January 2015 - Xymon - Xymon mailman web

acknowledge.c(gi) buffer overrun
by cb＠df7cb.de 02 Feb '15

02 Feb '15

Hi, spotted on 4.3.17 in production: --- a/web/acknowledge.c +++ b/web/acknowledge.c @@ -289,7 +289,7 @@ int main(int argc, char *argv[]) pcre *dummy; char *re; - re = (char *)malloc(8 + strlen(pagename)); + re = (char *)malloc(8 + 2*strlen(pagename)); sprintf(re, "%s$|^%s/.+", pagename, pagename); dummy = compileregex(re); if (dummy) { This might even deserve a CVE number, but as it's a seccgi, it's not widely exposed. Christoph -- cb at df7cb.de | http://www.df7cb.de/

4 5

Monitor file content (trigger on keyword) on MS Windows
by linuxmasterjedi＠free.fr 30 Jan '15

30 Jan '15

Hi, I would like to know how do you search for keywords in files on Windows (I'm using BBWIN as a Windows XYmon agent). I've tried fsmon BBWIN plugin without any luck. Any advice? Thanks

2 3

errors with custom graphs
by Sheel.Shah＠rd.com 30 Jan '15

30 Jan '15

Hello, I set up some custom graphs to monitor my Memcached instances. However, I appear to have run into an issue. I set up my xymonserver.cfg to collect all of my data into one NCV file, as evidenced by my TEST2RRD and my configuration below. I also believe I defined the datatypes appropriately. The issue that I am seeing is in the RRD file itself, when I use the RRDTOOL to dump the file. All of the values for the various datatypes are showing as NaN. Would someone be able to point me in the direction of what I could be doing wrong? Thank you, Sheel TEST2RRD="<other stuff>,memcache-test=ncv,MC-TFH-8K01-11221=ncv,MC-TFH-8K01-11222=ncv,MC-TFH-8K02-11221=ncv,MC-TFH-8K02-11222=ncv" NCV_memcache-test="Hits:GAUGE,Misses:GAUGE,reqs:GAUGE,Gets:GAUGE,Sets:GAUGE,storage:GAUGE,items:GAUGE,hitratio:GAUGE,*:NONE" NCV_MC-TFH-8K01-11111="Hits:DERIVE,Misses:DERIVE,reqs:DERIVE,Gets:DERIVE,Sets:DERIVE,storage:DERIVE,items:DERIVE,hitratio:DERIVE,*:NONE"

3 3

Agent information
by sanjana.ahlawat＠gssltd.co.in 29 Jan '15

29 Jan '15

Hi Team I am new to xymon and trying to learn about it. But I am unable to figure out few questions. 1. I run xymon client installation by apt-get. but can you tell me what is actually running or getting installed in my system is it a rpm or what? 2. how my agent works. how does it gains information from the system it is running on. 3. what is the architecture of the xymon. I would really appreciate your help. Please give me the insight of the tool. -- Thanks and Regards *Sanjana *

3 7

Installing pcre2 10.0.0
by raulmoralesf＠yahoo.com.mx 27 Jan '15

27 Jan '15

Hi, May be this is not the correct site to ask about PCRE, however I'm installing thit library in order to set up XYMON, And the configure script of PCRE stops with this message:..... checking for link... link -lib checking the archiver (link -lib) interface... unknown configure: error: could not determine link -lib interface Someone knows what file/etc is missing to PCRE...??? Thanks in advance

1 1

Question on trending using Windows MrBig client - working now, fix unknown
by Mark.Deiss＠xerox.com 27 Jan '15

27 Jan '15

First off, like to thank Mr. Eriksson for authoring the MrBig package. Really appreciate it. Running older Windows platforms so the powershell clients are not practical and prefer to minimize any Windows registry modifications which some of the other clients require. Created another dummy widget on the Windows box, made xymonserver.cfg updates on the Xymon server. Halted the MrBig service, halted the Xymon services, flushed the Xymon logs, restarted Xymon services then MrBig services --- and of course --- Mr. Johnson's Windows widget started populating the rrd databases on the Xymon server. Arggghh. No clue what cleared the issue. Had Mr. Johnson's widget just updating the web pages and was not working further on it's rrd issue while trying to get dummy widget to generate rrd content. Now, trying to figure out why the NCV_<testname>="blah1:GAUGE,blah2:GAUGE,*:NONE" syntax in the xymonserver.cfg is not suppressing garbage lines that have colon entries (lines with timestamp entries). Running Xymon 4.3.17 - time to see if there is some patch. Looking in the mail archive, see that Mr. Johnson in 2006 was discussing this issue with Mr. Stoerner replying with the NONE syntax. A rrdtool dump and rrdtool info is showing the garbage content being inserted into the rrd file. ________________________________________ From: Xymon [xymon-bounces at xymon.com] on behalf of Deiss, Mark [Mark.Deiss at xerox.com] Sent: Tuesday, January 27, 2015 5:53 AM To: ulric at siag.nu Cc: 'xymon at xymon.com >> xymon' Subject: Re: [Xymon] Question on trending using Windows MrBig client Thank you sir. I looked through the C code and the messaging syntax tracks with what I have been fooling around with. I have some external tests coming from Xymon-based Linux boxes that are generating rrd content so the modifications for those in the xymonserver.cfg and graphs.cfg on the Xymon server are okay. There are rrd updates occurring for the Windows client on the Xymon server from the MrBig internal tests so it's not a perm issue on the Xymon server. The MrBig internals are showing rrd update activity in the Xymon server's rrd-status.log. The dummy external is registering in the rrd-status.log but showing no processing attempt. Have several other MrBig externals running on Windows boxes that are correctly sending messages across to the Xymon server; these are not involved with rrd operations. Mr. Johnson's termuser.pl procedure is the first time attempting rrd generation using data from a Windows box. The module is for a Windows platform using BBWIN; the module message using MrBig is appearing correctly in the Xymon web display. Nuts. Guess next step is to make a another dummy test (quit trying to use the internal citrix definition on the Xymon server), ncv based, single data point, and try again from the Windows client. Then try from a Linux box sending same content over under the ID of the Windows box. Will probably have to go into the xymond_rrd code and add a bunch more debug statements to figure out why the Windows message is not being processed. Try and figure out what check logic there is in front of the rrdcreate operation. ________________________________________ From: ulric at siag.nu [ulric at siag.nu] Sent: Tuesday, January 27, 2015 3:14 AM To: Deiss, Mark Cc: 'xymon at xymon.com >> xymon' Subject: Re: [Xymon] Question on trending using Windows MrBig client 2015-01-26 21:15 skrev Deiss, Mark: > Has anyone successfully performed rrd trending using data from an > external test from a MrBig Windows client? I am the original author of the MrBig client and yes, it is certainly possible to use it to get trending data. Here is an example, an external test which controls an egg incubator. Not exactly what you're looking for, but the principle is the same. http://siag.nu/Incubator/ Ulric _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

Question on trending using Windows MrBig client
by Mark.Deiss＠xerox.com 27 Jan '15

27 Jan '15

Has anyone successfully performed rrd trending using data from an external test from a MrBig Windows client? The MrBig client-internal tests are creating rrd files on the Xymon server. Have a stripped down external test that is staging a file (filename of citrix, no file extension) for delivery using MrBig with the following content: green Fake citrix test users: 49 The "green" is the first line in the file being sent across to the Xymon server and the generated web page looks okay. Also tried messaging using "users 49" in case the Xymon citrix parser was not NCV based. I figure this should process against the stock TEST2RRD definition of citrix on the Xymon server and per the graphs.cfg citrix stanza, looks like the graphing is operating on a users: <number> data set coming in. Not concerned at this point with graphing since the rrd itself is not being created but was concerned that the xymond_rrd code may only be processing against specific citrix value of users I have turned on debugging with the tasks.cfg entry for the rrd-status xymond_rrd to include "--no-cache --debug". I see the windows client delivering the citrix update and the xymond_rrd is reporting seeing the client-citrix message in the rrd-status.log - but nothing else, no creating or updating of a rrd file under <client>/citrix.rrd. The other rrd files are updating and am getting updated web pages for the client citrix message. Have bounced the xymon server ad nauseum, twiddling thumbs for upwards of an hour waiting for rrd file to be created, bouncing the MrBig client too. Are there any additional debug settings for the xymond_rrd channel to get more detail on what is being done with the client-citrix message? What I am after is a using a modified version of Galen Johnson's termuser.pl on Xymonton - wanted to add additional line for tracking disconnected user sessions.

2 2

sending one singular status to another xymon server
by schritte＠ub.uni-frankfurt.de 23 Jan '15

23 Jan '15

hi, is it posible to forward just one status (build-in test) to another xymon server? The server where the test should be displayed cannot do the check himself because xymon there has been compiled with fewer options. thanks, Rolf -- Mit freundlichen Gruessen Rolf Schrittenlocher Lokales Bibliothekssystem Frankfurt Senckenberganlage 31, 60054 Frankfurt Tel: (49) 69 - 798 28908 Fax: (49) 69 798 28817 LBS: lbs-f at mlist.uni-frankfurt.de Persoenlich: schritte at ub.uni-frankfurt.de

2 3

PULLDATA flag not behaving as documented
by john.thurston＠alaska.gov 23 Jan '15

23 Jan '15

The "pulldata" flag is documented as supporting an explicit ip:port combination. In the man file for hosts.cfg: > pulldata[=[IP][:port]] > This option is recognized by the xymonfetch(8) utility, and causes it to poll the host for client data. The optional IP-address and port-number can be used if the client-side msgcache(8) daemon is listening on a non-standard IP-address or port-number. but the application does not seem to be picking up the ipaddress or port specified. It always uses the address of the host. Take the following example config line: 1.2.3.4 foo.bar.com # pulldata=5.6.7.8:2014 noconn By the documentation, I expect it to try pull data from 5.6.7.8 on port 2014. It does not. It always tries to pull from 1.2.3.4 on port 1984 Looking in xymonfetch.c, I see where the parsing is done to identify explicit IP addresses. Using a "xymondboard fields=XMH_FLAG_PULLDATA", all I get back is "PULLDATA". There is never an IP address listed. My C isn't good enough to trace farther back through the code :( I think there may be an error in the parsing of the pulldata tag. Can anyone help me unwind this and tell me what I'm doing wrong (or if there is a bug I'll have to figure out how to patch)? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

4 4

custom script once a day
by jlaidman＠rebel-it.com.au 23 Jan '15

23 Jan '15

Hi On 23 January 2015 at 06:43, usa ims via Xymon <xymon at xymon.com> wrote: I have a custom client test that I only want it to be executed once every > day at 2:15am. After looking through the man pages of hosts.cfg and > alerts.cfg, I am confused on what is the best course of action. From > reading the archives, it was indicated to use the cron utility of Linux for > it to start at ‘2:15am’. > The tasks.cfg allows specifying a "CRONDATE" so you don't need to use Linux cron, and it's probably better to keep it all within Xymon. > I would like to be alerted only once but the test to run every hour until > recovered. So normally you want the test to run once only at 2:15am. But if it's in a failed state, you want the test re-run every hour. This is also what happens with the network tests, where the xymonnet-again.sh script looks for failed network tests and re-runs them every minute rather than the normal 5-minute interval. You can't make use of the xymonnet-again.sh script because it only works with the standard network tests (it simply runs xymonnet specifying the tests to repeat). But you could use the same idea. > In the clientlaunch.cfg of the xymon/hobbit client, I’m going to put 15m, > am I correct? > Why 15 minutes? Did you mean 60 minutes? > [xxxxx] > ENVFILE $HOBBITCLIENTHOME/etc/hobbitclient.cfg > CMD $HOBBITCLIENTHOME/ext/xxxxx.pl > LOGFILE $HOBBITCLIENTHOME/logs/xxxxx.log > INTERVAL 60m > Here you could put (instead of INTERVAL) something like: CRONDATE 15 2 * * * to run at 2:15 every morning. And in the script I’m going to put ‘status+24h’ so that it will not turn > purple. > Yep. > In the alerts.cfg, I have the following: > HOST=xxxxx > SCRIPT /etc/xymon/xxxxx-emails-geoxx.sh SERVICE=xxxxx COLOR=yellow > REPEAT=24h FORMAT=SCRIPT RECOVERED > Yep, so this will run the script (I'm guessing) to send an email when the service fails and when it is restored. What you could do is add another line to alerts.cfg to re-run your original monitoring script for the test, but only when the test is failing. Something like this (notice that I put the SERVICE on the first line so that it applies to both SCRIPT lines): HOST=xxxxx SERVICE=xxxxx SCRIPT /etc/xymon/xxxxx-emails-geoxx.sh SERVICE=xxxxx COLOR=yellow REPEAT=24h FORMAT=SCRIPT RECOVERED SCRIPT $HOBBITCLIENTHOME/ext/xxxxx.pl "&host&" FORMAT=SCRIPT DURATION>5m DURATION<16h REPEAT=1h So the second line will mean that an error condition will cause a re-test, and when the error condition stops, the re-test will also stop. Some important things to note here are: a) If the script that does the checks (xxxxx.pl) operates on several hosts, then it should take as its parameter, the name of a host to limit its checks on. Otherwise when one host fails, all of them would be re-tested. b) The "DURATION" specification means that the re-test won't happen immediately on failure, but will wait for the REPEAT interval of 1h. There's no point re-testing within 3 seconds of the first test failing. c) I've set the maximum DURATION to 16 hours because if you haven't fixed the problem by 6pm it probably won't get done until the next day. Adjust this as you see fit, but probably not worth having it more than 24h. J

1 0