December 2015 - Xymon - Xymon mailman web

ftps tests
by Galen.Johnson＠sas.com 19 Dec '15

19 Dec '15

Hey, I need to test FTPS on a server but the test keeps complaining that it isn't getting the expected response. The vsftpd server is NOT running implicit ftps so there is nothing listening on port 990. I've tested using curl so I know STARTTLS is working over port 21. I've tried adding the following to my host entry: ftps:21:s but it still comes up yellow (log is less than helpful "Service ftps on ftphost1 is not OK : Unexpected service response?"). Has anyone else been able to test ftps with tls over port 21 using xymon? What am I missing? thanks =G=

5 9

Feature request: safe logfetch
by jlaidman＠rebel-it.com.au 18 Dec '15

18 Dec '15

On Fri, Dec 18, 2015 at 4:40 PM Thurston, John R (DOA) < john.thurston at alaska.gov> wrote: > Better, this behavior should be disallowed by default and enabled only by > explicit action on the client. If you control the client, then it will be > no big deal to enable on each host. If you don't control the client, then > it should default to a closed configuration. I would agree, if backticks were a new feature. But we don't want to break things for installations that make use of this. Perhaps change the default for a major release? Also, I think the "secure" form of execution should be enhanced to be able to do globbing. In that way, many people will be able to convert from this: file:`echo /var/log/*/somefile` to this: file:/var/log/*/somefile without executing anything.

2 1

Feature request: safe logfetch
by jlaidman＠rebel-it.com.au 18 Dec '15

18 Dec '15

Hi, I wanted to get opinions on this. I make extensive use the backticks feature of the "file:" configuration option in client-local.cfg, to run little scripts on my clients. The intended use is to report on dynamically-determined filenames. However, I (ab)use it to run little scriptlets on client boxes and report back to the Xymon server. Something like this: file:`FILE=/tmp/array_status; LIFETIME=1d; [ -f "$FILE" -a -r "$FILE" -a -s "$FILE" ] || exit 1; find "$FILE" -ctime -1 | grep ^ >/dev/null || exit 1; ( COLOR=green && STATUS=OK; egrep "rebuilding|expanding|ready for recovery" $FILE >/dev/null && COLOR=yellow && STATUS=WARNING; grep "DEGRADED" $FILE >/dev/null && COLOR=red && STATUS=ALERT; echo "status+$LIFETIME $MACHINE.RAID $COLOR $(date) RAID $STATUS"; head -20 $FILE; ) | $BB $BBDISP @ >/dev/null` This will look in the file /tmp/array_status (updated every 5 minutes from cron) and alert based on strings such as "DEGRADED" or "rebuilding". This is awesomely useful, and makes Xymon extremely flexible. These scriptlets can essentially replace simpler "ext" scripts on the client, and can be entirely managed on the server side. However, it's really not very secure, because the Xymon server can run any code on the client box as the xymon user, without any form of authentication. The only reason I'm comfortable doing this is that I manage both (Xymon) client and server hosts. But the day may come when I'm asked to monitor someone else's host, and they won't be happy for me to run arbitrary commands on their host. Worse still if they're silly enough to run their Xymon client under a privileged account, although some people allow the xymon user to use sudo. What are their options? I can think of three: 1. They can refuse to use a Xymon client. 2. They can disable logfetch (eg remove the "logfetch" command from the xymonclient.sh script, or "chmod 0 logfetch", or rename and symlink to /bin/true). But this means we miss out on logfile monitoring. 3. On some systems they could prevent logfetch from using the exec() system call, such as using an selinux policy, or using a wrapper that declares its own void functions for the exec*() suite system calls, like sudo's "noexec" option. What I'd like is to be able to tell the sysadmin to run his client in a "secure logfetch" mode that forbids exec() system calls. Then she'll be happy that this attack vector is closed, and that I can't run arbitrary commands on her host. Perhaps there could be a LOGFETCH_OPTS variable that can have "--noexec" added to the command-line for running logfetch, which would enable the secure mode. Cheers Jeremy

2 1

FreeBSD [ifstat] processing
by nicolas＠lienard.name 16 Dec '15

16 Dec '15

Hello Having same issue with my FreeBSD 10.2 devices, i tried this patch on server side but it was not matching successfully all the interfaces due to bad regular expression matching on the mac addresses part. # netstat -ibn | egrep "<Link|Name" | grep -v ^lo Name Mtu Network Address Ipkts Ierrs Idrop Ibytes Opkts Oerrs Obytes Coll em0 1500 <Link#1> 00:22:4d:ad:fe:35 893691871 0 0 1135451821124 497735825 0 107868664606 0 pflog 33160 <Link#5> 0 0 0 0 697354 0 69531302 0 tap0 1500 <Link#3> 00:bd:c4:41:4e:00 448130087 0 0 584819922588 250814356 0 43739464436 0 bridg 1500 <Link#4> 02:f7:58:d9:cb:00 0 0 0 0 0 0 0 0 vlan1 1496 <Link#9> 00:bd:c4:41:4e:00 58827595 0 0 61939630719 46134046 3255 29559453921 0 vlan2 1300 <Link#10> 00:bd:c4:41:4e:00 450450 0 0 34627817 456686 110 36271656 0 tap30 1500 <Link#7> 00:bd:24:27:3a:1e 109129 0 0 7518832 171580 0 231138481 0 bridg 1500 <Link#8> 02:f7:58:d9:cb:1e 0 0 0 0 0 0 0 0 vlan3 1496 <Link#12> 00:bd:24:27:3a:1e 143 0 0 10409 73 0 3893 0 It was matching only pflog0 interface with the regexp where the mac address part is in bold : "^([a-z0-9]+)\\s+\\d+\\s+<Link#\\d+>\\s+ <smb://s+//d+//s+<Link#//d+>//s+>[:0-9]+\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+[0-9- <smb://s+//d+//s+[0-9-]+//s+(//d+)//s+//d+//s+[0-9-]+//s+(//d+)//s+[0-9->]+" }; Here a functional one (in bold the replacement) rrd/do_ifstat.c [line 31] /* Name MTU Network IP Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll */ /* lnc0 1500 172.16.10.0/24 172.16.10.151 26 - 1818 26 - 1802 - */ static const char *ifstat_freebsd_exprs[] = { "^([a-z0-9]+)\\s+\\d+\\s+<Link#\\d+>\\s+ <smb://s+//d+//s+<Link#//d+>//s+>[a-z0123456789.:]+\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+[0-9- <smb://s+//d+//s+[0-9-]+//s+(//d+)//s+//d+//s+[0-9-]+//s+(//d+)//s+[0-9->]+" }; The part on client is working fine. Thanks and long life to Xymon ! regards, Nico From: Xymon [mailto:xymon-bounces at xymon.com <http://lists.xymon.com/mailman/listinfo/xymon>] On Behalf Of Jeremy Laidman Sent: Thursday, 20 February 2014 1:46 PM To: xymon at xymon.com <http://lists.xymon.com/mailman/listinfo/xymon> Subject: Re: [Xymon] FreeBSD [ifstat] processing On 17 February 2014 23:24, Jeremy Laidman <jlaidman at rebel-it.com.au <http://lists.xymon.com/mailman/listinfo/xymon><mailto:jlaidman at rebel-it.com.au <http://lists.xymon.com/mailman/listinfo/xymon>>> wrote: On 17 February 2014 18:48, Jeremy Laidman <jlaidman at rebel-it.com.au <http://lists.xymon.com/mailman/listinfo/xymon><mailto:jlaidman at rebel-it.com.au <http://lists.xymon.com/mailman/listinfo/xymon>>> wrote: For this reason, it seems to make sense that the "link" lines are probably the best for this, as I would think that they would show packets contained only in physical frames (ethernet or some other medium). So I'm proposing that the FreeBSD client be adjusted from this: echo "[ifstat]" netstat -i -b -n | egrep -v "^lo|<Link" To this: echo "[ifstat]" netstat -i -b -n | egrep "<Link" Seem reasonable? Would anyone be adversely impacted by this suggested change? Anyone? Nobody else using FreeBSD? I've implemented a work-around that works for me, by using the following line in xymonclient-freebsd.sh: netstat -ibn|egrep "<Link|Name"| grep -v ^lo | while read A B C D E F G; do [ $A = "Name" ] || { C=0.0.0.0/0<http://0.0.0.0/0 <http://0.0.0.0/0>>; D=0.0.0.0; }; printf "%-5s %5s %-13s %-17s %12s %6s %14s %14s %6s %14s %6s\n" $A $B $C $D $E $F $G; done The output now only includes interface lines with "<Link" that are not loopback devices (thus ignoring all the non-physical entries), and the "<Link#1>" and MAC address lines have been replaced with dummy values that parse correctly on the server. I now have useful interface graphs for my FreeBSD systems. This is an ugly hack, and I only want this in place until a proper solution can be implemented. So, I'm proposing that the xymonclient-freebsd.sh script be modified to use this line for [ifstat]: netstat -ibn | egrep "<Link|Name"|grep -v ^lo (This could leave the loopback addresses in place, and I don't think anyone would mind.) Then, the following (untested) patch to do_ifstat.c. What say ye all? Cheers Jeremy --- do_ifstat.c.orig 2014-02-20 13:35:33.000000000 +1100 +++ do_ifstat.c 2014-02-20 13:42:32.000000000 +1100 @@ -27,8 +27,10 @@ /* Name MTU Network IP Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll */ /* lnc0 1500 172.16.10.0/24<http://172.16.10.0/24 <http://172.16.10.0/24>> 172.16.10.151 26 - 1818 26 - 1802 - */ +/* Name MTU Network Address Ipkts Ierrs Ibytes Opkts Oerrs Obytes Coll */ +/* em0 1500 <Link#1> 00:11:22:33:44:55 26 - 1818 26 - 1802 - */ static const char *ifstat_freebsd_exprs[] = { - "^([a-z0-9]+)\\s+\\d+\\s+[0-9.\\/]+\\s+[0-9.]+\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+ <smb://s+//d+//s+[0-9.///]+//s+[0-9.]+//s+//d+//s+[0-9-]+//s+(//d+)//s+//d+//s+[0-9-]+//s+(//d+)//s+>[0-9-<file:///\\s+\d+\s+%5b0-9.\%5d+\s+%5b0-9.%5d+\s+\d+\s+%5b0-9-%5d+\s+(\d+ <file:///s+/d+/s+%5b0-9./%5d+/s+%5b0-9.%5d+/s+/d+/s+%5b0-9-%5d+/s+(/d+>)\s+\d+\s+%5b0-9-%5d+\s+(\d+)\s+%5b0-9->]+" + "^([a-z0-9]+)\\s+\\d+\\s+<Link#\\d+>\\s+[:0-9]+\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+\\d+\\s+[0-9-]+\\s+(\\d+)\\s+ <smb://s+//d+//s+<Link#//d+>//s+[:0-9]+//s+//d+//s+[0-9-]+//s+(//d+)//s+//d+//s+[0-9-]+//s+(//d+)//s+>[0-9-<file:///\\s+\d+\s+%3cLink%23\d+%3e\s+%5b:0-9%5d+\s+\d+\s+%5b0-9-%5d+\s+(\d+ <file:///s+/d+/s+%3cLink%23/d+%3e/s+%5b:0-9%5d+/s+/d+/s+%5b0-9-%5d+/s+(/d+>)\s+\d+\s+%5b0-9-%5d+\s+(\d+)\s+%5b0-9->]+" }; /* Name Mtu Network Address Ipkts Ierrs Idrop Ibytes Opkts Oerrs Obytes Coll */ ********************************************************************** This message is intended for the addressee named and may contain privileged information or confidential information or both. If you are not the intended recipient please delete it and notify the sender. **********************************************************************

2 4

Trigger a script from xymon webpage
by kothari.raunak＠gmail.com 16 Dec '15

16 Dec '15

Hi everyone, Let me explain what I am trying to do. Let's say we have some monitoring on our servers in xymon which can alert us when something goes wrong. The corrective action for such events is normally to have our support team restart some service or follow some remedial procedure, most of which could be automated. The issue many a time is the access into the system during non office hours. The support staff may not be able to access the system immediately and so would like to explore if there is any way to trigger any scripts etc from the xymon webpages. Sort of like clicking any buttons on the webpage could be enabled to trigger a customer script ? Is it possible to do this using xymon, do share if someone has any experience with this. Thanks. Regards, Raunak

2 1

your opinion on Xymon HA (or dual server config).
by rbadilla＠grupocesa.com 16 Dec '15

16 Dec '15

Hi: The new site administrator has been happy with the simplicity and usability of Xymon. Then have asked for more changes over our actual config. Currently I have one (kind of resource limited) Sparc V210 as xymon server. But have find out then sometimes the apache or xymond process coredump by some mistakes or changes. Sometimes we notice when this happen so just restart the process or server. But when the problem arises and we don't notice the problem; after 8 hours there is a lot of rrd data that can't be showed. (We can't send sms or emails out of the site domain). So my boss have asked to make an another xymon server; to workout changes on one and keep the other with the older config till the new changes are "stable". I have read the HA section but I'm unsure that can justify a cluster. So my question is if I have two xymon servers with the same config and tell the clients that report to both of them; can this scenario accomplish the task ? I think that my boss is requesting a kind of pre-production/ production config. So I though two same config servers fit the scenario or must use the cluster ?? Any input is welcome! Thanks a lot! -- ------------------------------ CONFIDENCIALIDAD - La información contenida en este mensaje es confidencial y se dirige únicamente a su destinatario. Si usted lector de este mensaje no es ese destinatario, la diseminación, distribución o copia del mismo o sus adjuntos (de existir) se encuentran prohibidos. Si lo ha recibido por error, por favor notifique de manera inmediata por correo y destruya las copias de su correo. CONFIDENTIALITY STATEMENT - The information contained in this message is confidential and intended only for the addressee. If the reader of this message is not the intended recipient you are notified that any dissemination, distribution or copy of this message and attachments (if any) is strictly prohibited. If you have received this in error, please immediately notify us by reply email, destroy all copies and remove from all media. ------------------------------

3 2

clientconfig.cfg not getting updated
by colin.coe＠gmail.com 16 Dec '15

16 Dec '15

Hi all I'm noticing that the Windows Powershell Xymon client isn't being updated to reflect changes in client-local.cfg. I had thought that changes on the Xymon server to client-local.cfg would result in changes on the Windows clients. Am I wrong here, and if so, what's the correct way to get these changes propagated out? I'm wanting the following to be pushed out to the clients: --- tail -n 2 /etc/xymon/client-local.cfg [os=powershell] clientversion:2.04:http://benmon1p.scada.horizonpower.com.au/pub/ --- clientlocal.cfg contains: --- eventlog:security ignore success ignore Success ignore "The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer" eventlog:system ignore "Contact the administrator to install the driver before you log in again" tssessions adreplicaton --- Thanks CC

3 16

issue of runclient.sh on Solaris 10 Generic_147148-26
by rbadilla＠grupocesa.com 15 Dec '15

15 Dec '15

Hi: I'm recently updating xymon clients and find out the both Sparc or X86 Machines with Solaris 10+recent patches have problems with the tr command. For example with my xymon server [Time:14:48 User:monitor]$ uname -a SunOS hssapl08 5.10 Generic_142900-06 sun4u sparc SUNW,Sun-Fire-V210 [Path:/trabajo/monitor/client] [Host:hssapl08 Zone:global] [Time:14:48 User:monitor]$ cat /etc/release Solaris 10 10/08 s10s_u6wos_07b SPARC Copyright 2008 Sun Microsystems, Inc. All Rights Reserved. Use is subject to license terms. Assembled 27 October 2008 the xymon the runclient.sh script have SERVEROSTYPE="`uname -s | tr '[ABCDEFGHIJKLMNOPQRSTUVWXYZ/]' '[abcdefghijklmnopqrstuvwxyz_]'`" # This systems operating system in lowercase works fine. But recent solaris 10 with patches (almost all machines use the same .profile with KSH) don't pick /usr/ucb/tr instead use /usr/bin/tr which cause "Bad string" as output. Then the xymon client don't start fine. -- Meanwhile I have modified the runclient.sh to SERVEROSTYPE="`uname -s | /usr/ucb/tr '[ABCDEFGHIJKLMNOPQRSTUVWXYZ/]' '[abcdefghijklmnopqrstuvwxyz_]'`" # This systems operating system in lowercase then allowing to run the client. Since Oracle Solaris® 11 team have stated the /usr/ucb utilities will be deprecated some time after Solaris 11.3; I think this issue could be relevant. I'm playing the /usr/bin/tr to acomplish the task and then post findings. Thanks a lot by this wonder software (xymon). -- ------------------------------ CONFIDENCIALIDAD - La información contenida en este mensaje es confidencial y se dirige únicamente a su destinatario. Si usted lector de este mensaje no es ese destinatario, la diseminación, distribución o copia del mismo o sus adjuntos (de existir) se encuentran prohibidos. Si lo ha recibido por error, por favor notifique de manera inmediata por correo y destruya las copias de su correo. CONFIDENTIALITY STATEMENT - The information contained in this message is confidential and intended only for the addressee. If the reader of this message is not the intended recipient you are notified that any dissemination, distribution or copy of this message and attachments (if any) is strictly prohibited. If you have received this in error, please immediately notify us by reply email, destroy all copies and remove from all media. ------------------------------

1 0

upgrade from BigBrother to Xymon
by patrik_xymon＠outlook.com 14 Dec '15

14 Dec '15

Dear Xymon-Team I have some question about the Xymon Server. Can I upgrade from a BigBrother Server (Windows Server 2003) to a Xymon Server (UNIX)? Works Xymon on Windows Operating System (newer than Windows Server 2003)? Should I installing a ubuntu server version or will be ok when i installing ubuntu desktop version? Thanks for the answer best regards Patrik Nussbaumer

5 7

Bug in findhost ?
by fclaire＠free.fr 14 Dec '15

14 Dec '15

Hi, I have troubles using the findhost feature with the "Jump to page" box checked. On my xymon server the result URL is using localhost instead of my xymon server's FQDN. This problem seems to be reproducible on www.xymon.com: - go to https://www.xymon.com/xymon-cgi/findhost.sh - enter "ipgw" in the search field - hit the search button - you're redirected towards http://vxymon.hswn.dk/services/#ipgw.hswn.dk Host vxymon.hswn.dk doesn't exist. On my system it's redirecting to http://localhost. 2 questions: - why is the xymon server hostname changing and is there a place to configure it for findhost's answer ? - why is the answer redirecting to http when the query was done on a https URL ? I looked into findhost.c but didn't have enough time to understand how all of this works. Cheers, Francois.

2 4