March 2014 - Xymon - Xymon mailman web

Suggestions for tablet solution for Xymon monitoring
by jlaidman＠rebel-it.com.au 04 Apr '14

04 Apr '14

Hi If you had a budget to buy some tables for support staff, what would be your "solution". I know of (but have no experience with) an Android Xymon app. I've found nothing for IOS. But perhaps it shouldn't matter what the device is, as long as it has a reasonable screen size and a browser, and probably SIM slot for GSM/LTE data. Cheers Jeremy

2 2

Item "PROCS" not complete
by sidiney＠redix.com.br 02 Apr '14

02 Apr '14

I have a problem and i'm unable to resolve . Under " PROCS " , sometimes the Xymon just not sending the message completely , as follows: Problem situation : Accuse as if they were not running , and the list of processes does not come entirely. Wed Mar 12 09:46:48 EDT 2014 - Processes NOT ok green udevd (found 3 , req . 1 or more) green sshd (found 1 , req . 1 or more) green master ( found 1 , req . 1 or more) green crond (found 1 , req . 1 or more) red clamd (found 0 , req . 1 or more) green amavisd (found 3 , req . 1 or more) red xinetd (found 0 , req . 1 or more) red slapd (found 0 , req . 1 or more) green rsyslogd (found 1 , req . 1 or more) green ntpd (found 1 , req . 1 or more) USER PID PPID PRI STARTED S % CPU % MEM TIME RSZ VSZ CMD Oct 03 1 0 root S 19 0.0 00:00:07 0.0 1396 19352 / sbin / init Postfix 08:34:26 453 21763 S 19 0.0 00:00:00 0.0 5376 98228 smtpd -n [ 127.0.0.1 ] : 10025 - t inet - u-o content_filter = -o = -o local_recipient_maps virtual_mailbox_maps = virtual_alias_maps = -o it relay_recipient_maps smtpd_restriction_classes = it = it = in - the smtpd_delay_reject smtpd_client_restrictions = permit_mynetworks , reject it smtpd_data_restrictions smtpd_end_of_data_restrictions = it = it = it smtpd_helo_restrictions smtpd_milters smtpd_sender_restrictions = it = it = in - the smtpd_reject_unlisted_sender smtpd_relay_restrictions = - the smtpd_recipient_restrictions = permit_mynetworks , reject- the mynetworks_style = host mynetworks = 127.0.0.0 -o / 8 , [ :: 1 ] / 128 = yes it strict_rfc821_envelopes it smtpd_error_sleep_time = 0 it smtpd_soft_error_limit = 1001 = 1000 it smtpd_hard_error_limit it smtpd_client_connection_count_limit = 0 = 0 it smtpd_client_connection_rate_limit it receive_override_options = no_header_body_checks , no_unknown_recipient_checks , no_address_mappings it local_header_rewrite_clients = it = syslog_name postfix / amavisd Postfix 09:39:49 553 21763 S 19 0.0 00:00:00 0.0 3300 51276 smtp- t unix - u Oct 03 558 1 root S 23 0.0 00:00:00 0.0 316 10908 / sbin / udevd - d Oct 03 988 558 root S 21 0.0 00:00:00 0.0 336 10904 / sbin / udevd - d 03 Oct 1430 1 root S 19 0.0 0.0 3344 185132 01:57:04 / usr / sbin / vmtoolsd 03 Oct 1547 1 root S 19 0.0 02:30:58 0.0 6068 256212 / sbin / rsyslogd -i / var / run / c - syslogd.pid 5 03 Oct 1595 1 root S 19 0.0 00:01:35 0.0 1288 452264 automount - pid - file / var / run / autofs.pid 03 Oct 1616 1 root S 19 0.0 00:00:07 0.0 616 66252 / usr / sbin / sshd Ntp 03 Oct 1632 1 S 19 0.0 00:00:12 0.0 1132 25936 ntpd - u ntp : ntp - p / var / run / ntpd.pid - g 03 Oct 1687 1 root S 19 0.0 00:03:08 0.0 784 117280 crond Postfix 09:07:23 1731 21763 S 19 0.0 00:00:00 0.0 6240 100456 465 smtpd -n - t inet - u - stress = -o content_filter = scan : [ 127.0.0.1 ] : 10030 -o = yes smtpd_tls_wrappermode it smtpd_sasl_auth_enable = yes it smtpd_client_restrictions = it = smtpd_data_restrictions it smtpd_helo_restrictions = it = smtpd_recipient_restrictions = permit_sasl_authenticated smtpd_relay_restrictions it , reject it syslog_name = postfix / smtps it milter_macro_daemon_name = ORIGINATING 03 Oct 1749 1 root S 19 0.0 00:00:01 0.0 544 100924 rhnsd Zimbra Mar 1761 30637 07 S 19 0.1 00:07:51 0.1 26904 784316 / opt / zimbra / opendkim / sbin / opendkim -x / opt / zimbra / conf / opendkim.conf - u zimbra 03 Oct 1793 1 root S 19 0.0 0.0 492 103888 00:00:00 / usr / bin / rhsmcertd Zimbra Mar 1 3534 10 S 19 0.0 00:00:19 0.6 100476 217852 / opt / zimbra / amavisd / sbin / amavisd ( master) 03 Oct 4469 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty1 03 Oct 4499 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty2 03 Oct 4504 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty3 03 Oct 4509 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty4 Oct 03 4515 558 root S 21 0.0 00:00:00 0.0 328 10904 / sbin / udevd - d 03 Oct 4546 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty5 03 Oct 4560 1 root S 19 0.0 00:00:00 0.0 464 4060 / sbin / mingetty / dev/tty6 Has anyone experienced this and know how to treat?

4 13

File Modification Time problem
by Carl.Inglis＠rakon.com 01 Apr '14

01 Apr '14

Hi, I'm running Xymon 4.3.17 under Slackware Linux 32bit. I have a couple of files on a Windows box which are being checked for modification time. (They act as heartbeat files for an in-house developed process) They are reporting: [[file 1]] File was modified 4294963721 seconds ago - should be <3600 [[file 2]] File was modified 4294963853 seconds ago - should be <1800 As far as I can tell the numbers being given are the maximum value of an unsigned 4 byte integer less the actual value of the modified time difference. The file information in the client data is: [file:file 1] type:0x00020 (file) mode:777 (not implemented) linkcount:1 owner:0 (not implemented) group:0 (not implemented) size:22 atime:1396262142 (2014/03/31-10:35:42) ctime:1389871880 (2014/01/16-11:31:20) mtime:1396262142 (2014/03/31-10:35:42) [file:file 2] type:0x00020 (file) mode:777 (not implemented) linkcount:1 owner:0 (not implemented) group:0 (not implemented) size:21 atime:1396262010 (2014/03/31-10:33:30) ctime:1392825988 (2014/02/19-16:06:28) mtime:1396262010 (2014/03/31-10:33:30) The date and time on both the Windows PC and the Xymon server have correctly been adjusted for DST (automagically). However DST is implicated since the problem started happening at ~02:02 on Sunday morning when the UK switched to British Summer Time. I've restarted the Xymon processes, and restarted the BBWin process, to no effect. My search through lists.xymon.com hasn't returned anything that appears relevant, although obviously I may have missed something. Any pointers as to how I can continue to debug this, or thoughts on how to fix it, would be appreciated. Thanks, Carl Carl Inglis Systems Administrator Rakon UK Limited Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 1522 812630 | Fax: +44 1522 812664 | Mob: +44 7786 552915 Carl.Inglis at rakon.com | www.rakon.com [The Queens Awards for Enterprise 2012] [Rakon Logo] This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments. Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090. Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content.

1 1

class= in analysis.cfg
by KK1051＠att.com 31 Mar '14

31 Mar '14

I am using the CLASS= option in the client-local.cfg and in analysis.cfg. The file options from client cfg get pushed to the client ok and proper logs are collected. When I work with the analysis.cfg file it is not triggering on the keywords and color for the log files. I use the Xymon_client -test and this works my rules properly trigger on the test keywords. I am using 4.3.10 on server and 4.3.12 on client. I am preparing to upgrade server and client to 4.3.17. I see in the notes that .14 to .16 had some work in this area. So is it me or is the upgrade my solution? Kevin H. King Implementations "You can not please everyone everyday, But everyday please everyone you can" -me

2 2

analysis.cfg not working?
by sean.clark＠twcable.com 31 Mar '14

31 Mar '14

Have an odd thing that popped up with analysis.cfg I renamed all of my groups in hosts.cfg so that everything was consistent – then tried this in analysis.cfg: DISPLAYGROUP="Bastion" PROC /usr/bin/pt-heartbeat 2 8 red However, this PROC got applied to all hosts in the hosts.cfg (and procs went red for ~800 hosts or so, until I removed it) Is it an issue with analysis.cfg? Or because I use the group bastion several times in hosts.cfg, or? Snippet of hosts.cfg: group Script Servers 0.0.0.0 some.VIP.that.monitored.elseware # NET:tools-mon page Oceanic group Bastion 10.249.5.8 monitor-01.somedomain.com # NET:oceanic-mom group Web Servers 10.249.5.2 web-01.somedomain.com # NET:oceanic-mom page rio-texas RIO Production Servers group VIP 0.0.0.0 anotherVIP.monitored.elseware# NET:xymon-server group Bastion 127.0.0.1 rio-monitor-01.somedomain.com # NET:rio-tex ________________________________ This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

2 3

Add block of text below graph?
by john.horne＠plymouth.ac.uk 31 Mar '14

31 Mar '14

Hello, We are using Xymon 4.3.12, and would like to graph some stats from our (Shibboleth) authentication system - typically the number of users authenticated etc. However, is it possible to add a block of dynamic text below the graph (below the axis label)? We would like a small table showing the top ten sites that users have logged in to at that time. This could be plain text, but could be an HTML table. Is that possible? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 2

Service smtp on hostname is not OK : Unexpected service response
by henrik＠hswn.dk 31 Mar '14

31 Mar '14

Den 2014-03-25 16:54, Wilcox, Theodore A -FS skrev: >> >> Which SMTP server software are you using? >> > These are Domino and Lotus Notes servers running on AIX. okay, that's a bit unusual. Might be why it hasn't shown up before. Would it be possible for you to do a network "snif" of the traffic between Xymon and these servers? E.g. on the Xymon server run "tcpdump -s 1500 -w xymon-smtp.dump host <ip-of-smtp-server> and tcp port 25". (Assuming this is not encrypted smtp). Thanks, Henrik

4 4

Xymon RPM repo
by colin.coe＠gmail.com 30 Mar '14

30 Mar '14

Hi Japheth Just wondering if you could split the 32 and 64bit RPMs into separate repos? Something like http://terabithia.org/rpms/xymon/el5/x86_64 for 64bit and http://terabithia.org/rpms/xymon/el5/i386 for 32bit I ask as I've just spent a bit of time trying to workout why my 64bit servers we preferring the 32bit xymon-client RPM. Thanks CC -- RHCE#805007969328369

3 3

xymongrep for windows
by abs＠shadymint.com 29 Mar '14

29 Mar '14

Hi, Has anyone already attempted to compile xymongrep as a standalone windows program under MinGW or some such? I am looking to add externals under BBWin and have these externals configured from etc\hosts.cfg to make them as much like native Unix extensions as I can. Thanks -- Andy

3 6

ORA tests with xymon
by tawilcox＠fs.fed.us 28 Mar '14

28 Mar '14

The hosts file from Big Brother had the keyword "ora" for testing the oracle port. Xymon just missed an oracle server failing that test in Big Brother. We just copied the hosts.cfg file from one to the other, for the most part. So the oracle servers still have the key word "ora" in them. Reading the man pages it shows an oracle ping test as "oratns". Is this the same test as "ora" in BB? The alert had cleared in BB by the time I found this, so I can't test it. Do I need to change all of the "ora" keywords to "oratns"? Ted [USDA USFS] Theodore (Ted) Wilcox, PMP , ITIL Incident Management Program Manager, EOC Monitor CIO/EOC USDA Forest Service p: 505-500-7648 tawilcox at fs.fed.us 100 Sun Avenue NE Albuquerque, NM 87109 www.fs.fed.us<http://www.fs.fed.us/> [Twitter]<https://twitter.com/forestservice>[Facebook]<http://facebook.com/USDA> Caring for the land and serving people This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 1