March 2014 - Xymon - Xymon mailman web

Problems with an alarm
by sebastian.schapovalov＠telefonica.com 07 Mar '14

07 Mar '14

Guys, I want to thank you all for the quick help you sent to me.. We resolved the problem. (It was in the 8 layer … me) We made a “friendly” application web that allow us to modify the analisys.cfg file using a intermediate file, but it was recording wrongly the file and when We put max=0 in that app, it put "nothing" into the file… so, when I check the analisys.cfg file, I realized the mistake… I want to apologize for the time I steal to you, and thanks again! Regards! Seba De: Root, Paul T [mailto:Paul.Root at CenturyLink.com] Enviado el: viernes, 07 de marzo de 2014 02:46 p.m. Para: Schapovalov, Sebastian; 'Henrik Størner'; 'xymon at xymon.com' Asunto: RE: [Xymon] Problems with an alarm The example tells me to have max=0 and nothing for min. Example: Check that ONLY ports 22, 80 and 443 are open for incoming connections: # PORT STATE=LISTEN LOCAL=%0.0.0.0[.:].* EXLOCAL=%[.:](22|80|443)$ MAX=0 "TEXT=Bad listeners" From: Schapovalov, Sebastian [mailto:sebastian.schapovalov at telefonica.com] Sent: Friday, March 07, 2014 11:32 AM To: Root, Paul T; 'Henrik Størner'; 'xymon at xymon.com' Subject: RE: [Xymon] Problems with an alarm Hi Paul, We have tried with “min=0 max=0” cause we need this alarm inform us when there are connections, because that servers are in the shutdown process (since 2 months ago) and don’t have to get to connect. PORT LOCAL=%10.20.70.157.* REMOTE=%10.20.32.184.1198* state=ESTABLISHED min=0 max=0 color=red "TEXT=OPGE->Comandos SDP 1 : frontal datos1 vlzfesg16|10.20.70.157: -> vlzfedsdp1|10.20.32.184:1198* " PORT LOCAL=%10.20.70.157.* REMOTE=%10.20.32.185.1198* state=ESTABLISHED min=0 max=0 color=red "TEXT=OPGE->Comandos SDP 1 : frontal datos2 vlzfesg16|10.20.70.157: -> vlzfedsdp2|10.20.32.185:1198* " PORT LOCAL=%10.20.70.157.* REMOTE=%10.20.32.186.1198* state=ESTABLISHED min=0 max=0 color=red "TEXT=OPGE->Comandos SDP 1 : frontal datos3 vlzfesg16|10.20.70.157: -> vlzfedsdp3|10.20.32.186:1198* " De: Root, Paul T [mailto:Paul.Root at CenturyLink.com] Enviado el: viernes, 07 de marzo de 2014 10:34 a.m. Para: Schapovalov, Sebastian; 'Henrik Størner'; 'xymon at xymon.com' Asunto: RE: [Xymon] Problems with an alarm Shouldn’t it be max=0? From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Schapovalov, Sebastian Sent: Friday, March 07, 2014 7:22 AM To: Henrik Størner; xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] Problems with an alarm Hi Henrik, thanks for you quick answer. Analisys.cfg PORT LOCAL=%10.20.170.57.* REMOTE=%10.20.132.84.1198* state=ESTABLISHED min=0 color=red "TEXT=OPGE->Comandos SDP 1 : frontal datos1 fesg16|10.20.170.57: -> fedsdp1|10.20.132.84:1198* " hosts.cfg subpage VLZ_SDP1 <H5>Velez SDP1</H5> group-compress <H5>SDP1 EG:</H5> 0.0.0.0 .default. # REPORTTIME=*:0600:2359 NOPROPRED:* NOPROPPURPLE:* include /home/xymon/server/www/gestion/tmp/hosts.cfg_20140307_VLZ_SDP1_10 group-compress <H5>SDP1 BEsBDs:</H5> All the others alarms run Ok. De: Xymon [mailto:xymon-bounces at xymon.com] En nombre de Henrik Størner Enviado el: viernes, 07 de marzo de 2014 09:46 a.m. Para: xymon at xymon.com<mailto:xymon at xymon.com> Asunto: Re: [Xymon] Problems with an alarm Importancia: Alta Den 2014-03-07 12:47, Schapovalov, Sebastian skrev: Hi! I am Sebastian and I am working actually in Telefonica Argentina. I have a problem with XYMon settings. We have an alarm which shows the ports connections totality to a server. We´d need this alarm turns to red when exists 1 or more connections, but it keeps in green. Send you an example.. [cid:image001.png at 01CF3A15.CF8E56D0] Could you show us what your configuration is - the analysis.cfg and hosts.cfg settings ? Regards, Henrik ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

1 0

Problems with an alarm
by sebastian.schapovalov＠telefonica.com 07 Mar '14

07 Mar '14

Hi! I am Sebastian and I am working actually in Telefonica Argentina. I have a problem with XYMon settings. We have an alarm which shows the ports connections totality to a server. We´d need this alarm turns to red when exists 1 or more connections, but it keeps in green. Send you an example.. [cid:image001.png at 01CF39DF.77F8FB90] I have tried changing the max and min values of connections, I have tried with a negative max value... and others, but I couldn't make it turn it to red. Could you help me? Thanks a lot! ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

3 5

Problems with an alarm
by sebastian.schapovalov＠telefonica.com 07 Mar '14

07 Mar '14

Hi! I am Sebastian and I am working actually in Telefonica Argentina. I have a problem with XYMon settings. We have an alarm which shows the ports connections totality to a server. We´d need this alarm turns to red when exists 1 or more connections, but it keeps in green. Send you an example.. [cid:image001.png at 01CF39E2.38AFA120] I have tried changing the max and min values of connections, I have tried with a negative max value... and others, but I couldn't make it turn it to red. Could you help me? Thanks a lot! ________________________________ Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it. Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

1 0

Downtime for disk check?
by ejacobs＠thomaspublishing.com 06 Mar '14

06 Mar '14

Every morning, sometime between 5 and 7, a particvular machine fills up a disk and then, after a while it goes back down (backups followed by clean up). Can I use "Downtime" for the disk alert? -- Eric Jacobs Thomas Publishing Company Infrastructure and operations Information Technology Group Phone: 215-494-7312 Email: ejacobs at thomaspublishing.com

3 2

clear status when ping is ko
by germain1.malherbe＠orange.com 06 Mar '14

06 Mar '14

Hi All For several reasons, xymonnet is disabled on my Xymon. Another script to check ping connectivity has been coded. This morning, a host has shutdown and the "ping" test has turned red. 30 minutes later, the other local tests for this host have turned clear. I thought it was xymonnet which generate these clear. I can see "Checked with ping: Yes" in the "info" test Is a ping test exists (even if xymonnet is disabled) and, if ko, sends clear status (instead of purple status) for other tests executed on server ? Best Regards -- Germain Malherbe Orange - DSI France/Digital Factory/Hebex Bagnolet +33 1 58 96 62 51 / +33 6 87 66 99 43 germain1.malherbe at orange.com _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 2

Alert testing failing on time criteria
by SKreien＠la-z-boy.com 06 Mar '14

06 Mar '14

Hey everyone, Running into something I don't understand trying to test my alerts.cfg. I have a line in alerts.cfg like so: HOST=lzbs1101.na.lzb.hq SERVICE=ADUsers TIME=*:0000:0800 And I'm trying to test it out using this command line: xymond_alert --test lzbs1101.na.lzb.hq ADUsers --duration=6 --color-red --time=3:0523:0611 And the result I'm getting back is: Failed 'HOST=lzbs1101.na.lzb.hq SERVICE=ADUsers TIME=*:0000:0800' (time criteria) Can someone help me understand why it's not matching on time? I have it set to every day between midnight and 8am in alerts.cfg, and the timeframe I'm trying to test is within that window. So why isn't it matching? Thanks! Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Incorporated ® 1284 North Telegraph Road | Monroe, Michigan 48162 | Phone: 734-384-6403 | Fax: | Email: SKreien at la-z-boy.com<mailto:SKreien at la-z-boy.com> www.la-z-boy.com | <http://www.la-z-boy.com/> facebook.com/lazboy |<http://www.facebook.com/lazboy> twitter.com/lazboy |<http://www.twitter.com/lazboy> youtube.com/lazboy |<http://www.youtube.com/lazboy> This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 2

Another feature wish
by christian.becker＠rhein-zeitung.net 05 Mar '14

05 Mar '14

Hello out there, i'm asking if it would be possible to implement a mechanism to generate a release info for a monitored Linux / Unix client node. For example, that we have the full real name of the operating system, for example on the Info page. For one example out of my currently 101 Linux servers, there's only a line saying simply "SUSE LINUX 11", but if I login to the server and look into the file /etc/issue, I see that the OS relase is "SUSE Linux Enterprise Server 11 SP3". Sure, I could go ahead and write a script that provides me with a separate column containing this info, but i was wondering if it would be easy to implement into the Xymon basics? Regards Christian CHRISTIAN BECKER System Engineer CSC Global Outsourcing Services Central Region | www.csc.com<http://www.csc.com> ________________________________ CSC * This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose * CSC Deutschland Services GmbH * Registered Office: Abraham-Lincoln-Park 1, 65189 Wiesbaden, Germany * Board of Directors: Thomas Nebe, Peter Schmidt * Registered in Germany: HRB 7574, Wiesbaden

2 2

umlauts in xymon
by hj.beckers＠kreis-steinfurt.de 05 Mar '14

05 Mar '14

As the title says: If I enter a "ä" into the following directive "group-only apps|... |ikol|laemmkomm| ..." instead of the "ae" the column is ignored when xymon displays the page. "file" on linux characterizes the file as UTF-8, firefox page information shows the same char set. Coding the "ä" as a html entity makes no difference. Yours Hermann-Josef Beckers

2 3

Server TimeOut
by tawilcox＠fs.fed.us 04 Mar '14

04 Mar '14

We have several web sites we are monitoring. The url for these pages is a login page. All are alerting for "Server Timeout". Is there a way to eliminate this alert and still check to see if the web page is available? Ted This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 2

nosslcert
by tawilcox＠fs.fed.us 04 Mar '14

04 Mar '14

I am just starting out with Xymon and have many questions. The current issue is that I want to suppress the sslcert test on some of my hosts. I have tried adding nosslcert to the host line after the testip keyword. I have tried to drop the test using the ./.xymon 120.0.0.1 "drop HOSTNAME sslcert" command Nothing is working. Ted This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

3 7