October 2014 - Xymon - Xymon mailman web

Squidworks migration
by droark＠intellinetcorp.com 22 Oct '14

22 Oct '14

Hello, I am migrating someone from the Squidworks appliance over to a CentOS 6.5 server. Has anyone had success migrating Xymon data from this appliance, and if so is it more than just installing Xymon server and moving the RRD files over? On Squidworks, the Xymon root is located at /var/www/xymon. The RRD files are in /var/www/xymon/data/rrd/MAG/. I don't see a separate database for Xymon like I do for Cacti, so I'm assuming there are no database operations that need to take place. Any help or more successful Google-fu is appreciated. Thanks, Devin -- Devin Roark | Systems Administrator | IntelliNet Corporation 216-706-1070 | droark at intellinetcorp.com<mailto:droark at intellinetcorp.com> | 1255 Euclid Avenue, Cleveland, Ohio 44115

1 0

Hobbit Server Overload Due To Windows Event Logs
by Scott.Rebman＠hhsc.state.tx.us 22 Oct '14

22 Oct '14

We're trying to completely shut down all Windows event logs being sent from the clients to the Xymon server. We experimented and only seemed able to achieve this by deleting the: <load name="msgs" value="msgs.dll"/> line and the entire "<msgs> ...</msgs>" stanza from the local BBWin.cfg. We thought we had a recipe for success on the rest of our Windows clients but when we started trying to make it work on two other boxes, we found that the "procs" and "timediff" tests went purple! We experimented by putting parts of the <msgs> ... stanza back in but we found that (apparently) the client data was not making it back to the server from the client after the mods. So - we got it working on our test box, but on two other "live" boxes it failed and interfered with other tests. This is a hot item for us since our Hobbit server is being overwhelmed by incoming data, in large part coming from these huge Windows event logs. Thanks! Scott Allen Rebman Solaris System Administrator HHS/HHSC/Contractor TIERS Operations (512)873-6864 (CrossPark) (512)275-6122 (cell) Scott.Rebman at hhsc.state.tx.us

2 1

Sudden rash of "logfetch" crashes in libc on RHEL 6 Linux?!?
by earle＠isolar.DynDNS.ORG 21 Oct '14

21 Oct '14

On Oct 21, 2014, at 13:58 PM +1100, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote: > On 21 October 2014 10:01, Greg Earle <earle at isolar.dyndns.org> wrote: > >> Starting about 45 minutes ago as I type this, all of a sudden, 5 of >> my machines running Xymon 4.3.17 have gotten afflicted with a mysterious >> 'disease' - "logfetch" is endlessly crashing on all of them. > > I wonder if it's the same logfetch bug that's been lingering at least 3 > years: > > http://lists.xymon.com/archive/2013-August/038009.html I believe you're probably right, I had found postings from as far back as December 2011 to this list describing the same sort of crashing. > You might try out the work-around mentioned there to see if it helps. My work-around was to back-out the two seemingly-harmless "ignore" lines I had just added to my "client-config.cfg" file! I would try the memmove() twiddle (if I can't solve it some other way) but then again I'm using the Terabithia pre-cooked RPMs, so ... >> P.S. Why am I getting these "isn't signed with proper key" messages as well? > > Maybe this can help: > > http://lists.leap-cf.org/pipermail/leaplist/2012-December/000836.html Ah, interesting, thanks for that. Not sure I'm too excited about going 'round adding 2 lines to 100+ "/etc/abrt/abrt.conf" files tho ;) - Greg

2 1

Alerts Mail Problem
by stephenwong1015＠gmail.com 21 Oct '14

21 Oct '14

Dear Xymon, Thanks for your open source licensed software,,i have a trouble configure on the e-mail alert, i had add the mail and following the example, but i cannot get the alerts mail....would u pls help to solve the problem. /home/xymon/server/etc/alerts.cfg HOST=HomePC1 MAIL stephenwong1015 at gmail.com SERVICE=rdp REPEAT=1h HOST=HomePC2 MAIL stephenwong1015 at gmail.com SERVICE=rdp DURATION>5 COLOR=red Thanks and Regards Stephen

3 2

Multiple Issues with 4.3.17 install
by cleaver＠terabithia.org 21 Oct '14

21 Oct '14

If you're seeing a crash alert ("Signal received", etc) and it's purple, it was just the one-time note that something internal to xymon crashed. (That, of course, isn't supposed to happen, but... :/ ) xymond_rrd normally doesn't send in a test about itself (none of the processors launched via xymond_channel do by default, only the xymonlaunch-ed daemons and run-once commands), so it won't clear even if the system is running fine now. Also, I'd have to check, but I believe re-enabling of disables doesn't take effect right away -- there's a part that may not update until the next status message is received for it. In either case, just drop the now-spurious "xymond_rrd" test using something like: ./xymon 0.0.0.0 "drop xymonems xymond_rrd" HTH, -jc On Tue, October 21, 2014 6:57 am, Neal, Jonathan W wrote: > Anyone got any ideas about this? The test does not show as disabled on > the enable/disable page, but is still blue and doesnât seem to update at > all. No xymond_rrd files are being created in /export/home/xymon/data/* > anywhere. If I do a ./xymon 0.0.0.0 "enable xymonems.xymond_rrd" it > doesnât change it at all. It is like the status is stuck somewhere, but > I am not sure how or where. > > > From: Neal, Jonathan W [mailto:wes.neal at verizon.com] > Sent: Monday, October 20, 2014 12:52 PM > To: Jeremy Laidman > Cc: xymon at xymon.com > Subject: RE: [Xymon] Multiple Issues with 4.3.17 install > > No core file on the system.Â I think there is something else odd going > on.Â I removed all the data that belongs to the xymonems host from > /data/* .Â I restarted the system and xymond_rrd is still blue, even > though it isnât even disabled any longer.Â Itâs like it canât or > doesnât know how to update the status for it.Â I watched the xymond > status for from yellow to green after the restarted, but xymond_rrd never > changed. > > > From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] > Sent: Sunday, October 19, 2014 4:08 PM > To: Neal, Jonathan W > Subject: Re: [Xymon] Multiple Issues with 4.3.17 install > > Look for a core file, then use gdb to get a backtrace. This will tell us > what it is doing when it crashes. > J > On 18/10/2014 7:31 AM, "Neal, Jonathan W via Xymon" <xymon at xymon.com> > wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From:Â "Neal, Jonathan W" <wes.neal at verizon.com> > To:Â "xymon at xymon.com" <xymon at xymon.com> > Cc:Â > Date:Â Fri, 17 Oct 2014 16:31:06 -0400 > Subject:Â RE: [Xymon] Multiple Issues with 4.3.17 install > I am unsure why it is even showing purple, but it definitely is and it > keeps alerting on it.Â If I drill down into a system I see data being > graphed that is valid.Â If I look at the processes on the system I see: > > xymonems:xymon > ps -ef |grep xymond_rrd > Â Â xymon 18720 18714Â Â 0 02:45:03 ?Â Â Â Â Â Â 0:00 > xymond_channel --channel=data --log=/var/log/xymon/rrd-data.log xymond_rrd > --rr > Â Â xymon 18806 18720Â Â 0 02:45:12 ?Â Â Â Â Â Â 0:02 xymond_rrd > --rrddir=/export/home/xymon/data/rrd > Â Â xymon 18761 18719Â Â 0 02:45:04 ?Â Â Â Â Â Â 0:51 xymond_rrd > --rrddir=/export/home/xymon/data/rrd > Â Â xymon 18719 18714Â Â 0 02:45:03 ?Â Â Â Â Â Â 0:14 > xymond_channel --channel=status --log=/var/log/xymon/rrd-status.log > xymond_rrd > > So to me it seems as if it is running.Â What am I missing here? > > Wes > > > ---------- Forwarded message ---------- > From:Â "Neal, Jonathan W" <wes.neal at verizon.com> > To:Â "xymon at xymon.com" <xymon at xymon.com> > Cc:Â > Date:Â Thu, 16 Oct 2014 18:40:46 -0400 > Subject:Â Multiple Issues with 4.3.17 install > I am coming from an early 4.2 install.Â I merged my bb-hosts, > hobbit-alerts.cfg and hobbit-clients.cfg files into the proper files in > the new 4.3.17 install.Â I also copied over the entire histlogs directory > from data.Â Â Currently xymon_rrd keeps dying and going purple with a > Fatal signal error. > Â > rrd-status log has this in it going back most of the day: > Â > 2014-10-16 19:23:00 Peer at 0.0.0.0:0 failed: Broken pipe > 2014-10-16 19:23:00 Peer not up, flushing message queue > 2014-10-16 19:24:43 Shutting down, flushing cached updates to disk > 2014-10-16 19:28:39 Peer not up, flushing message queue > 2014-10-16 20:00:35 Shutting down, flushing cached updates to disk > 2014-10-16 20:00:36 Cache flush completed > 2014-10-16 21:58:19 Peer not up, flushing message queue > 2014-10-16 22:30:58 Shutting down, flushing cached updates to disk > 2014-10-16 22:30:59 Cache flush completed > 2014-10-16 22:31:14 Peer not up, flushing message queue > Â > Xymond is also constantly going yellow and I again see that 0.0.0.0:1984 > that is mentioned above: > Â > Statistics for Xymon daemon > Version: 4.3.17 > Up since 16-Oct-2014 22:31:09 (0 days, 00:04:59) > Â > Incoming messagesÂ Â Â Â Â :Â Â Â Â Â Â Â 937 > - statusÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â 885 > - comboÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 1 > - extcomboÂ Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â 22 > - pageÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - summaryÂ Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - dataÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 6 > - clientÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 2 > - notesÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - enableÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - disableÂ Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - ackÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - configÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 4 > - queryÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - xymondboardÂ Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 6 > - xymondlogÂ Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 5 > - dropÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - renameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - dummyÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 1 > - pingÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - notifyÂ Â Â Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - scheduleÂ Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - downloadÂ Â Â Â Â Â Â Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > - Bogus/TimeoutsÂ Â Â Â Â Â :Â Â Â Â Â Â Â Â Â 5 > Incoming messages/secÂ :Â Â Â Â Â Â Â Â Â 3 (average last 300 seconds) > Â > status channel messages:Â Â Â Â Â Â Â 885 (1 readers) > stachg channel messages:Â Â Â Â Â Â Â 877 (1 readers) > pageÂ Â channel messages:Â Â Â Â Â Â Â Â 37 (1 readers) > dataÂ Â channel messages:Â Â Â Â Â Â Â Â Â 6 (1 readers) > notesÂ channel messages:Â Â Â Â Â Â Â Â Â 0 (0 readers) > enadis channel messages:Â Â Â Â Â Â Â Â Â 0 (0 readers) > client channel messages:Â Â Â Â Â Â Â Â Â 2 (1 readers) > clichg channel messages:Â Â Â Â Â Â Â Â Â 0 (1 readers) > userÂ Â channel messages:Â Â Â Â Â Â Â Â Â 0 (0 readers) > backfeed messagesÂ Â Â Â Â :Â Â Â Â Â Â Â Â Â 0 > Â > Â > Latest error messages: > Loading hostnames > Loading saved state > Setting up network listener on 0.0.0.0:1984 > Setting up signal handlers > Setting up xymond channels > Setting up logfiles > Setup complete > Â > Can anyone tell me what might be going on? > Thanks in advance! > Â > >

1 0

xymon 4.3.17 central mode SVCS service status text inaccurate
by robr7535＠gmail.com 21 Oct '14

21 Oct '14

Hi, I have installed Xymon 4.3.17 on CentOS 6, using bbwin .13 on the Win hosts in central configuration mode. I'm seeing an odd issue when monitoring Windows services- the service status color matches the state of the service (red=service down; green=service up), but the text displayed does not. For example, service1 is running, and shown as green as it should be. But the status text displayed is 'service1 is stopped/disabled - want started/any'. I've confirmed the service is running, and the data sent by the client (via client data link on xymon page) shows it as such. What I have in analysis.cfg is simply: HOST=host1 SVC service1 STATUS=started I've seen some reports with previous xymon versions having similar problems when monitoring Windows hosts in central mode. Is there a way around this besides from switching to local mode? Thanks, Rob.

3 4

devmon issue
by Jurgen.Claessens＠cegeka.be 21 Oct '14

21 Oct '14

Hello all, I have an issue with devmon. Perhaps someone has encountered the same and found a solution. Devmon works without problems, except when there is no oid data to be read. When this happens for a test, all the other tests seem to get into trouble. Result is that not just the single test goes white, but also other test which do have correct data. I have checked if I am not using double oid's. Any tips are welcome. Thanks Jurgen Claessens This e-mail and all files transmitted as attachment(s) thereto are confidential and solely intended for the individual to whom or the organization to which they are addressed. If you received this e-mail by mistake, please notify Cegeka's Service Desk at cegeka.support at cegeka.be or call +32 (0)11 240 363. We thank you in advance. Cegeka hereby confirms that this message has been swept by Sophos for the presence of viruses.

1 0

Multiple Issues with 4.3.17 install
by wes.neal＠verizon.com 21 Oct '14

21 Oct '14

No core file on the system. I think there is something else odd going on. I removed all the data that belongs to the xymonems host from /data/* . I restarted the system and xymond_rrd is still blue, even though it isn’t even disabled any longer. It’s like it can’t or doesn’t know how to update the status for it. I watched the xymond status for from yellow to green after the restarted, but xymond_rrd never changed. Wes Neal Group e-mail: SES-HSI.Team at one.verizon.com<mailto:SES-HSI.Team at one.verizon.com> 24x7 Helpdesk for EMS: VZOES/OSC 1-800-634-5887 Opt3 From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] Sent: Sunday, October 19, 2014 4:08 PM To: Neal, Jonathan W Subject: Re: [Xymon] Multiple Issues with 4.3.17 install Look for a core file, then use gdb to get a backtrace. This will tell us what it is doing when it crashes. J On 18/10/2014 7:31 AM, "Neal, Jonathan W via Xymon" <xymon at xymon.com<mailto:xymon at xymon.com>> wrote: _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon ---------- Forwarded message ---------- From: "Neal, Jonathan W" <wes.neal at verizon.com<mailto:wes.neal at verizon.com>> To: "xymon at xymon.com<mailto:xymon at xymon.com>" <xymon at xymon.com<mailto:xymon at xymon.com>> Cc: Date: Fri, 17 Oct 2014 16:31:06 -0400 Subject: RE: [Xymon] Multiple Issues with 4.3.17 install I am unsure why it is even showing purple, but it definitely is and it keeps alerting on it. If I drill down into a system I see data being graphed that is valid. If I look at the processes on the system I see: xymonems:xymon > ps -ef |grep xymond_rrd xymon 18720 18714 0 02:45:03 ? 0:00 xymond_channel --channel=data --log=/var/log/xymon/rrd-data.log xymond_rrd --rr xymon 18806 18720 0 02:45:12 ? 0:02 xymond_rrd --rrddir=/export/home/xymon/data/rrd xymon 18761 18719 0 02:45:04 ? 0:51 xymond_rrd --rrddir=/export/home/xymon/data/rrd xymon 18719 18714 0 02:45:03 ? 0:14 xymond_channel --channel=status --log=/var/log/xymon/rrd-status.log xymond_rrd So to me it seems as if it is running. What am I missing here? Wes ---------- Forwarded message ---------- From: "Neal, Jonathan W" <wes.neal at verizon.com<mailto:wes.neal at verizon.com>> To: "xymon at xymon.com<mailto:xymon at xymon.com>" <xymon at xymon.com<mailto:xymon at xymon.com>> Cc: Date: Thu, 16 Oct 2014 18:40:46 -0400 Subject: Multiple Issues with 4.3.17 install I am coming from an early 4.2 install. I merged my bb-hosts, hobbit-alerts.cfg and hobbit-clients.cfg files into the proper files in the new 4.3.17 install. I also copied over the entire histlogs directory from data. Currently xymon_rrd keeps dying and going purple with a Fatal signal error. rrd-status log has this in it going back most of the day: 2014-10-16 19:23:00 Peer at 0.0.0.0:0<http://0.0.0.0:0> failed: Broken pipe 2014-10-16 19:23:00 Peer not up, flushing message queue 2014-10-16 19:24:43 Shutting down, flushing cached updates to disk 2014-10-16 19:28:39 Peer not up, flushing message queue 2014-10-16 20:00:35 Shutting down, flushing cached updates to disk 2014-10-16 20:00:36 Cache flush completed 2014-10-16 21:58:19 Peer not up, flushing message queue 2014-10-16 22:30:58 Shutting down, flushing cached updates to disk 2014-10-16 22:30:59 Cache flush completed 2014-10-16 22:31:14 Peer not up, flushing message queue Xymond is also constantly going yellow and I again see that 0.0.0.0:1984<http://0.0.0.0:1984> that is mentioned above: Statistics for Xymon daemon Version: 4.3.17 Up since 16-Oct-2014 22:31:09 (0 days, 00:04:59) Incoming messages : 937 - status : 885 - combo : 1 - extcombo : 22 - page : 0 - summary : 0 - data : 6 - client : 2 - notes : 0 - enable : 0 - disable : 0 - ack : 0 - config : 4 - query : 0 - xymondboard : 6 - xymondlog : 5 - drop : 0 - rename : 0 - dummy : 1 - ping : 0 - notify : 0 - schedule : 0 - download : 0 - Bogus/Timeouts : 5 Incoming messages/sec : 3 (average last 300 seconds) status channel messages: 885 (1 readers) stachg channel messages: 877 (1 readers) page channel messages: 37 (1 readers) data channel messages: 6 (1 readers) notes channel messages: 0 (0 readers) enadis channel messages: 0 (0 readers) client channel messages: 2 (1 readers) clichg channel messages: 0 (1 readers) user channel messages: 0 (0 readers) backfeed messages : 0 Latest error messages: Loading hostnames Loading saved state Setting up network listener on 0.0.0.0:1984<http://0.0.0.0:1984> Setting up signal handlers Setting up xymond channels Setting up logfiles Setup complete Can anyone tell me what might be going on? Thanks in advance!

1 1

Help tracking down ghost client
by robert.herron＠gmail.com 21 Oct '14

21 Oct '14

Xymon 4.3.17 on Oracle Linux 6 I have a ghost showing up on the my "Ghost Clients" report and I can't figure out what's is happening. A quick search of the archive didn't turn up anything similar. On the Ghost Client report: Hostname Sent from Candidate Report age mail07.example.com 10.10.1.2 xymon.example.com 0:32 This "mail07" [g]hostname doesn't exist in my hosts.cfg. It was removed when the host was decommissioned two months ago. The "sent from" address is my Xymon server. The "report age" counts up to just over 3 minutes, resets to 0, and starts incrementing again. This [g]host was a net-only testing host -- CONN, SMTP, and HTTP. There are references to the [g]hostname in analysis.cfg and alerts.cfg but those shouldn't cause this. The "mail07" string does occur in the ~/server/tmp/xymond.chk file but it seems to be ghost report. The xymond.chk line ends in "nGhost reports:\n 10.10.1.2 reported host mail07.example.com\n|||0|0". No other file in ~/server/etc contains "mail07". I added "--debug" to the xymonnet's CMD line and to the ~/server/ext/xymonnet-again.sh but "mail07" doesn't show up in either log. Any thoughts on where to look next? Thanks. Robert Herron robert.herron at gmail.com

4 4

Recover messages
by colin.coe＠gmail.com 21 Oct '14

21 Oct '14

Well, its only recover messages that I'm get complaints about but happy to get as much info on this as possible. Thanks On Mon, Oct 20, 2014 at 7:30 AM, Josh Luthman <josh at imaginenetworksllc.com> wrote: > Specifically only recover? > > Josh Luthman > Office: 937-552-2340 > Direct: 937-552-2343 > 1100 Wayne St > Suite 1337 > Troy, OH 45373 > > On Oct 19, 2014 6:52 PM, "Colin Coe" <colin.coe at gmail.com> wrote: >> >> Hi all >> >> Is there any way to only send recover messages between, say 6AM-10PM? >> Some of those that I work with are getting grumpy about recover >> messages while they're sleeping. >> >> Thanks >> >> CC >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon -- https://www.redhat.com/wapps/training/certification/verify.html?certNumber=…

3 2