November 2015 - Xymon - Xymon mailman web

Need help with upgrade from 4.3.17 to 4.3.20
by vadud3＠gmail.com 17 Jul '18

17 Jul '18

I am not sure what I need to after the upgrade for the columns to show data instead of something like this ELF �� >� �� @��@�� Þ ��@�8� �@�%�"� �� @��@�@��@�@��ø ��ø �� 8 ��8 @��8 @�� @��@��ää��ää�� I removed FollowSymLinks from xymon-apache.conf file under /xymon-cgi/ and /xymon-seccgi/ and restarted. I am using ubuntu -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

9 29

Recovery notifications not generated when test goes red->yellow->green?
by hobbit＠elyograg.org 13 Dec '17

13 Dec '17

It appears that if a test goes from the red state, to the yellow state, and then to the green state, no recovery notification is sent. If it goes directly from red to green, then we get a notification. Initial notifications are only sent on RED and PURPLE. We have recovery notifications configured for most tests. Xymon server is 4.3.21, built using makerpm.sh and installed with yum on CentOS 6. I do not know whether our previous version (4.3.14) behaved similarly. It was almost an accident that I discovered the problem at all. Is this expected behavior? If it is, can I change it? Thanks, Shawn

4 3

DNS failures causing "runtime longer than time limit"
by jlaidman＠rebel-it.com.au 11 Sep '17

11 Sep '17

Hi I'm running Xymon v4.3.10 on Linux, and I'm quite sure it's compiled with c-ares support. I have 12 new DNS servers that were added to Xymon about one month ago. All of my server entries in hosts.cfg have "testip". The tasks.cfg runs xymonet with "--dns-timeout=3". The hosts entries look like so: 10.10.10.1 dnshost1.example.com # testip dns=NS:example.com,SOA: example.com About a week ago, connectivity to all of these servers failed, and at the same time, the xymonnet run time jumped from less than 15 seconds to about 330 seconds, so about 315 seconds extra. The xymonnet page says 295 seconds is taken up by DNS tests. If the increase in time taken is about 315 and is entirely due to the 12 servers failing, then each failed server is adding about 26 seconds to the total run time. I don't think this should be happening like this. With two DNS checks per server, the DNS checks should be taking 6 seconds each to time-out, not 26. If I run xymonnet with "--timing --no-update" and specify only one hostname, I can view the results and the timing. This shows that the ping check gets reported after about 3 seconds, and then the DNS tests are executed and take 26 seconds total. My naiive assumption was that when a server failed a ping (and didn't have "noclear" defined in hosts.cfg) then the network checks would be skipped. On re-reading the man page for hosts.cfg, it dawned on me that a failed ping simply suppresses failed test /results/, but doesn't stop the tests from being run. So the real problem is that the "--dns-timeout=3" is not being taken into consideration by xymonnet. If I run xymonnet with "--debug" it tells me: 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=2 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=6 1900 2015-06-03 12:02:20 Processing 0 DNS lookups with ARES 1900 2015-06-03 12:02:46 Finished ARES queue after loop 423 This is peculiar. Why would it say "processing 0 DNS lookups" when there are two lookups to test? Could this be because xymonnet hasn't actually been built with ARES support and I didn't know it? Is there a good way to tell? If I add "--no-ares" I get the same results perhaps suggesting a lack of ARES support. On the other hand, if I add "timeout:3" and "attempts:1" into resolv.conf, I also get the same results. If I run "nm /path/to/xymonnet | grep gethostby" it returns "ares_gethostbyname". Just for fun, I compiled Xymon v4.3.21 and ran the xymonnet binary from there, with no change in behaviour. I also tried removing the "--dns-timeout" option so that it defaults to 30 seconds, but still no change - 26 seconds for two DNS tests. So, I'm not really sure what the problem is, but xymonnet certainly isn't behaving as I would expect. Cheers Jeremy

2 3

EXTIME still valid ?
by rltexas1＠gmail.com 22 Jun '16

22 Jun '16

Is the EXTIME option still valid in the alerts.cfg I am having problems testing the following EXTIME=1:1140:1240 Should be exclude Monday's 11:40 to 12:40. Will test EXTIME=M:1140:1240 But if it's M for Monday what would Sunday be ? Thanks

4 4

MAGMA XYMon Web GUI Admin Now Available!
by sanderson＠CORNETSER.com 07 Jan '16

07 Jan '16

Henrik and Fellow Xymoners, Just for you I have pushed off any real work for today just to get you all a first release of MAGMA the XYMon Web GUI Admin. MAGMA is an add-on web GUI for managing Host, Groups and Alarms on a XYmon 4.3 or newer system. You can find MAGMA at http://www.squidworks.net/magma/ There you will find the description, screen shots and features of MAGMA along with the link to download the source package. It requires MySQL and PHP5 and is very simple to install. All supporting information is included in the tarball. How does it work? --------------------------- It stores all alarm and host/group configs in the SQL database and rewrites the Host.cfg, Analysis.cfg and Alarms.cfg files causing the XYmon system to update its tests and pages based on the changes in these files. It will overwrite the files each time a host is added or edited making the process of updating automatic. To get the full benefit of MAGMA you should place all hosts in "central" mode, although this is not required, without it your management is somewhat restrictive (external test management only). In Central mode you get full management features for all tests. If you have any questions or need some help just send me a email @ sanderson @ squidworks.net Cubert 8-) Aka Shannon Anderson

9 10

Xymon and Oracle ASM?
by betsy.schwartz＠gmail.com 30 Dec '15

30 Dec '15

Anyone got any good scripts for xymon and Oracle ASM?

5 4

Monitoring process with regex - fails with 4.3.4 and BBWin 0.13
by sirusirus14＠gmail.com 21 Dec '15

21 Dec '15

Hello I will use the BBWin 0.13 in Windows Server 2012, the Xymon 4.3.4 on CentOS I use. In order to monitor the regular expression to the Windows process, we set as follows in the BBWin.cfg of Windows Server. <procs> <setting name "notepad" rule = "= 2" alarmcolor = "red" /> <setting name "% notepad C: \ Users \ Administrator \ Desktop \ test.txt" rule = "= 2" alarmcolor = "red" /> <setting name "% notepad *" rule = "= 2" alarmcolor = "red" /> <setting name "% ^ notepad *" rule = "= 2" alarmcolor = "red" /> </ procs> The first line "notepad" only I've correctly match, the rest regular expression does not match. Please tell me if there is a mistake. Thank you very much.

2 2

xymon hostdata module going rogue
by Scot.Kreienkamp＠la-z-boy.com 14 Dec '15

14 Dec '15

Hi everyone, I have a xymon server running 4.3.21 that seems to be accumulating processes like these: hobbit 28430 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> hobbit 28435 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> hobbit 28440 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> hobbit 28444 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> hobbit 28449 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> hobbit 28452 0.0 0.0 0 0 ? Z 12:50 0:00 [xymond_hostdata] <defunct> It seemed related to drop messages, so I did a test. [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 161 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 162 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 163 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 164 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 165 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 166 [hobbit at retv6100 temp]$ xymon 127.0.0.1 "drop amds7101_na_lzb_hq" ; ps auxw |grep xymond_hostdata |wc -l 167 So every time I send a drop message I get a defunct process hanging out. Bug in Xymon? This is on RHEL5, xymon 4.3.21. Thanks! Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * Scot.Kreienkamp at la-z-boy.com<mailto:Scot.Kreienkamp at la-z-boy.com> www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> | facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<https://twitter.com/lazboy> | youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy> [cid:lzbVertical_hres_e400f094-7baa-4c76-a2c8-89ec5a6f2cfd.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

5 20

"Discarding timed-out partial msg" Error Messages
by matt1299＠gmail.com 08 Dec '15

08 Dec '15

Hey all, Lately, I've been seeing quite a few error messages show up in xymond indicating that it was discarding a timed-out partial message from some machine. i.e. Latest error messages: Discarding timed-out partial msg from X.X.X.X They seem to be happening sporadically but more often than usual as of late. Maybe one or two every couple of days or so. They don't seem to be coming from the same machine/machines either. Is this something I should be worried about? Are there any side-effects from this happening too much? What are the causes of this happening? Any way to make it not happen as much? Any ideas or advice is greatly appreciated! Thanks!! -- Matt Vander Werf

2 3

Xymon swarm proposal
by henrik＠hswn.dk 30 Nov '15

30 Nov '15

Hi, the recent talk on xymon-developer about rewriting xymonproxy to support TLS, IPv6 and other good stuff made me think about other ways of scaling Xymon across large installations. Which led me to the idea of having multiple independent Xymon servers - a swarm, because no one Xymon server depends on the others, but they can cooperate. Simply put, you have a number of independent Xymon installations. Each of them handles a group of servers - it could be one in each of your datacentres, one for each organisational unit, one in each network segment, or just a because you have such a large installation that a single Xymon server cannot cope with the load (and that would be a really big installation, judging by the numbers I hear). This all works just like the Xymon you have today. The only thing that is needed to have all of these independent Xymon servers show up as a single (virtual) Xymon installation is to have the Xymon webpages - generated by xymongen - to display a set of webpages showing the status of all of the Xymon servers in the swarm. When you click on the detailed status log, you are transparently sent to the Xymon server that holds the data about that server (the URL points to the Xymon server handling the particular server you want to check on). The nice thing about this is that I think it can be implemented fairly easily, i.e. without having to change anything fundamental in the way the various Xymon programs work. Which means it will also be easy to adapt into an existing Xymon installation, and with a good chance of not introducing difficult-to-troubleshoot bugs (difficult because bugs involving remote systems are always a headache to reproduce). There are of course a few nitty-gritty details, e.g. "Find host" really should be able to search across all of the servers in the swarm. But those cases are rather few and fairly isolated to not be too much of a headache. Multiple independent Xymon servers * Each site runs just like today. * A new sites.cfg file lists the other sites (just a site ID and how to contact xymond there) * Each site UI (the static webpages from xymongen) merges data from all sites Advantages * More resilient - if one site dies, the others will remain operational * Less cross-site traffic (local data remain local except when needed) * Less load on each site (updates only go to one Xymon server) * Horizontally scalable Limitations * Hostnames must be unique globally. Probably not a significant problem. * Functions that fetch data directly from disk-files cannot be cross-site (rrd-files, history-logs), unless you can retrieve the data via a network request. In a standard Xymon installation that would be: o Availability reports o Event log reports (but see below) o Multi-host graphs, unless all of the hosts are local * Alerts are always handled locally xymongen * hosts.cfg file for the page layout must be merged from all sites. Can be a simple append-one-after-the-other (built-in) or perhaps allow foran externally generated hosts.cfg - if you want to have servers from multiple locations on one page. * How do we handle non-unique pagenames? Transparently prefix them with the remote site-ID? * xymondboard data is fetched from multiple sites and combined (appended) - handled in sendmessage() * cgi-URL's are generated with a prefix of /SITE/ - no change otherwise. The local webserver then proxies /SITE/ requests to the remote site. * Should there be both a local and a global "all non-green" page? Maybe even a full set of local and global webpages? That would be easy by running xymongen twice - one for the local and one for the global set of pages. sendmessage() function * No changes for sending status- or data-updates (status, combo, extcombo, client, data, modify) * Option to fetch data from multiple sites. This is already in place for sending to multiple Xymon servers, so we just need to combine the output response from multiple sites. * When processing host-related requests, we learn where the host is located. Cache this for use by various tools. Must be disk-based (e.g. SQLite file) so it can be shared. xymond * hostinfo requests should only answer for the local hosts. No need to consult the SQLite cache - no changes. CGI programs * "Find host" must be cross-site * Ack-alert: Suggest making it local-only. Since alerts are only generated locally, it makes sense to also only ack the local alerts. * Enable/disable only on the local site? Use the "info" page enable/disable (automatically local). Global enable/disable needs some more looking into. * Critical systems - would probably be nice to be able to do both a local and a global version. * Eventlog - would be nice to have both local and global, even though that means fetching a (large) remote logfile. Will probably require a new "eventlog" CGI interface for retrieving a remote logfile. It is probably not something we want to do on every critical-systems/all-nongreen webpage update. So those could keep the local eventlog display (as-is), and then the eventlog CGI could have the option of combining logs from all sites (or maybe a selection of sites). xymon commands _Commands re. specific hosts_ First check via hostinfo cache (see below) if we know where the host is (performance optimization). If not then simply broadcast the message to all sites and combining any data that is returned - there will only be data from one server. * notify * disable * enable * query * xymondlog, xymondxlog, clientlog * hostinfo - sendmessage() will fetch the data for us, whether from the local xymond or from the SQLite cache. _Commands that collect data on multiple hosts_ * xymondboard, xymondxboard - option from user whether to fetch local or global info. Handled in sendmessage() _Command that only work locally_ * ghostlist * drop * rename * schedule. If done via web i/f it becomes automatically transparent, but not for scripts. Probably only used for disable/enable/drop/rename so makes most sense to do it locally. Doing global would have to parse the message to detect which host it is about. Comments are very welcome. Regards, Henrik

5 4