January 2014 - Xymon - Xymon mailman web

Syslog analyzer
by kc6ovd＠gmail.com 15 Jan '14

15 Jan '14

Xymon Brothers & sisters, One use of xymon I enjoy is forwarding all my syslogs from many cisco devices for alerting and displaying. I am now looking to do something with analysis of the logs. So say a top ten faults or something to just summarize the logs a bit to see things that we do not alert on a single occurrence. What tools are any of your using. Just wanting to get a feel from the group of what is out there. Let me hear what you are doing. Thanks -Kevin Long time brother converted to xymon 4 years ago.

1 0

How to restore a check that was previously disabled
by ozkrumpet＠gmail.com 15 Jan '14

15 Jan '14

Hi, I am using xymon 4.3.12. I previously had the ports check disabled in the hosts.cfg file using the defaults like: 0.0.0.0 .default. # NOCOLUMNS=ports I have then subsequently removed this NOCOLUMNS entry for ports and have defined a check for a couple of servers straight from the example in the man page to check for SSH port being open. The check has not reappeared in the xymon webpage and was wondering if there was anything special I need to do to "reactivate" it so xymon is aware that it should appear again on the webpage? Thanks Alex

3 3

Best way to override process detection for an individual server
by ozkrumpet＠gmail.com 15 Jan '14

15 Jan '14

Hi, I am using xymon 4.3.12. I am trying to use xymon to monitor processes across a number of servers. We have our analysis.cfg file setup with a regex entry to catch all the servers in our domain, but I then want to override the check for a single server. I have created an entry along the lines of: HOST=%.*.foo.com PROC sshd 0 0 red HOST=fred.foo.com PROC sshd 1 -1 red When using the above config the fred.foo.com server appears to be getting both sshd criteria in the procs check, one looking for zero and one looking for 1. Is there a way to override a check that runs across the whole domain for a single server, so that fred.foo.com only looks for zero instances of sshd? Thanks Alex

2 1

Is the powershell windows client reporting file time incorrectly?
by glauber.ribeiro＠experian.com 15 Jan '14

15 Jan '14

And it is! Function epochTime assumes a local time and converts to UTC: function epochTime([System.DateTime] $t) { [uint32](($t.Ticks - ([DateTime] "1/1/1970 00:00:00").Ticks) / 10000000) - $osinfo.CurrentTimeZone*60 } But it's being used on times that are already UTC function XymonFileStat($file,$hash="") { ... "atime:{0} ({1})" -f (epochTime $fh.LastAccessTimeUtc),$fh.LastAccessTime.ToString("yyyy/MM/dd-HH:mm:ss") "ctime:{0} ({1})" -f (epochTime $fh.CreationTimeUtc),$fh.CreationTime.ToString("yyyy/MM/dd-HH:mm:ss") "mtime:{0} ({1})" -f (epochTime $fh.LastWriteTimeUtc),$fh.LastWriteTime.ToString("yyyy/MM/dd-HH:mm:ss") ... } I think the fix is to change the lines above to "atime:{0} ({1})" -f (epochTime $fh.LastAccessTime),$fh.LastAccessTime.ToString("yyyy/MM/dd-HH:mm:ss") "ctime:{0} ({1})" -f (epochTime $fh.CreationTime),$fh.CreationTime.ToString("yyyy/MM/dd-HH:mm:ss") "mtime:{0} ({1})" -f (epochTime $fh.LastWriteTime),$fh.LastWriteTime.ToString("yyyy/MM/dd-HH:mm:ss") glauber -----Original Message----- From: Ribeiro, Glauber Sent: Tuesday, January 07, 2014 16:09 To: 'xymon at xymon.com' Subject: RE: Is the powershell windows client reporting file time incorrectly? It looks as if in the new client, the GMT correction is being applied twice, or GMT correction is being applied to a time that's already in GMT. g -----Original Message----- From: Ribeiro, Glauber Sent: Tuesday, January 07, 2014 16:02 To: 'xymon at xymon.com' Subject: Is the powershell windows client reporting file time incorrectly? Please see this: http://lists.xymon.com/oldarchive/2008/06/msg00441.html And here is what the new client reports for a file in my system: [file:D:\tsiback\today\tsbackup.log] type:100000 (file) mode:777 (not implemented) linkcount:1 owner:0 (BUILTIN\Administrators) group:0 (MCKOEMTAB3\None) size:7764 atime:1389100219 (2014/01/07-01:10:18) ctime:1389100219 (2014/01/07-01:10:18) mtime:1389100676 (2014/01/07-01:17:56) FileVersion: FileDescription: Let's take mtime. 2014/01/07-01:17:56 is correct, in local time. 1389100676, if I'm not mistaken (big if) is 2014-01-07 13:17:56 I'm at GMT-6 (USA Central Time), so the correct time stamp for the file in GMT would have been 07:17, not 13:17. Xymon sees the time "in the future" and reports that the file is massively out of synch ("File was modified 4294959253 seconds ago - should be <108000"). ================================== Compare with the old BBWin client (same file name, but different server): [file:d:/tsiback/today/tsbackup.log] type:0x00020 (file) mode:777 (not implemented) linkcount:1 owner:0 (not implemented) group:0 (not implemented) size:4823 atime:1389062375 (2014/01/7-02:39:35) ctime:1389058500 (2014/01/7-01:35:00) mtime:1389062373 (2014/01/7-02:39:33) 1389062373 is 2014-01-07 02:39:33, so the old client is reporting the unixepoch in local time, as described in the old bug report I mentioned at the start of this email. Also, why is the "type" reported differently? (100000 versus 0x0020) Does it matter? glauber

2 1

WinPSClient - Updates?
by JasonRP＠techheads.com 15 Jan '14

15 Jan '14

So it looks like the WinPSClient hasn’t been updated in a few months. I had seen a thread from quite a while ago about some issues David was running into, but can’t tell if he’s still around and willing/able to work on it. I’ve been able to get XymonPSClient.exe (aka SrvAny) to run powershell natively as a 64-bit executable. The only change necessary to enable this was changing the PowerShell executable to running as %windir%\sysnative\WindowsPowerShell\v1.0\powershell.exe. The sysnative portion prevents a 32-bit program (SrvAny) from being redirected to %windir%\SysWow64. (See http://msdn.microsoft.com/en-us/library/windows/desktop/aa384187(v=vs.85).a…) I also found a better service wrapper than SrvAny, namely nssm (http://nssm.cc/) This has the ability to detect if powershell fails and restart it, which is something SrvAny lacks. It also comes in both 32-bit and 64-bit versions, so when using the latter the sysnative piece isn’t necessary. I’ve only been working at this for a day or two, so it probably needs more testing, but it looks promising. Is there any work (design contemplation) about how xymonclient.ps1 could handle external scripts? I assume this was just a future phase and not so much a limitation or barrier that hadn’t yet been overcome. Thanks. --- Jason Richards Pagh

4 7

Xymon 4.3.13: HTTPS check issues
by feld＠feld.me 14 Jan '14

14 Jan '14

Hello, I just started testing of Xymon 4.3.13 before putting it in the FreeBSD ports tree and noticed an issue with a couple servers we are monitoring. The HTTPS check is going red and the SSL is purple. Xymonnet shows this error: Error output: Unspecified SSL error in SSL_connect to https (47873/tcp) on host 66.170.1.47: error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112) Unspecified SSL error in SSL_connect to https (47873/tcp) on host 66.170.1.28: error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:reason(1112) Any clue what is causing it? Xymon 4.3.13 on FreeBSD 9.1 OpenSSL 0.9.8q 2 Dec 2010 Thanks

3 9

MQ monitoring on Windows
by glauber.ribeiro＠experian.com 14 Jan '14

14 Jan '14

OK, I misunderstood. You should be able to send “data” messages. Same place in http://xymon.com/xymon/help/manpages/man1/xymon.1.html data HOSTNAME.DATANAME<newline><additional text> The first word is the literal “data” instead of “status”. I’ve used this in unix, but not windows. It should work, though. You may need to enable xymond_filestore on the server side (I did). I used this to build a poor-man’s tripwire system, where the clients report file hashes to the server, and the server compares them to a server-side database. You would have to use bbwincmd for this, since the temp dir method hardcodes a “status” message. g From: Neil Simmonds [mailto:Neil.Simmonds at express-gifts.co.uk] Sent: Tuesday, January 14, 2014 01:55 To: Ribeiro, Glauber Subject: RE: [Xymon] MQ monitoring on Windows Hi Glauber, You're right if it was an external test as normal, unfortunately I want to send this data as client data that the server will then handle the tests on. Apparently (according to Henrik) if you send MQ data from a Linux client with the command like I had the BBWin command (i.e. replacing the colour with the word "client") then Xymon will handle it as if it was normal client data. That means I can then configure the queues I want to monitor on the server and not have to change the script if someone wants a new queue monitored. It doesn't look like that is going to work on BBWin. I think I'll have to rewrite it to do the checking of queue depth on the client and send the status to Xymon in the way you have described. Regards, Neil. > -----Original Message----- > From: Ribeiro, Glauber [mailto:glauber.ribeiro at experian.com] > Sent: 13 January 2014 20:15 > To: Neil Simmonds > Cc: xymon at xymon.com<mailto:xymon at xymon.com> > Subject: RE: [Xymon] MQ monitoring on Windows > > OK, here’s what it needs to be: > > > 1) If you put the text file in the tmp directory (which is what I do in Windows with > BBWin): > > > color timestamp, etc > Rest of your data > > So, the first line has to be the “color” (the word green, red, or yellow), a space, and > the timestamp, plus optionally some short text you want to display in big font. But > definitely the color has to be the first word on the first line, or it won’t work. After > the first line, come whatever detail lines you want to send. The file name must be > the column name for xymon server, i.e, you name the file “mq” (not mq.txt, just > mq). > > > 2) In Unix, I use the xymon utility, and I suppose bbwincmd works the same way. In > that case, the format is documented in > http://xymon.com/xymon/help/manpages/man1/xymon.1.html under “XYMON > MESSAGE SYNTAX”. The message type you want is status. > > Assuming your client name is set to client.domain.com, your data must look like > this: > > status client,domain,com.mq green timestamp, etc Rest of the data > > > Notice the hostname has commas instead of dots. Notice the column name after > the host. Notice that the data MUST start with the word “status”, or it won’t work. > As you can see in the URL above, there are a few optional things. The Lifetime > parameter is very useful for tests that run less often than every 5 minutes. If > lifetime is 40 minutes, the format would be > > status+40 ... ... ... > > > I think with this information, you’ll be able to make it work. Good luck, and let us > know! > > Like I said above, with BBWin I always use the method of dropping a text file in the > tmp directory. > > > glauber > > Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ________________________________ NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

1 0

Modernizing the DNS check
by feld＠feld.me 14 Jan '14

14 Jan '14

Is there any hope of enhancing the DNS check capability beyond its current functionality? It would be nice if it could detect all the NS for the domain you're monitoring to compare the SOA serial of all the NS servers and go red if they're not in sync.

5 10

Dig test as the only service monitored
by dan.mcdonald＠austinenergy.com 13 Jan '14

13 Jan '14

I did a bit more testing, and found that the ³dig² test cannot be the only service that is monitored for a host, or it will fail. As I wanted to check my anycast dns address to verify that it responds to DNS for various zones (and we generally don¹t respond to echo requests on load-balanced virtual addresses), the only test I needed to run was ³dig². I have added the ³conn² test and now the dig test becomes active. I did replicate the issue with another virtual DNS server anycast address. The failure message is ³service unavailable². That appears to be coming from line 1528 of xymonnet.c. I¹m not handy enough in C to determine where the precise coding is that blocks testing services when there are no ping or tcp tests first. Is that expected behavior? -- Daniel J McDonald, CISSP # 78281

2 1

MQ monitoring on Windows
by glauber.ribeiro＠experian.com 13 Jan '14

13 Jan '14

OK, here’s what it needs to be: 1) If you put the text file in the tmp directory (which is what I do in Windows with BBWin): color timestamp, etc Rest of your data So, the first line has to be the “color” (the word green, red, or yellow), a space, and the timestamp, plus optionally some short text you want to display in big font. But definitely the color has to be the first word on the first line, or it won’t work. After the first line, come whatever detail lines you want to send. The file name must be the column name for xymon server, i.e, you name the file “mq” (not mq.txt, just mq). 2) In Unix, I use the xymon utility, and I suppose bbwincmd works the same way. In that case, the format is documented in http://xymon.com/xymon/help/manpages/man1/xymon.1.html under “XYMON MESSAGE SYNTAX”. The message type you want is status. Assuming your client name is set to client.domain.com, your data must look like this: status client,domain,com.mq green timestamp, etc Rest of the data Notice the hostname has commas instead of dots. Notice the column name after the host. Notice that the data MUST start with the word “status”, or it won’t work. As you can see in the URL above, there are a few optional things. The Lifetime parameter is very useful for tests that run less often than every 5 minutes. If lifetime is 40 minutes, the format would be status+40 ... ... ... I think with this information, you’ll be able to make it work. Good luck, and let us know! Like I said above, with BBWin I always use the method of dropping a text file in the tmp directory. glauber

1 0