June 2014 - Xymon - Xymon mailman web

Xymon alerting on acknowledged events
by feld＠feld.me 06 Jun '14

06 Jun '14

Hi all, Our xymon server seems to disobey acknowledged events and still alert anyway. If we mark it blue to disable the service it will stop alerting us. We've seen this behavior before a long time ago and the fix was possibly a missing directory or something to that effect but we cannot seem to find it on Google nor locate it in our notes / ticketing system. Too much noise in there from the word "xymon". Any hints? Thanks

3 4

PfSense firewall client
by kspringer＠innovateteam.com 06 Jun '14

06 Jun '14

Thanks for the tip. I got it working pretty quickly with that. :) Now I just need to figure out how to get it to run at startup without me logging into the console and manually starting it. Anyone know how to do that on a PfSense OS? Thank you. ------------------------------------------------ Kris Springer From: Dernier Rondón [mailto:darc7983 at gmail.com] Sent: Thursday, February 20, 2014 11:45 AM To: Kris Springer Cc: Xymon MailingList Subject: Re: [Xymon] PfSense firewall client I hope this helps, pfsense forum mentioned step by step how to install the client XyMon for pfsense (thanks gwhynott). You need only modify files that are in "/usr/local/www/xymon/client/etc" then start the service ./runclient.sh start Regards! 2014-02-20 14:44 GMT-04:30 Kris Springer <kspringer at innovateteam.com <mailto:kspringer at innovateteam.com> >: Ive got some PfSense firewalls that I would love to have running with xymon client. Anyone have a step-by-step guide to get this working? PfSense is BSD. Thank you. ------------------------------------------------ Kris Springer _______________________________________________ Xymon mailing list Xymon at xymon.com <mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon -- -- Dernier Rondón Linux Counter reg# 473239 Machine's counter reg# 381205

2 1

Why Xymon?
by david.gore＠verizon.com 06 Jun '14

06 Jun '14

Hi All, We are being asked "Why Xymon?". We have some answers but I was hoping someone else may have been more eloquent and articulate than myself in defending the use of Xymon. Perhaps you could share your wisdom? We started using Xymon when we lost our first level 24x7 monitoring group and have not looked back since. Now we are being asked to use an in-house application and offshore assets. Some of the Xymon features we like are: *big picture of all our apps via the nonongreen page, application, OS, network and databases monitored *graphing and historical trending *ease of use *light weight/low resource *multiple scripting languages support (any) *redundant (warm standby) *cost (free) thanks Henrik and everyone else *support via the mailing list, We have been using Xymon from the beginning back in 2005. Before using Xymon/Hobbit we used Big Brother. Thanks in advance for any advice. ~David W Gore

8 8

Fwd: WAN performance/monitoring
by jlaidman＠rebel-it.com.au 06 Jun '14

06 Jun '14

Whoops, forgot to CC this to the list. I hate it when that happens. So in case it helps someone else, my off-list email is below. And just for the record, I still reckon Smokeping is the go. I see no reason why it wouldn't detect a lot of transient errors, more likely if you adjust the parameters for step and ping count. There's no way of guaranteeing that you would see a transient error, unless you happen to be sending every packet received by the device you're testing! Instead you should be monitoring the error rates on the switch port and the device NIC, probably using SNMP. ==== Adam On Thursday, 5 June 2014, Adam Goryachev < mailinglists at websitemanagers.com.au> wrote: > > Specifically, I now want to record at least the following data into RRD's > for later viewing: > 1) Maximum ping time per minute > 2) Average ping time per minute > 3) Minimum ping time per minute > 4) Packet loss per minute Seems to me that this is exactly what Smokeping can provide for you. Have a look at the demo site, drill down to a single device, and have a look at the graphs. eg: http://oss.oetiker.ch/smokeping-demo/?target=Customers.OP.octopus One thing that does happen is obviously drift, ie, the processing time of > my script will take a fraction of a second, so I won't really get a value > for every single second One way to overcome this is to run the probe in background, so that it doesn't really matter how long it takes (as long as you're not accumulating processes over time). Like this: #!/bin/sh doping() { ... } while true; do SECONDS=`date +%s` # in case not bash sleep `expr 60 - $SECONDS % 60` doping >> /var/log/pingmon.log & done This runs the subroutine do_ping in the background, but first waits how ever long it needs until the clock ticks over for the next minute. You would always have the subroutine run at the start of the minute. Cheers Jeremy

1 0

WAN performance/monitoring
by mailinglists＠websitemanagers.com.au 05 Jun '14

05 Jun '14

Hi All, First some background, then sharing some scripts I've written/used, and finally asking for some advice please. Some time ago I was having a LAN issue (dropped packets) which I wrote a small script to measure, and quantify the problem. (If you can't see the problem, you can't fix it, and you can't prove it is fixed afterwards). All the script did was use fping to ping a group of IP's once per second, then every minute it would record a log of the date/time plus one line for each IP that had one or more dropped packets. This worked nicely for the above purpose, allowing me to easily pinpoint the common machines experiencing the problem, and then eventually solve it. Now I'd like to extend the script to cover my WAN connections, but I also need more information, and don't want to re-invent the wheel. So, I'm looking for suggestions on how to implement what I need, and/or other products that already do this. Specifically, I now want to record at least the following data into RRD's for later viewing: 1) Maximum ping time per minute 2) Average ping time per minute 3) Minimum ping time per minute 4) Packet loss per minute Now the first three could be done by using my script to calculate the value and then record those three values per minute, or I could record 60 values per minute and let RRD do the calculation. One thing that does happen is obviously drift, ie, the processing time of my script will take a fraction of a second, so I won't really get a value for every single second, but then that is probably overkill anyway, if I can get one value for 99% of seconds, then I should get a clear picture of my links, performance, and any issues. The second part of this question is what values for the above 4 things do you use for xymon as alarms? What is acceptable, what is marginal, and what is downright awful? In my case I'm using connections for RDP (Windows Remote Desktop). BTW, currently the script doesn't actually integrate with xymon, that is still doing it's own standard network ping monitoring, but obviously this is a lot more intense/detailed, and I'd like to integrate the result (to get alerting/history/etc). The current script I'm using which is started by /etc/rc.local at boot with "nohup /usr/local/bin/pingmon.sh >> /var/log/pingmon.log #!/bin/bash HOSTLIST="x.x.x.10 x.x.y.254 x.x.z.254" HOSTLIST=$HOSTLIST function doping { START=`date '+%Y%m%d-%H:%M:%S'` result=`fping -C 60 -q ${HOSTLIST} 2>&1` echo "${result}" | grep -q -- - 2>&1 > /dev/null res=$? if [ $res == 0 ] then echo -en "${START}\n${result}" | grep -- - else echo "${START}" fi } while /bin/true do doping >> /var/log/pingmon.log done I also wrote a report generator which was supposed to parse the log file and generate a summary/report in perl. I've attached that script here, but I can't claim that it is bug free, it also hard codes some business parameters (ie, business hours/days/etc), search for XXXX to find most things you will want to change. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au

3 3

DISK check: HOST must be before CLASS
by bakgat8＠hotmail.com 03 Jun '14

03 Jun '14

in analysis.cfg - it surprised me that this did not work: CLASS=linux DISK /cdrom IGNORE DISK * 100 102 PROC ntpd PROC sshd 1 PROC cron HOST=athyna,xymam00 DISK * 88 96 HOST=appel,banana PROC sendmail But putting the host athyna (which is linux) first does: HOST=athyna,xymam00 DISK * 88 96 CLASS=linux DISK /cdrom IGNORE DISK * 100 102 PROC ntpd PROC sshd 1 PROC cron HOST=appel,banana PROC sendmail I do many PROC tests per HOST after the CLASS definition - why is DISK difficult about sequence? I run my own disk test for most servers, that is why the CLASS basically turns the test off. Then I realized I was not testing athyna at all, and the default would actually be fine.

1 0

tasks.cfg - strange CRONDATE behaviour
by abs＠shadymint.com 03 Jun '14

03 Jun '14

Hi, Can anyone else confirm this. I have in tasks.cfg, something like so :- [xxx_refresh] ENVFILE /apps/xymon/server/etc/xymonserver.cfg CMD /apps/scripts/xxx_refresh.sh LOGFILE $XYMONSERVERLOGS/xxx_refresh.log CRONDATE 15 8-18 * * 1-5 What I deduce by adding echo statements to xxx_refresh.sh, is that if this shell script completes in less than 60 seconds, xymonlaunch runs it a second time :- grep Running xxx_refresh.log Running as pid 10044 at Mon Jun 2 08:15:03 BST 2014 Running as pid 29168 at Mon Jun 2 09:15:04 BST 2014 Running as pid 15931 at Mon Jun 2 10:15:03 BST 2014 Running as pid 17089 at Mon Jun 2 10:15:59 BST 2014 Running as pid 2805 at Mon Jun 2 11:15:02 BST 2014 Running as pid 4021 at Mon Jun 2 11:15:59 BST 2014 Running as pid 22545 at Mon Jun 2 12:15:00 BST 2014 Running as pid 23730 at Mon Jun 2 12:15:57 BST 2014 I have added a (redundant?) INTERVAL keyword, I have also played around with GROUP, but i cant stop it running twice. Presumably adding a sleep at the end of the script would be a workaround, I'll try that next. -- Andy

2 4

monitoring msgs
by jlaidman＠rebel-it.com.au 02 Jun '14

02 Jun '14

On 30 May 2014 19:44, Ian Diddams <didds3 at yahoo.co.uk> wrote: > The client did not report any logfile data > > This probably means that your client doesn't know to report the file data back to the Xymon server. Is your client host configured to run in central mode? Assuming it is, check the Hobbit temp directory (on the client host) for two files, one called logfetch.<hostname>.cfg and the other called logfetch.<hostname>.status. The "status" file should have an entry for your messages file. The "cfg" file should have the entire hobbit-clients.cfg section associated with this host (including comments and blank lines). Note that it can take up to 15 minutes for changes in hobbit-clients.cfg to be reflected in these two files. If you have neither of these files, you might be running in client mode rather than central mode. Or there might be an error in your hobbitclient.log file. Once these files are looking OK, the messages file details should start showing up in your client data. On any network test page, click on the [Client data] link at the bottom of the page, and then search for a "msgs" section like this: [msgs:/var/log/messages] Jun 2 14:39:27 servername kernel: It's cold in here Jun 2 14:43:62 servername sendmail: Go install postfix Cheers Jeremy

1 0

Xymon v5 readiness
by jlaidman＠rebel-it.com.au 02 Jun '14

02 Jun '14

On 30 May 2014 19:43, Henrik Størner <henrik at hswn.dk> wrote: > In other words, if you need IPv6 - go grab the current "trunk" version. > I shall do this. I have no need for the web content checks at the moment, nor LDAP, so this'll do fine. J

1 0