunk examined increased. Next I want to find out how big brother did this, so there are no nasty surprises when I move off the big brother client to the xymon client. -- Bakkies

1 0

File monitoring with `date` in filename
by schritte＠ub.uni-frankfurt.de 27 Sep '13

27 Sep '13

Dear xymon users, I got stuck while trying to monitor a file which should be updated regularly and which has got a timestamp in its name. "files" on the server remains clear, no data . Could someone tell me what is wrong with these settings or what have i forgotten? On the server we have in analysis.cfg HOST=myserver FILE `/home/mypath/log/update_out_$(date +%Y%m%d).txt` MTIME<600 red in client-local.cfg: [myserver] file:`find /mypath/log/update_out_$(date +%Y%m%d).txt` I see an entry for this file on the client in tmp logfetch.myserver.cfg file:`find /mypath/log/update_out_$(date +%Y%m%d).txt` but there is nothing for this file in msg.myserver.txt File exists and is readable: find /home/mypath/log/update_out_$(date +%Y%m%d).txt -exec ls -l {} \; -rw-rw-r-- 1 ... 2467070 Sep 26 08:43 /home/mypath/log/update_out_20130926.txt In xymonclient.log I see an entry sh: syntax error at line 1: `(' unexpected but I don't know if it is related to the file problem or to anything else. I know that sh can't deal with $(xy), I tried as well FILE /home/mypath/log/update_out_`date +%Y%m%d`.txt MTIME<600 red but in vain. Any help appreciated, kind regards Rolf -- Mit freundlichen Gruessen Rolf Schrittenlocher Lokales Bibliothekssystem Frankfurt Senckenberganlage 31, 60054 Frankfurt Tel: (49) 69 - 798 28908 Fax: (49) 69 798 28817 LBS: lbs-f at mlist.uni-frankfurt.de Persoenlich: schritte at ub.uni-frankfurt.de

3 5

logfetch questions
by bakgat8＠hotmail.com 27 Sep '13

27 Sep '13

LOGFILE CONFIGURATION ENTRIES A logfile configuration entry looks like this: log:/var/log/messages:10240 The log:FILENAME:SIZE line defines the filename of the log, and the maximum amount of data (in bytes) to send to the Xymon server. what is the MAX SIZE value possible - iow constrained by what ? logfetch monitors the bottom X chunk of the file - true or false ? if I get output like below - what can I conclude? [msgs:/var/log/rmsupload.log] <...SKIPPED...> SIZE being set to 31856 200 SITE command was accepted local: /ftpstage/rms/rmsupload17896.t remote: 'tran.rmsrpt32(+1)' 227 Entering Passive Mode (161,195,160,202,88,21) 125 Storing data set TRAN.RMSRPT32.G0008V00 <...SKIPPED...> I had more data than could fit in the chunk? iow I may have missed interesting stuff! SIZE being set to 31856 means what? how is this value decided? Thanks!

2 1

two xymon servers - who controls clients?
by bakgat8＠hotmail.com 27 Sep '13

27 Sep '13

I am setting up a production xymon monitoring server. I have a development one already running and was having the clients report to both. I had not thought this setup would be problematic, (being use to old style Big brother) but as I am working on a LOG monitoring setup - it dawned on me that both prod & dev xymon server installs have a client-local.cfg. Is there any kind of priority in the list of servers implied from the client point of view? on any given client I have /etc/default/xymon-client XYMONSERVERS="10.65.1.171 10.65.20.51" If by some dumbness of me I end up with different client-local.cfg files on prod and dev - which one will end up on the client? -- Bakkies

3 3

CLOCK and CPU test
by novosirj＠ca.rutgers.edu 26 Sep '13

26 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I suspect I know the answer to this but want to check: I'm running Xymon 4.3.12. My manager has recently brought up the need to have the clock drift monitored (it caused problems with a DB server when there was massive drift once for some reason). I looked into how to do this and it looks like the highest level that clock drift can cause Xymon to alert at is yellow. This means that if I wanted to be alerted, I'd have to also get alerted for yellow CPU on that machine, right? So far my only idea is to raise the yellow level for CPU. I don't really want to bother with an external test. Any tips? - -- ____*Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Sr. Systems Programmer || \\ and Health | novosirj at rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIT/EI-Academic Svcs. - ADMC 450, Newark `' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJDOxQACgkQmb+gadEcsb4kIACePC1gBVn4bTvMJFmyinpmcAz4 Ve4AnjMZ+B/CN3zdMFYJVdtBlS3iDUvj =+9dQ -----END PGP SIGNATURE-----

4 6