November 2014 - Xymon - Xymon mailman web

both SPARC and x86 Solaris clients?
by rlhamil2＠gmail.com 07 Nov '14

07 Nov '14

How best to tell apart Solaris sparc vs x86 in client-local.cfg (for the clientversion especially, so suitable tar file can be chosen)? One possibility: modify runclient.sh to use uname -sp (lowercased, and with space converted to dash), which would come out as sunos-sparc or sunos-i386 (which is the end result I’d like) another: use the —class= argument to runclient.sh (although that would have to be referenced as a class in client-local.cfg), and means modifying the startup, which may vary before Solaris 10 vs at or after Solaris 10) another: set SERVEROSTYPE in xymonclient.cfg on Solaris (sparc and x86) as above Doubtless other possibilities too, but if anyone is dealing with this already, what are they doing? Comparably, what will happen when a bunch of Linux-on-ARM hit the data centers? :-)

1 0

duration of MSG red status
by nskyrca＠syr.edu 07 Nov '14

07 Nov '14

Hi Jeremy, I got 7, one every 5 minutes. ALERTREPEAT is set to 30 in hobbitserver.cfg. Our hobbit-alerts.cfg file has “DURATION>1m REPEAT=5m” for the msgs test for that machine. As far as I could tell, the messages status is yellow and it is staying yellow, not flapping. When I click on history in the GUI, it shows that it was yellow for 35 minutes. It looks like it’s the same message that we keep getting an alert for. We had an incident on Friday, where we got 7 email alerts. Below are examples of the portion of the email that showed the yellow alert. The timestamp in the log is 21:00:16 for all of the alerts, so it’s the same message. Email alert 1: yellow System logs at Fri Oct 31 21:01:10 EDT 2014 <pre> </pre> &yellow Warnings in <a href="/xymon-cgi/bb-hostsvc.sh?CLIENT=bbgroupa-web4.syr.edu&SECTION=msgs:/usr/local/blackboard/logs/tomcat/activemq.txt">/usr/local/blackboard/logs/tomcat/activemq.txt</a> <pre> &yellow WARN 2014-10-31 21:00:16,480 ActiveMQ NIO Worker 30057 org.apache.activemq.broker.TransportConnection.Transport - Transport Connection to: tcp://128.230.126.194:49464 failed: java.io.EOFException </pre> Email alert 2 yellow System logs at Fri Oct 31 21:06:10 EDT 2014 <pre> </pre> &yellow Warnings in <a href="/xymon-cgi/bb-hostsvc.sh?CLIENT=bbgroupa-web4.syr.edu&SECTION=msgs:/usr/local/blackboard/logs/tomcat/activemq.txt">/usr/local/blackboard/logs/tomcat/activemq.txt</a> <pre> &yellow WARN 2014-10-31 21:00:16,480 ActiveMQ NIO Worker 30057 org.apache.activemq.broker.TransportConnection.Transport - Transport Connection to: tcp://128.230.126.194:49464 failed: java.io.EOFException </pre> Email alert 7 yellow System logs at Fri Oct 31 21:31:11 EDT 2014 <pre> </pre> &yellow Warnings in <a href="/xymon-cgi/bb-hostsvc.sh?CLIENT=bbgroupa-web4.syr.edu&SECTION=msgs:/usr/local/blackboard/logs/tomcat/activemq.txt">/usr/local/blackboard/logs/tomcat/activemq.txt</a> <pre> &yellow WARN 2014-10-31 21:00:16,480 ActiveMQ NIO Worker 30057 org.apache.activemq.broker.TransportConnection.Transport - Transport Connection to: tcp://128.230.126.194:49464 failed: java.io.EOFException </pre> The Hobbit acknowledge code that appears in the subject of the emails is all the same code. Maybe we are getting multiple email messages because we did not acknowledge the alert. But, if the string does not appear again in the file in the next cycle, shouldn’t it turn back to green? When it happens again, I will try to look at the “client data available” link . I hope this helps. Nicole From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] Sent: Tuesday, October 28, 2014 9:37 PM To: Nicole Beck Cc: Bill Arlofski; xymon at xymon.com Subject: Re: [Xymon] duration of MSG red status Nicole On 29 October 2014 05:16, Nicole Beck <nskyrca at syr.edu<mailto:nskyrca at syr.edu>> wrote: What I’m seeing is that I get an alert for my trigger string (which has a timestamp on it), and then I keep getting alerts for the same trigger string (with the same timestamp) for the next 30 minutes. How often do you get the repeated alerts? Or how many in that 30 minutes? I’m not sure if anything else was append to the log file in that 30 minutes. I stop getting the alerts after 30 minutes and don’t have to wait until the log is rotated for the alert to clear. Do you have ALERTREPEAT defined in xymonserver.cfg? The default is 30 seconds, but you may have it less than that. Similarly, do you have "REPEAT" defined in alerts.cfg for the rule matching these alerts? (The "REPEAT" value in alerts.cfg defaults to the setting of ALERTREPEAT.) Is your message status (red?) staying non-green for the 30 minutes, or non-green for only a short time, or flapping like red/green/red/green? The way messages get to Xymon are via the client data. So during an "event" you can click on the "Client data available" link at the bottom of your "msgs" page for the host, and it should show you all of the client data, and you can search for the logfilename to see what log lines the client sent to the server. Or you can click on the logfile name on the "msgs" page for a modified client data report showing just the log lines for that logfile. What I'm trying to understand is whether you are getting the same messages sent multiple times from the client causing multiple events, or whether the one event is generating multiple alerts.

2 1

Bug Fix memstat.ksh on Solaris 11.2
by everett.vernon＠gmail.com 06 Nov '14

06 Nov '14

Hi all I have updated this script on Xymonton. https://wiki.xymonton.org/doku.php/monitors:memstat Couple of "bugs" came up. Firstly, Solaris 11 no longer supports setUID for root owned scripts. You now need to use sudo, which, thankfully, is installed by default. Then came a real interesting one when we upgrades to Solaris 11.2 The memstat script uses echo "::memstat" | mdb -k to collect the memory usage snapshot. Except, in Solaris 11.2, there are a few new values. The most interesting is, ZFS File Data has been split into ZFS File Data and ZFS Metadata, which is great, except that graphing sees both as haivng the NCV same index. So I had to make a change for that. Then there's a real odd-ball. Another entry appears, called Guest. I have never seen it ahve any other value besides 0, but it's there nonetheless. And every so often, I also get an entry "In temporary use". I kid you not! And it messes up the graphs. The changes should make it all work nicely on Solaris 10, 11, and 11.2 And it should work with setUID and sudo. Take your pick. Regards Vernon -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

1 0

[Devmon] devmon mysterious behaviour
by jlaidman＠rebel-it.com.au 06 Nov '14

06 Nov '14

I seem to recall a problem on 64-bit platforms where 64-bit SNMP request IDs were being rejected by libsnmp because it parsed them as 32-bit IDs, but only if the values were large enough. In this situation, I was able to probe the OIDs just fine using snmpget, but devmon failed to get the responses, but only sometimes. Comparing packet captures of failures and successes showed the problem. A previously posted thread might be of some assistance: http://sourceforge.net/p/devmon/mailman/message/30148661/

1 0

You don't have permission.
by Andreb＠paym8.co.za 05 Nov '14

05 Nov '14

Hi Guys, Trying to access Xymon from another Pc with Chrome and the following error shows. You don't have permission to access /xymon/xymon.html on this server. I did get this also previously and got passed it, but for the life of me I can't remember what I did. I have changed the dir permissions and also I have added "require all granted" to the httpd conf and such. Any advice Regards

3 2

Email and website notifications wrong IPs
by tres.finocchiaro＠gmail.com 04 Nov '14

04 Nov '14

We had this issue and it was caused by invalid settings in our DNS server. Xymon seems to attempt a DNS resolution prior to using the hard-coded IP address, which was tremendously confusing for us, but identified a problem were were unaware of. -Tres - Tres.Finocchiaro at gmail.com On Tue, Nov 4, 2014 at 11:13 AM, Neal, Jonathan W via Xymon <xymon at xymon.com > wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From: "Neal, Jonathan W" <wes.neal at verizon.com> > To: "xymon at xymon.com" <xymon at xymon.com> > Cc: > Date: Tue, 4 Nov 2014 11:12:50 -0500 > Subject: Email and website notifications wrong IPs > > Emails for some of my systems on the new Xymon server are going out with > bad IPs in them. > > > > The system is correct in hosts.cfg and it seems it is monitoring the > correct host, but when it alerts on it, Xymon puts the wrong IP in the > email and it also puts the wrong IP on the webpage. If I grep for that > incorrect IP, it doesn’t exist in $xymon/server/etc anywhere. > > > > From notifications log I see this: > > Tue Nov 4 15:21:34 2014 DTAMMI-DYN2.conn (XXX.XXX.25.228) EMAIL ADDRESS > > > > But the email it sends out says this: > > System unreachable for 4014 poll periods (1211916 seconds) > > > > &red XXX.XXX.19.160 is unreachable > > > > If I look at the Xymon webpage for it also has this address listed: > > > > XXX.XXX.19.160 is unreachable > > > > Any idea what might be causing this? > > > > Wes Neal > > > >

3 3

Email and website notifications wrong IPs
by wes.neal＠verizon.com 04 Nov '14

04 Nov '14

Emails for some of my systems on the new Xymon server are going out with bad IPs in them. The system is correct in hosts.cfg and it seems it is monitoring the correct host, but when it alerts on it, Xymon puts the wrong IP in the email and it also puts the wrong IP on the webpage. If I grep for that incorrect IP, it doesn't exist in $xymon/server/etc anywhere. >From notifications log I see this: Tue Nov 4 15:21:34 2014 DTAMMI-DYN2.conn (XXX.XXX.25.228) EMAIL ADDRESS But the email it sends out says this: System unreachable for 4014 poll periods (1211916 seconds) &red XXX.XXX.19.160 is unreachable If I look at the Xymon webpage for it also has this address listed: XXX.XXX.19.160 is unreachable Any idea what might be causing this? Wes Neal

1 0

How to handle SSL Cert Clients with same hostname reporting to xymon
by paul＠shadowsoft.com 03 Nov '14

03 Nov '14

Folks, I have a Godaddy cert that is suppose to work on multiple servers BUT they must have the same hostname. If I put the same hostname on the servers the Cert works but xymon is not happy. Is there a way to collect data from 3 different ips that have the same hostname and they report separately? Paul Jordan

2 1

Status propagation
by SKreien＠la-z-boy.com 03 Nov '14

03 Nov '14

Hi Everyone, Wondering if this is possible... I have a series of pages, like so: Xymon.html-->subpage Service1.html -->subpage Pilot Xymon.html-->subpage Service1.html -->subpage UAT Xymon.html-->subpage Service1.html -->subpage Prod Etc... I am currently using the NOPROP tags to keep them from propagating upward, but the problem I have with that tag is that I still want the entire page to change color for hosts on that page. But I don't want the status changes propagating to higher views. What I'd like is for a host on subpage Pilot to be able to turn the Pilot page red including the status on Service1.html, but the status view on the top level Xymon.html page for Service1.html is still green. It makes things stand out a bit more on the actual page without giving false impressions on the top level page. Any ideas if that's possible? Thanks! Scot Kreienkamp This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

1 0

alert for non 200 status from log monitoring
by waa-hobbitml＠revpol.com 01 Nov '14

01 Nov '14

On 10/31/2014 04:39 PM, deepak deore wrote: > Hi, > > I want to trigger alert if there is non 200 status in below tomcat access > logs. I have enabled logs monitoring in client-local.cfg, eg. below log has > non-200 status in 3rd field from last. > > 10.10.10.10 - - [31/Oct/2013:15:45:56 +0000] GET /some/long/url HTTP/1.0 > 404 2531 161 > > How can i define that pattern in analysis.cfg, i can define for 404 as > below but would like to alert for all non 200. > > LOG %/path/to/log_file/access\.[0-9]*-[0-9]*-[0-9]*\.log " 404 " COLOR=red > > Thanks, > Deepak Hi Deepak If you want the test to turn red on any non 200 status, you can omit the COLOR=red because that is the default. You can also leave it for clarity though. :) I think the following will work. Replace your " 404 " with: "%HTTP/1\.(1|0)[[:space:]][345][[:digit:]]{2}[[:space:]][[:digit:]]" That should catch all HTTP/1.0 or HTTP/1.1 requests, followed by a literal space, followed by a 3, or 4, or 5 followed by two more digits (to cover all 300, 400 and 500 series http response codes), followed by a literal space, followed by a digit. If you don't look for the HTTP/1.(0|1) at the front, you will catch all other 300, 400, 500 numbers that are surrounded by spaces in your logs. For example, the size of the request (if it is three digits) which follows the response code in your example. In my Apache log entries, the GET or POST requests are double-quoted like so: .... "GET /wtf HTTP/1.1" 404 270 "-" "Mozilla/5.0 ....." so I could use: "%[[:punct:]][[:space:]][345][[:digit:]]{2}[[:space:]][[:digit:]]" Which ignores the HTTP/1.(1|0) and just catches the closing double-quote after the HTTP/1.0 or HTTP/1.1, the literal space, and then the non-200 response code, followed by a space. Also, you may not want to catch the 300 series response codes because they mainly consist of non-warning or non-critical things like redirects. Hope this helps. -- Bill Arlofski Reverse Polarity, LLC http://www.revpol.com/ -- Not responsible for anything below this line --

1 0