April 2014 - Xymon - Xymon mailman web

report example
by KVerMeer＠peoplenetonline.com 22 Apr '14

22 Apr '14

I would like to create a report (if it does not already exist) that calculates red/green time for a given service for a given date range for ALL client machines configured. Or possibly a subset of clients if that is also doable. This is for an end-of-month type report. Percentages as well as total times would be great. For example. Service = conn Start = 4/1/14 00:00:00 End = 4/30/14 23:59:59 Output would be: Client1 Green: 0/0% Red: 43200/100% Client2 Green: 21600/50% Red: 21600/50% Clent3 Green: 42200/97.685% Red: 1000/2.315% .... Total Green: xxxxx/xx.xxx% Red: yyyyy/yy.yyy% Is this type of report (easily) doable? Any pointers on the best way to so such a report would be appreciated.

1 0

BB to Xymon - "[machine].net stopped reporting (PURPLE)" alerts
by earle＠isolar.DynDNS.ORG 19 Apr '14

19 Apr '14

Over the past couple of months I've been transitioning my site away from an old Big Brother installation over to Xymon 4.3.12. There's only one small problem left that I'm dealing with. At one point, I switched the BBDISPLAY server in the Big Brother "bb-hosts" file from our old (now deprecated) Big Brother server and pointed it at our new Xymon server. For awhile both kept on running and only a few machines had their Big Brother clients restarted in the interim, which caused them to start reporting in to the Xymon server instead. Our Big Brother setup used the "netstat.sh" extension to send in "netstat -i" results to BB. So these systems that got restarted began to send the same data to Xymon via their Big Brother client. Now I've completed the transition and Big Brother has been shut off everywhere. As a result for these 4 particular hosts that had BB restarted, now Xymon is complaining hourly with Subject: Xymon [NNNNNNN] [machine].net stopped reporting (PURPLE) messages containing the last "netstat -i" output it received. I thought the raw data sent from a Xymon client already included "netstat -i" output, so I thought the server would just get that info from the clients now? At any rate, some file(s) somewhere clearly has kept state thinking it should still be being sent the "netstat -i" output; how do I track down where they are so I can get these alerts to stop? Thanks, - Greg

2 1

AUTO: Jason Jones is out of the office (returning 28/04/2014)
by jason.jones＠codelsoftware.com 17 Apr '14

17 Apr '14

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20140417/bb3fb20c/attach…>

1 0

Fwd: Re: Subject: Re: SSL OCSP monitoring
by ralphmitchell＠gmail.com 16 Apr '14

16 Apr '14

Resending because it didn't go to the mailing list. I don't remember why it was deemed a good idea not to direct replies to the list by default. I wonder how many conversations have "gone off list" like this without the participants noticing?? Ralph Mitchell ---------- Forwarded message ---------- From: "Ralph Mitchell" <ralphmitchell at gmail.com> Date: Apr 16, 2014 7:23 AM Subject: Re: [Xymon] Subject: Re: SSL OCSP monitoring To: "Steff Watkins" <s.watkins at nhm.ac.uk> Cc: OCSP is a little different to expiry - it's for checking that the certificate has not been revoked. Say you have some kind of national ID card with certificate and key issued by a nationwide trusted entity. You could use it to access banking and health services, sign documents, encrypt email, etc. If the card is lost or stolen, you call it in, the certificate is revoked and they send you a new one. If the stolen card is subsequently used to try to gain access to your bank account, the bank calls an OCSP responder to validate the card and then rejects it. Clients, such as web browsers, can do the same to check if server certificates have been revoked before trusting them. I'm not sure what anyone would gain from testing revocation status, given that you're generally monitoring certs on your own network and servers. Ralph Mitchell On Wed, Apr 16, 2014 at 5:40 AM, Steff Watkins <s.watkins at nhm.ac.uk> wrote: > > Hi, > > > > Can we monitor SSL certificate's revoke status ? > > > > Thanks, > > Deepak > > Hello Deepak, > > Not sure if this is what you're after but I've found a way of getting > Xymon to give yellow alerts when the SSL certificate on a webserver has 30 > days (or less) until expiry, and red alerts on 14 days (or less). > > The first part is to give a secure URL in the comment section of the host > definition in the hosts.cfg file, such as: > > 192.168.12.12 www # conn ssh http://www. yabadabadoo.blah.uk/ > https://yabadabadoo.blah.uk/ > > This tells Xymon to check the secure HTTP instance on, in this case, > www.yabadabadoo.blah.uk . So it picks up the SSL certificate and reports > on its presence. This should create an "sslcert" column on your Xymon > display. You can view the retrieved certificate in that column. > > However the next step is needed if you wanted alerts raised when an SSL > certificate is getting near expiry date. > > In the tasks.cfg file you need to setup a clause to force the system to > raise a warning if the SSL certificate gets near expiry date. I have done > this by adding the "sslwarn" and "sslalarm" options to the definition for > xymonnet. > > The actual definition I am using is shown below: > > ----- > [xymonnet] > ENVFILE /usr/local/hobbit/server/etc/xymonserver.cfg > NEEDS xymond > CMD xymonnet --no-ares --report --ping --checkresponse > --sslwarn=30 --sslalarm=14 '--dnslog=/var/log/xymon/dns.log' > '--concurrency=5' '--debug' '--dump=both' > LOGFILE $XYMONSERVERLOGS/xymonnet.log > INTERVAL 5m > ----- > > As you can see I have '-sslwarn=30' which causes the sslcert column for a > host to go yellow when the SSL certificate for that host has 30 days or > less until expiry. The '--sslalarm=14' raises the alert level to red when > there is 14 days or less until the SSL certificate's expiry date. > > I have this running in a live environment at the moment and can confirm > that it does work. I'm fairly sure that you should be able to use this sort > of setup for testing the revocation dates of SSL certificates for other > protocols, such as secure smtp. > > Hope this helps. > > Regards, > Steff Watkins > ----- > Steff Watkins Natural History Museum, Cromwell > Road, London,SW75BD > Systems programmer Email: s.watkins at nhm.ac.uk > Systems Team Phone: +44 (0)20 7942 6000 opt 2 > ======== > "Many were increasingly of the opinion that they'd all made a big mistake > in coming down from the trees in the first place. And some said that even > the trees had been a bad move, and that no one should ever have left the > oceans." - HHGTTG > > > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

Subject: Re: SSL OCSP monitoring
by s.watkins＠nhm.ac.uk 16 Apr '14

16 Apr '14

> Hi, > > Can we monitor SSL certificate's revoke status ? > > Thanks, > Deepak Hello Deepak, Not sure if this is what you're after but I've found a way of getting Xymon to give yellow alerts when the SSL certificate on a webserver has 30 days (or less) until expiry, and red alerts on 14 days (or less). The first part is to give a secure URL in the comment section of the host definition in the hosts.cfg file, such as: 192.168.12.12 www # conn ssh http://www. yabadabadoo.blah.uk/ https://yabadabadoo.blah.uk/ This tells Xymon to check the secure HTTP instance on, in this case, www.yabadabadoo.blah.uk . So it picks up the SSL certificate and reports on its presence. This should create an "sslcert" column on your Xymon display. You can view the retrieved certificate in that column. However the next step is needed if you wanted alerts raised when an SSL certificate is getting near expiry date. In the tasks.cfg file you need to setup a clause to force the system to raise a warning if the SSL certificate gets near expiry date. I have done this by adding the "sslwarn" and "sslalarm" options to the definition for xymonnet. The actual definition I am using is shown below: ----- [xymonnet] ENVFILE /usr/local/hobbit/server/etc/xymonserver.cfg NEEDS xymond CMD xymonnet --no-ares --report --ping --checkresponse --sslwarn=30 --sslalarm=14 '--dnslog=/var/log/xymon/dns.log' '--concurrency=5' '--debug' '--dump=both' LOGFILE $XYMONSERVERLOGS/xymonnet.log INTERVAL 5m ----- As you can see I have '-sslwarn=30' which causes the sslcert column for a host to go yellow when the SSL certificate for that host has 30 days or less until expiry. The '--sslalarm=14' raises the alert level to red when there is 14 days or less until the SSL certificate's expiry date. I have this running in a live environment at the moment and can confirm that it does work. I'm fairly sure that you should be able to use this sort of setup for testing the revocation dates of SSL certificates for other protocols, such as secure smtp. Hope this helps. Regards, Steff Watkins ----- Steff Watkins Natural History Museum, Cromwell Road, London,SW75BD Systems programmer Email: s.watkins at nhm.ac.uk Systems Team Phone: +44 (0)20 7942 6000 opt 2 ======== "Many were increasingly of the opinion that they'd all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans." - HHGTTG

1 0

SNAPSHOT Report and Historical Report not synched?
by David.Diep＠dc.gov 16 Apr '14

16 Apr '14

Hi everyone, When I am on 'Current Status' and select the 'cpu' report, it gives me current information, which is the output of the top command. But when I go to the Snapshot Report and go to older date and select the 'cpu' report, it returns with a date that is not that of what I selected for the Snapshot Report. Is this a bug or is it by design? Is there a way to sync the Snapshot report and the other historical reports? Thanks! David

2 1

recurring email alerts - SOLVED
by JAlexander＠feeneywireless.com 15 Apr '14

15 Apr '14

Okay, this is embarrassing, but I'll post anyway in case someone runs into this. I had originally installed Big Brother and BB clients. Then I migrated to Xymon. On the two systems in question, I had neglected to turn off and remove the BB clients. So.. I had 2 applications - only one of which had permissions to /var/log/messages and was getting flapping status. bbc up at the top of the chkconfig printout and xymon-client down at the bottom. I found it after turning the xymon-client off on one of the server and observing new messages saying that /var/log/messages was unreadable. Light bulb!! John A. From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of John D. Alexander Sent: Tuesday, April 15, 2014 8:06 AM To: xymon at xymon.com Subject: Re: [Xymon] recurring email alerts I've checked all of my systems and no misconfigurations like that. I also disabled the msgs report on the server and cleared all of the msgs status for the two servers and they are still reporting the issue of not being able to read log files. I guess the next thing is to clear the entire host off the server and wait to see what happens. John A. From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Adam Goryachev Sent: Monday, April 14, 2014 4:38 PM To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] recurring email alerts On 15/04/14 01:14, John D. Alexander wrote: I'm at a loss. Now I've got a client reporting /var/log/messages as unreadable and the server is showing a flapping status for msgs. Group ownership for /var/log/messages is set to root:xymon with proper permissions, so it should be able to read it. When I su to the xymon user, it can get to that file just fine. Look at the IP address reporting the issue, possibly you have two systems reporting under the same name. Regards, Adam There is nothing in analysis.cfg that is watching either /var/log/messages or /var/log/fail2ban. I cleared msgs from the server. Restarted the client. The issue keeps coming back. Any ideas? John A. From: Betsy Schwartz [mailto:betsy.schwartz at gmail.com] Sent: Friday, April 11, 2014 6:44 PM To: John D. Alexander Cc: xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] recurring email alerts I had that error once when I had a space after the file name in analysis.cfg If you can't find that file name maybe there's a shell eval that includes it somewhere? Sent from my iPhone On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <JAlexander at feeneywireless.com<mailto:JAlexander at feeneywireless.com>> wrote: My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable. Nothing I can find is testing for this file and the permissions are such that xymon can read it. Any clues on where to look to find what is causing this? Thanks. John Alexander Network Administrator John.Alexander at feeneywireless.com<mailto:John.Alexander at feeneywireless.com> Feeney Wireless, LLC - PO Box 2549, Eugene, Oregon 97402 (Free) 800-683-4818 (P) 541-685-9045 (F) 541-284-0030 www.feeneywireless.com<http://www.feeneywireless.com/> <image001.jpg><http://feeneywireless.com/> This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately. _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon -- Adam Goryachev Website Managers www.websitemanagers.com.au<http://www.websitemanagers.com.au>

1 0

new to Xymon
by Durk.Hempenius＠1850.nl 15 Apr '14

15 Apr '14

Afternoon, I am new to Xymon monitoring and i have a problem. The xymon monitoring we are using worked perfect until yesterday. One of the linux clients which is monitored by xymon doesn't give any report any more about cpu and disk and so on, the conn check is just working fine. This happened after de client yesterday afternoon needed a hard reboot. Is their a way I can reset it so everything goes back to green again?? I really appreciate if someone can help me out with this. Thanks in advance Durk Hempenius Voice Data Bridge B.V. Marathon 11F 1213 PG Hilversum E T F Durk.Hempenius at 1850.nl +31 88 1850 150 +31 88 1850 199 [cid:image001.png at 01CF58C7.30F061F0]<http://www.voicedatabridge.com/> De informatie verzonden met dit e-mailbericht (en bijlagen) is uitsluitend bestemd voor de geadresseerde(n)en zij die van de geadresseerde(n) toestemming kregen dit bericht te lezen. Gebruik door anderen dan geadresseerde(n) is verboden. De informatie in dit e-mailbericht (en bijlagen) kan vertrouwelijk van aard zijn en kan binnen het bereik vallen van een geheimhoudingsplicht en een verschoningsrecht. Wanneer u een e-mailbericht ontvangt dat niet voor u is bestemd, informeer de afzender hier direct over en verwijder aub het bericht. Any information transmitted by means of this e-mail (and any of its attachments) is intended exclusively for the addressee or addressees and for those authorized by the addressee or addressees to read this message. Any use by a party other than the addressee or addressees is prohibited. The information contained in this e-mail (or any of its attachments) may be confidential in nature and fall under a duty of non-disclosure and the attorney-client privilege. If you are not the intended recipient, you are requested to inform the sender of this e-mail message of this immediately, and to destroy the original e-mail communication.

3 3

recurring email alerts
by betsy.schwartz＠gmail.com 15 Apr '14

15 Apr '14

I had that error once when I had a space after the file name in analysis.cfg If you can't find that file name maybe there's a shell eval that includes it somewhere? Sent from my iPhone > On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <JAlexander at feeneywireless.com> wrote: > > My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable. > > Nothing I can find is testing for this file and the permissions are such that xymon can read it. > > Any clues on where to look to find what is causing this? > > Thanks. > > John Alexander > Network Administrator > John.Alexander at feeneywireless.com > Feeney Wireless, LLC - PO Box 2549, Eugene, Oregon 97402 > (Free) 800-683-4818 (P) 541-685-9045 (F) 541-284-0030 > www.feeneywireless.com > <image001.jpg> > This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately. > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

3 3

DEVMON on cisco 3750
by psmzkk＠gmail.com 15 Apr '14

15 Apr '14

Hi, My cisco switch and my xymon server are well config to received the snmp trape When I launch ./devmon --readbbhosts -vvv , I have : [14-04-15 at 12:34:10] Checking if #conn DEVMON:cid(public) matches NET:. then [14-04-15 at 12:34:10] Querying pre-existing hosts [14-04-15 at 12:34:10] Discovered MYHOSTNAMESWITCH as a cisco 3750 [14-04-15 at 12:34:10] Received signal TERM, shutting down with return code 0 So he can find the hardware version from my snmp host. More information in my devmon log: cat /var/log/devmon.log [14-04-08 at 10:23:54] Cant write to pidfile /var/run/devmon/devmon.pid (No such file or directory) However I have no ID to have the information on my web interface. Thanks you for your help ! Best Regards, Alexandre 2014-04-15 15:14 GMT+02:00 Novosielski, Ryan <novosirj at ca.rutgers.edu>: > There was nothing special about configuring devmon to work with this > device as I recall -- I followed the instructions and it works well. > > > *From*: psMz [mailto:psmzkk at gmail.com] > *Sent*: Tuesday, April 15, 2014 06:24 AM > *To*: xymon at xymon.com <xymon at xymon.com> > *Subject*: [Xymon] DEVMON on cisco 3750 > > Hello everyone, > > Someone have a process to install and configure DEVMON, > > > Thanks, > > Best Regards, > Alexander >

2 1