May 2014 - Xymon - Xymon mailman web

xymond crashing ~23 hours or so in do_message
by sean.clark＠twcable.com 13 May '14

13 May '14

I am running the latest RH5 32-bit version of JC Cleaver’s excellent packages – however, it is crashing with a sig abrt every day or so, and core dumping. I put on version of xymond that had debugging symbols to make it easier to read, and analyzed the core files It looks to crash on compiling “trends-test” for a host, when a remote host sends “xymondboard” The sigabort comes from —> response = newstrbuffer(lastboardsize); in the code One example: #6 0x08055f4f in do_message (msg=0x7a7cabc0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x22988 <Address 0x22988 out of bounds>, clientsave = 123} infotest = {name = 0xbff5b336 "info", clientsave = 0} logfields = 0x2dbb1e80 havehostfilter = 0 fields = 0x6a5568f “hostname,testname" Another: #6 0x08055f4f in do_message (msg=0x8bddbad0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x208b8 <Address 0x208b8 out of bounds>, clientsave = 123} infotest = {name = 0xbfefb336 "info", clientsave = 0} logfields = 0x13fb0008 havehostfilter = 0 fields = 0x5889672 “hostname,testname,color,acktime,disabletime,cookie,ackmsg,dismsg,lastchange,line1" And a third: #6 0x08055f4f in do_message (msg=0x8001c4c0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x20d40 <Address 0x20d40 out of bounds>, clientsave = 123} infotest = {name = 0xbfd4d336 "info", clientsave = 0} logfields = 0x7debb8f8 havehostfilter = 0 fields = 0x8630217 "hostname,testname" I guess what I am asking is, what are my next steps? Henrik, or JC (or anyone who knows C well) have any ideas? I’ve attached the full core file analysis log files to this message, if that helps, but I don’t know exactly how to proceed. If the origin was just one host, I would think it’s some bad thing happening from the one host, but these three crashes all came from communications from three different hosts, with different field requests to xymondboard Let me know -Sean ________________________________ This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

2 2

Updating Xymon - version 4 or 5?
by john.horne＠plymouth.ac.uk 13 May '14

13 May '14

Hello, On my TODO list is to update Xymon on our servers. We are currently running version 4.3.12. The question is should I update to the current release (4.3.17), or should I wait a bit longer for version 4.3.18 (will that be out soon?) or is version 5 due out any time soon (i.e. next 2 or 3 months)? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

2 1

zonemem.ksh
by everett.vernon＠gmail.com 13 May '14

13 May '14

Hi Roger I think you are looking at 2 separate issues here. The "n/a" in the memory cap is probably showing up because you have no memory cap on that zone. Check this bit of the code. *if [ -z $MEMCAP ]* then MEMFREE=$MEMFREE_GLOBK PCT_USED=$PCT_USEDG *CAP="n/a"* MEMFREEL=$MEMFREE_GLOBK PCT_USED=$PCT_USEDG # No cap, we look at the total free. else The zone name getting truncated has got to do with the string definition, which is important to ensure correct formatting of the displayed output. Check this bit of code. *typeset -L10 ZONE* typeset -R5 MEMCAP SWAPCAP CAP typeset -R6 PCT_USED PCTSWAP typeset -R8 MEMUSED MEMFREE TOTMEMFREE GLOBUSED RSS PCT_USEDG SWAP As you can see, the ZONE(name) is a string, 10 characters long, left justified. Change the L10 to whatever fits for your zone names. L15 will probably work fine. Regards Vernon On 13 May 2014 04:01, Roger Jerdez <rjerdez at gmail.com> wrote: > zonemem.ksh > Author > Vernon Everett <everett.vernon at gmail.com> > Compatibility > Xymon 4.2 > Requirements > It monitors zones, so I guess Solaris is pretty important. > Download > None > Last Update > 2013-08-02 > > > Hi > > Everett, I found a Little issue with the script when it is graphicating > the values for my zones, if the zone has a name more long that 10 > characteres it is showing N/A for the MEMCAP value. Do u have any idea why > is happening in order to modify the script and fix this > > zarespp1 8G 84.14% 1299M 6893M 5.26% | 32G > 71.88% 23G [image: yellow] > zprdaresw n/a 4.77% G 6249M 4.77% | n/a > 30.21% 18G > > zprdaresweb1 the name of the last zone that is not alarmed is zprdaresweb1 > and only is showing zprdaresw and it is not showing the MEMCAP, any idea > > Regards > Roger Jerdez > -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

1 0

flushing rrd files - now possible via rrdcached
by Martin.Sperl＠amdocs.com 09 May '14

09 May '14

There now exists a patch to rrdtool (which has already been merged) that allows xymon to work with the following config-changes: [rrdcache] LOGFILE $XYMONSERVERLOGS/rrdcached.log NEEDS xymond CMD $RRD_BASE/bin/rrdcached -w 1800 -z 900 -f 1800 -l $XYMONVAR/rrdcached/rrdcached.socket -j $XYMONVAR/rrdcached -p $XYMONVAR/rrdcached/rrdcached.pid -g -l 0.0.0.0:41984 -b $XYMONVAR/ -B [rrdstatus] CMD +--no-cache [rrddata] CMD +--no-cache And in the ENVFILE /etc/xymon/xymonserver.cfg add: RRDCACHED_ADDRESS="127.0.0.1:41984" RRDCACHED_STRIPPATH="$XYMONVAR" # these are there to override the default rrd install location # so that it uses the head build from rrdtool RRD_BASE="/opt/rrdtool-1.4.999" LD_LIBRARY_PATH="$RRD_BASE/lib/" The patch to rrdtool: https://github.com/oetiker/rrdtool-1.x/pull/462 has already been incorporated with the main development branch, so I hope it will get into the next rrdtool-1.4 release. Ciao, Martin From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Martin Sperl Sent: Dienstag, 29. April 2014 13:03 To: Jeremy Laidman Cc: xymon at xymon.com Subject: Re: [Xymon] flushing rrd files Thanks - the problem is that those sockets change so you have to "guess" their path and see if it is functional (as with your perl example - in my case there are actually 16 socket files in temp and I have to iterate over all of them to find the 2 that are actually working - slightly stupid...) Obviously this also does not work from a remote node which only has access to the rrd files via NFS... Meaning I have to write a http proxy for that... So I was wondering if xymond_rrd with the --no-cache would use the RRDCache if set in the environment. My guess would be I need to use a different env file which has RRDCACHED_ADDRESS set correctly (which rrdtool makes use of automatically if the ENV is set) and then configure xymond_rrd to use that environment instead.... If that works then that rrd-specific caching could get removed as a whole - with the exception of the need for I just want to avoid testing this on our live system, so I was asking if anyone has experience with this... Martin From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au] Sent: Dienstag, 29. April 2014 04:33 To: Martin Sperl Cc: xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] flushing rrd files I think work would need to be done to integrate with rrdcached. The RRD stats are cached by xymond_rrd. The showgraph.cgi binary sends a flush command to the xymond_rrd instances, via UNIX sockets, requesting a cache flush, so that graphs are up-to-date. You could probably emulate this by running showgraph.cgi from the command-line. Like so: SCRIPT_NAME=showgraph.sh REQUEST_METHOD=GET QUERY_STRING="host=hostname.example.com<http://hostname.example.com>&service=conn" /usr/lib/xymon/server/bin/showgraph.cgi >/dev/null In this case, the "conn" is not used for anything (all RRD files are flushed), but has to be a (I think) valid RRD filename (without the extension) or graph name (defined in graphs.cfg). Also, if you can send a string directly to the two UNIX sockets, you can cause a flush. The format is simply the hostname in slashes, like "/hostname.example.com<http://hostname.example.com>" and so you can probably achieve this using modern versions netcat or socat, or other things that can write to sockets. And just for fun, here's an implementation in Perl. Cheers Jeremy #!/usr/bin/perl -Tw my $hostname=shift; die "Specify hostname\n" unless defined($hostname); my $socketdir=$ENV{XYMONTMP}; die "XYMONTMP not defined, run from xymoncmd\n" unless $socketdir; use Socket; socket(SOCK, AF_UNIX, SOCK_DGRAM, 0) or die "socket: $!\n"; use Fcntl qw(F_GETFL F_SETFL O_NONBLOCK); my $flags = fcntl(SOCK, F_SETFL, O_NONBLOCK) or die "fcntl: $!\n"; opendir(DIR,$socketdir) or die "$!: $socketdir\n"; while(my $socketfile=readdir(DIR)) { next unless substr($socketfile,0,7) eq "rrdctl."; my $socketpath="$socketdir/$socketfile"; if (! -e $socketpath) { warn "not found: $socketpath\n"; next; } if (! -w $socketpath) { warn "not writeable: $socketpath\n"; next; } if (! -S $socketpath) { warn "not a socket: $socketpath\n"; next; } $socketaddr=sockaddr_un($socketpath); if (defined(send(SOCK, "/$hostname/", 0, $socketaddr))) { print "Flush command for '$hostname' sent to $socketfile\n"; } else { warn "Flush command for '$hostname' failed to send to socket $socketfile\n"; } } On 25 April 2014 22:29, Martin Sperl <Martin.Sperl at amdocs.com<mailto:Martin.Sperl at amdocs.com>> wrote: Hi! Is there a means to flush the rrd files filled in from xymond_rrd say via the "xymon" command? As an alternative is it possible to use the generic RRDCACHED as a replacement for the caching? Any experience with that? Thanks, Martin This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

3 7

Xymon on Mac OS X: Time Machine volumes; stopping after IGNORE
by earle＠isolar.DynDNS.ORG 08 May '14

08 May '14

Thanks to Adam Goryachev, Jeremy Laidman, and the mysterious "Paul T Root" at Century Link for responding. I wasn't familiar with EXHOST (more examples in the .cfg files would be helpful, Mr. Author sir), but I used "Paul"'s solution for the Tripwire exclusion and it works great: "For 2, Instead of having tripwire in your defaults, have it in the last entry before defaults like this: HOST=* EXHOST=macmini PROC "/opt/tripwire/te/agent/jre/bin/java" 1 1 red" Thanks for that - I can use it in other places, like on my Linux RAID boxes where all but 2 of them run a 3ware daemon, etc. Anyway, back to Time Machine and volumes with spaces, unfortunately I'm still getting the INODE alerts. I've tried every RE in Jeremy's post and none of them are working. :-( (As Jeremy and "Paul" pointed out, apparently when I am editing files at 4 AM, the dyslexia kicks in and I biffed the RE. Fixed now.) Maybe if I show you the alert message it will help. I'm baffled by the " /Volumes/Time Machine Backups" string construct in the tag I'm seeing, and wondering if that string isn't what is screwing things up with all these RE's I've been trying. - Greg -------- Begin Forwarded Message From: xymon Monitor <xymon at mgmt.my.do.main> Subject: Xymon [169050] macmini:inode CRITICAL (RED) Date: May 8, 2014 3:36:14 PM PDT To: Super User <root at my.do.main> red Thu May 8 15:33:12 PDT 2014 - Filesystems NOT ok &red  /Volumes/Time Machine Backups (97% used) has reached the PANIC level (95%) &yellow  /Volumes/Macintosh HD (93% used) has reached the WARNING level (90%) Filesystem itotal iused ifree %iused Mounted /dev/disk0s2 237145994 178167303 58978691 75% / /dev/disk1s2 244106666 236045350 8061316 97% /Volumes/Time Machine Backups /dev/disk2s2 176632084 164649661 11982423 93% /Volumes/Macintosh HD See http://mgmt/xymon-cgi/svcstatus.sh?HOST=macmini&SERVICE=inode -------- End of Forwarded Message

1 0

https sslcert validation patch
by christoph.maser＠1und1.de 08 May '14

08 May '14

A small patch to enable ssl certificate validation for https... not very polished but a start in case someone wants to go further....

1 0

Xymon on Mac OS X: Time Machine volumes; stopping after IGNORE
by earle＠isolar.DynDNS.ORG 08 May '14

08 May '14

Huge thanks to Henrik for solving my earlier problem with .net alerts. My Linux & Solaris hosts are humming along nicely, but I'm trying to add a few Macs to the soup and have two minor issues to solve. I've installed Xymon on my work Mac as a sandbox for this and here's what I'm running into: (1) My Mac has a Time Machine volume mounted on "/Volumes/Time Machine Backups". It's often close to full and with a high percentage of used inodes: [15:03] macmini:~ % df -h /Volumes/Time\ Machine\ Backups Filesystem Size Used Avail Capacity iused ifree %iused Mounted on /dev/disk1s2 931Gi 900Gi 31Gi 97% 236011707 8094959 97% /Volumes/Time Machine Backups (2) We have Tripwire installed everywhere in a certain path. The Mac does not have it installed. I want Xymon to ignore this and stop, rather than falling down through to the global PROC setting for this path. My RE smack-fu must be sorely lacking in my old age, because this isn't working (in analysis.cfg): HOST=macmini INODE %^*.Time.Machine.Backups IGNORE DISK %^*.Time.Machine.Backups 98 99 PROC "/opt/tripwire/te/agent/jre/bin/java" IGNORE STOP (I'm guessing that in the case of (2), the STOP keyword is not recognized when used in that file. I do see it picking up on the IGNORE in the resultant alert e-mail; but then it falls through to the 2 PROC lines I have at the bottom of the file and I get the alert for no Tripwire anyway.) Any help for mount paths with spaces in them, and ignoring a global PROC setting on an individual host basis? - Greg

4 3

DTS - xymon on centos 6.5 or on scientific Linux?
by dtsmon＠gmail.com 07 May '14

07 May '14

Has anyone installed xymon on cents 6.5 and gotten apache (new) to work? Thanks Tom Schmitt

3 2

Alert ignore question
by Russell.Blumenthal＠stonybrookmedicine.edu 07 May '14

07 May '14

Is it possible to set an alert to ignore only on the first Tuesday and Wednesday of the month between 6-7am? This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by e-mail and destroy all copies of the original.

2 1

Xymon master - slave Setup
by Paul.Root＠CenturyLink.com 07 May '14

07 May '14

So you enable xymond_distribute on the master with the –peer=<address>. And the address being your slave’s ipaddress. Can your master connect to your xymon port on the slave? That is port 1984 by default. Test that with telnet <slave> 1984 Also look at the log file for distribute. Proably $XYMONSERVERLOGS/distribute.log Also, DO NOT remove the entire mailing list from these emails. I don’t know everything, and am often too busy to answer things like this. I assume someone else on the list (often much smarter than me) will pick up the thread. From: Eli [mailto:eliap09 at yahoo.com] Sent: Wednesday, May 07, 2014 10:28 AM To: Root, Paul T Subject: Re: [Xymon] Xymon master - slave Setup Thanks much Paul for feed back so what is the relation with " distribute" I have enabled it set my second xymon as peer but nothing happen keep getting error " peer not found" I can ping and telnet each other but not sure how xymon talk to the peer. Any idea? Again thanks for your time. "Root, Paul T" <Paul.Root at CenturyLink.com<mailto:Paul.Root at CenturyLink.com>> wrote: The secondary machine should have the same hosts.cfg and analysis.cfg. The primaries alerts.cfg should be copied periodically (whenever changed), to the secondary as something like alerts.cfg.primary. Then the secondary has an alerts.cfg file that has one entry in it. And that entry just watches the primary: HOST=xymon1 COLOR=red SERVICE=bbd,conn DURATION>2 SCRIPT /usr/local/scripts/xymSecondaryTakeOver $NG-IM-ONCALL MAIL $NG-IM-ADMIN The script needs to copy the primaries into place. Of course you’ll need another entry in the primary’s alerts.cfg file for the secondary to release when the primary is back online. HOST=xymon1 COLOR=red SERVICE=bbd,conn SCRIPT /usr/local/scripts/xymSecondaryRelease $NG-IM-ONCALL MAIL $NG-IM-ADMIN Which copies the secondary alerts.cfg file back in place. That’s the basics. Other things to think about, is the two talking to each other when you disable or acknowledge alerts. Are your monitored systems going to send to both machines or just one, and the one works as a proxy. How you keep files in sync, etc. In our system, the secondary is actually a proxy server. It can get to some systems the primary can’t get to directly. And there are a few systems the primary can get to that the proxy can’t. Paul. From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Eli Sent: Monday, May 05, 2014 4:35 PM To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Xymon master - slave Setup How I can setup 2 xymon server as slave max/master for fail over? Please advise. Thanks

1 0