September 2014 - Xymon - Xymon mailman web

Windows Event Logs - Central Mode bbwin
by bdale＠kitchen-net.com.au 24 Sep '14

24 Sep '14

Hi, New to xymon, currently testing on a few windows servers running 2003,2008,2012. I am using the bbwin client at the moment but am also aware of the PowerShell client (which I haven't tested yet). bbwin clients are all running in central mode and successfully sending data to the xymon server. I'll give a brief background on what I have done to get event logs to work at all (this took lots of googling and playing around) I think this is the correct way to do it in central mode, if not please let me know and point me in the right direction as there isn't much information on the windows side of things: 1. Added this to analysis.cfg CLASS=win32 LOG %.* %^critical.* COLOR=red LOG %.* %^error.* COLOR=red LOG %.* %^failure.* COLOR=yellow LOG %.* %^warning.* COLOR=yellow This seems to work, the for example In the eventvwr where an event has Level=Warning in xymon this goes yellow. 2. Added rules in client-local.cfg to filter out certain events , this seems to use the description of the event and doesn't read the level at all (took a lot of googling and testing to work this out) [win32] eventlog:security:10240 ignore .* permitted a connection ignore .* permitted a bind ignore Windows Firewall blocked an application eventlog:system:10240 ignore Big Brother Xymon Client service ignore .* The local computer may not have the necessary registry information eventlog:application:10240 ignore The (service BBWin|agent \w+\.dll) has been success ignore The agent externals generated this event message ignore .* shutting down due to idle timeout Now the above all seems to work, events appear in the msgs column in xymon and they don't include any of the ones listed in the client-local.cfg. I can see the content of client-local.cfg being sent to the local machines and it all works. My questions are 1. Why can't I filter on Success, Information etc in the client-local.cfg ? does this just not work or am I doing it wrong. 2. Messages eventually disappear from the msgs column, so an error that had triggered it to go red will eventually go green even though the error may never have been fixed. I understand why this happens as it doesn't log an event to say the error is fixed so in that example it would always be red. But what controls how long the messages stay on the messages page for? And is there any way to for example have anything that is non green stay there until somehow they are acknowledged. Sort of like a to-do list of errors to resolve on each server. 3. Does any of this work better/differently in the PowerShell client? Brandon.

1 0

Preventing Purple - Periodical Checks
by tres.finocchiaro＠gmail.com 24 Sep '14

24 Sep '14

I have a custom service check that is only done during certain times of the day and only on certain days of the week. We use crontab and a shell script to generate the output and pipe it into the front-end using the xymon executable. xymon 127.0.0.1 "status $server.$service $green|$red|$yellow $timestamp,$description" This check works terrific when it runs, but in between checks it goes purple. Without creating a fake service check in between each scheduled cron entry, what's the quickest way to configure that this check goes purple less often? (or if that's not possible, never go purple?) How are others handling occasional or daily service checks? Are you hard-coding the times into the script itself? -Tres - Tres.Finocchiaro at gmail.com

7 8

clientlaunch.d
by solitaryr＠gmail.com 23 Sep '14

23 Sep '14

Hey, Does the does the xymon client allow the use of includes? For example, can you add the include clientlaunch.d/*.cfg to allow it to read the client tasks? I don't see anything obvious in the man page but the fact that it refers you to the tasks.cfg hints that it should. thanks =G=

2 4

Generating alerts by non-xymon shell scripts
by deepakdeore2004＠gmail.com 23 Sep '14

23 Sep '14

Hi, I have one shell script which generates apache allow,deny host file weekly, tests the syntaxt by "apachectl -t", sends email if syntax errors. If no syntax errors then push the file and to apache graceful restart and then send success email. Is there a way I can generate xymon alert instead of sending emails. Upon success xymon status will be green and failure will generate red/ yellow. I can do this by xymon scripts but wanted to check if there is simple way to generate xymon alerts based on normal shell scripts which will avoid emails and everything would be centralized to xymon. Thanks, Deepak

3 4

Xymon Server
by Andreb＠paym8.co.za 23 Sep '14

23 Sep '14

Hi Guys, So after a while of playing around and getting Xymon up and running I was wondering if Xymon has the capability to monitor Windows based servers and services? Kind Regards Andre

5 5

Current status + availability reports
by gendalia＠iastate.edu 23 Sep '14

23 Sep '14

I'd like to have a page that has the current status of a set of combo tests (all called 'health') and next to that columns for yesterday's availability report, last 30 days, last month, and year to date. Has anyone done something like that already? -Tracy

2 1

Xymon 5?
by solitaryr＠gmail.com 21 Sep '14

21 Sep '14

Hey, Has Henrik set a date for the release of Xymon 5? If one wanted to try it out, where would they look for the code base (not obvious on the xymon.com page or sourceforge.net) IIRC, he wanted to let 4.3.17 bake for a while (4.3.18 is waiting in the wings as well). =G=

1 0

ntp - xymon 4.3.17
by m.pingel＠ndr.de 21 Sep '14

21 Sep '14

Hi, I have a Suse Server and have take the "ntp" in the hosts.cfg. I get allways this Message back. Service ntp on SERVER is OK (up) Command: ntpdate -u -q -p 2 IP-Adresse 2>&1 !!!!!!!!!!!!!! WARNING !!!!!!!!!!!!!!!!!! The ntpdate program is deprecated and should not be used any more. To quote the upstream ntp developers: "The functionality ntpdate offered is now provided by the ntpd daemon itself. If you call ntpd with the command line option -q it will retrieve the current time and set it accordingly." Please check the Network Time Protocol (NTP) daemon man page and http://support.ntp.org/bin/view/Dev/DeprecatingNtpdate for further information. You can replace the ntpdate call with "rcntp ntptimeset" to achieve an inital poll of the servers specified in /etc/ntp.conf. The program /usr/sbin/sntp offers comparable functionality to ntpdate. Specifically sntp -P no -r pool.ntp.org is equivalent to ntpdate pool.ntp.org For further details please refer to the man page of sntp. sntp: unable to write PID to /etc/sntp.pid sntp: Permission denied Can you say me how I can change? Mit freundlichen Grüßen Matthias Pingel

2 1

disabling alerts
by usaims＠yahoo.com 20 Sep '14

20 Sep '14

Hi, I need to disable alerts on particular hosts. So I added '!' in from of the test but last night it alerted me. Please check my config and offer any help, thanks. subpage MySQL MySQL group-only conn|!cpu|!disk|!memory|msgs 10.xxx.xxx.xxx 123.corp.local 10.xxx.xxx.xxx 345.corp.local 10.xxx.xxx.xxx 678 corp.local

3 2

Xymon Setup
by Andreb＠paym8.co.za 19 Sep '14

19 Sep '14

Hi Guys I need some assistance with regards to setting up Xymon, I have seen it once or twice but the actual config itself I have never done. I used the man pages etc. but I can't get my Xymon url to show the page, checked the log and I am getting the following. [cid:image003.png at 01CFD37C.E3AA2DA0] [cid:image004.png at 01CFD37C.E3AA2DA0] Then the error just repeats over and over. Does anyone perhaps have an example of what needs to be setup that I can use to reference to mine to see what I did wrong. Kind regards, [Description: singature picture 1]<http://www.paym8.co.za/> Andre Beyleveldt System Engineer Phone: +27 11 564 2480 Mobile: +27 82 686 5828 Email: andreb at paym8.co.za<mailto:andreb at paym8.co.za> Website: www.paym8.co.za<http://www.paym8.co.za/> Postal: Private Bag X83, Halfway House 1685 [Description: image003]<https://sealserver.trustwave.com/cert.php?customerId=w6oj3BfC7hnnGnD5amTROy…> ATTENTION: PAYM8 continues its commitment to data security and is now in its fourth straight year of successful re-certification for PCI DSS (Payment Card Industry Data Security Standard) compliance. PAYM8 operates in the Payment Card Industry environment. In order to align with the Payment Card Industry Data Security Standard best practices, we do not send or accept any unencrypted or unmasked PANs (Primary Account Numbers as displayed on credit and debit cards) via end user messaging technologies (such as email, instant messaging and chat). If there is a business need to send unencrypted or unmasked PANs to PAYM8 please contact the recipient to facilitate an appropriate mechanism. The information transmitted in this e-mail is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Should you have received this e-mail in error please notify the sender and delete all copies of the e-mail. Unauthorized use, disclosure or copying of any part of this e-mail, or any similar action, is prohibited. No opinion expressed or implied by the sender necessarily constitutes the opinion of PAYM8. This e-mail does not constitute a guarantee or proof of the facts mentioned herein. No employee or intermediary is authorized to conclude a binding agreement on behalf of PAYM8 by e-mail without the express written confirmation by a duly authorized representative of PAYM8.

5 8