February 2015 - Xymon - Xymon mailman web

Intermediate cert monitoring
by jlaidman＠rebel-it.com.au 28 Feb '15

28 Feb '15

> I'm no expert but I think this has to do with a "certificate chain". In theory, the TLS server only needs to give it's own certificate to the TLS client, or it can optionally send other (intermediate) certificates in the chain, to save the client having to go find them. In practice, the client isn't able to locate the intermediate certificates and so the server generally provides all certificates in the chain as a "certificate bundle". > > Configuring a web server with only the server's land certificate works just fine if there are no intermediate certificates, such as when the server certificate was issued by a root CA because the client already has the for CA in its trusted certificate store.. But if it was issued by an intermediate CA then the intermediate certificate will not be in the store. > > The web server should be configured with all certificates in the chain, but sometimes it's not. In such cases it may be possible for libssl (and hence Xymon) to obtain the intermediate certificates and validate them, but not a browser. > > Actually, I suspect that libssl doesn't validate a trust chain anyway, because unlike a browser, libssl probably has no certificate store. So libssl only checks the reasonableness of a certificate and it's expiry date. > > J > > On 28/02/2015 2:24 PM, "Ralph Mitchell" <ralphmitchell at gmail.com> wrote: >> >> Having the Xymon server validate the intermediate certificates won't help if they're missing off the server that owns the certificate. The Xymon server would have the certs installed and always get a match. >> >> Where are the intermediate certs missing? Does the web server even start properly if it can't validate its own cert? >> >> Ralph Mitchell >> >> >> >> On Thu, Feb 26, 2015 at 1:51 PM, Eli via Xymon <xymon at xymon.com> wrote: >>> >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >>> >>> ---------- Forwarded message ---------- >>> From: Eli <eliap09 at yahoo.com> >>> To: Mark Felder <feld at feld.me> >>> Cc: xymon at xymon.com >>> Date: Thu, 26 Feb 2015 11:50:43 -0700 >>> Subject: Re: [Xymon] Intermediate cert monitoring >>> The issue was missing or not installed. As you know newer browsers doesn't have problem but the older one show cert error when the intermediate cert missing. We have bunch of cert so some time engineers forget to install the intermediate cert and caused issue. >>> >>> >>> Mark Felder <feld at feld.me> wrote: >>> >>> What was the exact problem with the intermediate certificate? What >>> should be monitored? Maybe we can come up with a way to add additional >>> monitoring parameters to Xymon's SSL monitoring if we know exactly what >>> should be monitored. >>> >>> My first guess is expiration, but I'm not sure if you can sign a cert if >>> it expires after your intermediate is due to expire. The only other >>> thought is if the chain was incomplete... >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >> >> >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon >>

2 2

Intermediate cert monitoring
by ralphmitchell＠gmail.com 28 Feb '15

28 Feb '15

Having the Xymon server validate the intermediate certificates won't help if they're missing off the server that owns the certificate. The Xymon server would have the certs installed and always get a match. Where are the intermediate certs missing? Does the web server even start properly if it can't validate its own cert? Ralph Mitchell On Thu, Feb 26, 2015 at 1:51 PM, Eli via Xymon <xymon at xymon.com> wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From: Eli <eliap09 at yahoo.com> > To: Mark Felder <feld at feld.me> > Cc: xymon at xymon.com > Date: Thu, 26 Feb 2015 11:50:43 -0700 > Subject: Re: [Xymon] Intermediate cert monitoring > The issue was missing or not installed. As you know newer browsers doesn't > have problem but the older one show cert error when the intermediate cert > missing. We have bunch of cert so some time engineers forget to install the > intermediate cert and caused issue. > > > Mark Felder <feld at feld.me> wrote: > > What was the exact problem with the intermediate certificate? What > should be monitored? Maybe we can come up with a way to add additional > monitoring parameters to Xymon's SSL monitoring if we know exactly what > should be monitored. > > My first guess is expiration, but I'm not sure if you can sign a cert if > it expires after your intermediate is due to expire. The only other > thought is if the chain was incomplete... > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > >

1 0

Intermediate cert monitoring
by eliap09＠yahoo.com 28 Feb '15

28 Feb '15

I read someone used script on this forum on the past but the answer not include the script anymore. I am really appreciate if some one give me some idea. Thanks! Eli via Xymon <xymon at xymon.com> wrote: >_______________________________________________ >Xymon mailing list >Xymon at xymon.com >http://lists.xymon.com/mailman/listinfo/xymon

1 0

Running server-side custom test more often than every 5 minutes
by glauber.ribeiro＠experian.com 27 Feb '15

27 Feb '15

I had this problem again today... this time I used the "1m" syntax, and it worked (good), but it still took 2 xymon server restarts (after waiting about 1/2 hour and not seeing a change) for xymon to pick up the change. I even made innocuous changes to tasks.cfg to see if that would trigger an update. It's not a big deal anyway. g -----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Ribeiro, Glauber Sent: Friday, February 13, 2015 13:57 To: J.C. Cleaver Cc: xymon at xymon.com Subject: Re: [Xymon] Running server-side custom test more often than every 5 minutes I waited about 15 minutes, before I changed from "1m" to "60". I was suspicious it wouldn't pick up a change in an include file, so I restarted xymon server after each change. g -----Original Message----- From: J.C. Cleaver [mailto:cleaver at terabithia.org] Sent: Friday, February 13, 2015 13:52 To: Ribeiro, Glauber Cc: xymon at xymon.com Subject: Re: [Xymon] Running server-side custom test more often than every 5 minutes Hmm. 1m *should* be a valid syntax since, as you'd indicated, it's used elsewhere. The appropriate parts are in xymonlaunch.c as well, even in 4.3.10. You mentioned it was an include file; I seem to recall occasional issues back then where include'd files didn't always get walked for changes, but my testing shows this to be working. Do you know about how long xymonlaunch was running it in 5m intervals after having changed it to 1m? Regards, -jc _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

XymonPowershellClient RRD collect graphing long mountpoint names
by g.stone-tolcher＠its.uq.edu.au 27 Feb '15

27 Feb '15

I think what to do with very long mount point names is going to be an issue. I have a suggestion for Zak that he might consider. You could use the "Label" in the "Mounted" field rather than the Filesystem, if the Filesystem is not a single letter driveletter (i.e not a mount point). It seems that most people, like the example below, use short unique Labels for their mount points. This could make RRD collection/graphing work more reliably? Cheers Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au> ITS: Service. Team. Accountability. Results. IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include. Please consider the environment before printing this email. CRICOS Code 00025B From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Ang, Denver Sent: Thursday, 26 February 2015 7:11 AM To: zak.beck at accenture.com Cc: xymon at xymon.com Subject: Re: [Xymon] XymonPowershellClient Yes! It is showing the Mountpoint but not all of them appear in the graph. Nevertheless, it's a great improvement. Below is a screenshot: [cid:image001.jpg at 01D051B4.402B0A30] Again, thank you! Denver From: zak.beck at accenture.com [mailto:zak.beck at accenture.com] Sent: Wednesday, February 25, 2015 3:38 AM To: Ang, Denver Cc: xymon at xymon.com Subject: RE: XymonPowershellClient Hi The latest commit includes Windows mountpoints in the disk list - does this do what you're expecting? Thanks Zak From: Ang, Denver [mailto:Denver.Ang at tamucc.edu] Sent: 24 February 2015 15:53 To: Beck, Zak Cc: xymon at xymon.com<mailto:xymon at xymon.com> Subject: RE: XymonPowershellClient Thanks! Looking forward to it. Denver From: zak.beck at accenture.com<mailto:zak.beck at accenture.com> [mailto:zak.beck at accenture.com] Sent: Monday, February 23, 2015 2:43 AM To: Ang, Denver Cc: xymon at xymon.com<mailto:xymon at xymon.com> Subject: RE: XymonPowershellClient Hi Windows mountpoints are on the todo list. Thanks Zak From: Ang, Denver [mailto:Denver.Ang at tamucc.edu] Sent: 19 February 2015 21:23 To: Beck, Zak Subject: XymonPowershellClient Hi Zak, Can you revise the code so that it will show the LUNS in the mountpoints? Denver Ang Systems Administrator II Information Technology Texas A&M University - Corpus Christi (361) 825-2854

3 2

Duplicated recovery alerts
by larry＠fni-stl.com 27 Feb '15

27 Feb '15

I've had a long term problem with receiving duplicated recovery alerts. Only with a small number of tests. Most of them seem to have an underscore or dash in the test name. But not always. On the alerting side I'm not getting any duplication. Only on recovery. Now using 4.3.18 on RHEL 6.6. It's like the IGNORE line is not getting read during the recovery phase. In my example below, line 386 should be the only alert I receive. And it is during alerting. Any advice would be appreciated. Larry B. # Email subject lines for the duplicated recovery notices. cfid:386 should be the only one. Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:409] Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:386] Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:550] # xymon/server/etc/hosts.cfg 0.0.0.0 qa_ccsic_ccs_red_alert # noconn nosslcert https://<internal_URL>/cgi-bin/ccs_red_alert.pl # related alerts.cfg sections # should be handled in this section and stop 384 PAGE=%url/FNIBOCS HOST=%(qa|test|launch)_ccsic_ccs.*_(redalert|red_alert) EXSERVICE=sslcert 385 MAIL <various_internal_email_addresses> DURATION>2 REPEAT=60 RECOVERED 386 --> MAIL <internal_systems_group_address> DURATION>2 REPEAT=60 RECOVERED COLOR=yellow,red 387 IGNORE # Matches this rule but should have not gotten past the above rule 384 407 PAGE=%url/.* EXSERVICE=sslcert 408 MAIL <various_internal_email_addresses> DURATION>2 REPEAT=60 RECOVERED COLOR=yellow,red 409 --> MAIL <internal_systems_group_address> DURATION>2 REPEAT=60 RECOVERED COLOR=yellow,red 410 ... 411 ... 412 ... 413 ... 414 ... 415 ... 416 ... 417 ... 418 SCRIPT /data/bin/xymon-page.sh sys DURATION>2 FORMAT=SCRIPT REPEAT=60 RECOVERED COLOR=red,purple 419 IGNORE # Catch all rule 548 HOST=* EXSERVICE=%$NoNotifySvc EXHOST=%$Windows|$NoPage|$SLA_MF66|$SLA_MF66_ESX EXPAGE=%(dev|uatest) 549 ... 550 --> MAIL <internal_systems_group_address> REPEAT=1440 RECOVERED COLOR=yellow,red 551 SCRIPT /data/bin/xymon-page.sh sys FORMAT=SCRIPT REPEAT=60 RECOVERED COLOR=red 552 IGNORE ========================================================= Larry D. Bonham Financial Network Inc. 10401-F Baur Olivette, MO 63132 (314) 400-9412 voice (314) 997-5647 fax ========================================================= ________________________________ CONFIDENTIALITY NOTICE: This electronic mail message is intended exclusively for recipient to which it is addressed. The contents of this message and any attachments may contain confidential and privileged information. Any unauthorized review, use, print, storage, copy, disclosure or distribution is strictly prohibited. If you have received this message in error, please advise the sender immediately by replying to the message's sender and delete all copies of this message and its attachments without disclosing the contents to anyone, or using the contents for any purpose.

1 0

Xymon client doesn't clean up all of its children
by feld＠feld.me 26 Feb '15

26 Feb '15

~~ I can't verify on other OSes right now, so I'm hoping someone can chime in ~~ On FreeBSD when I stop the Xymon client process it doesn't clean up all of its children. Primarily you'll find that the vmstat command is not sent a signal and continues to run ... indefinitely? As a result, restarting the Xymon client leaves vmstat processes around that really should not be there. I'm working around this right now, but is it possible this is being seen on other platforms and it's a bug in the client shutdown code? Thanks!

5 9

Intermediate cert monitoring
by eliap09＠yahoo.com 26 Feb '15

26 Feb '15

The issue was missing or not installed. As you know newer browsers doesn't have problem but the older one show cert error when the intermediate cert missing. We have bunch of cert so some time engineers forget to install the intermediate cert and caused issue. Mark Felder <feld at feld.me> wrote: >What was the exact problem with the intermediate certificate? What >should be monitored? Maybe we can come up with a way to add additional >monitoring parameters to Xymon's SSL monitoring if we know exactly what >should be monitored. > >My first guess is expiration, but I'm not sure if you can sign a cert if >it expires after your intermediate is due to expire. The only other >thought is if the chain was incomplete... >_______________________________________________ >Xymon mailing list >Xymon at xymon.com >http://lists.xymon.com/mailman/listinfo/xymon

1 0

Intermediate cert monitoring
by feld＠feld.me 26 Feb '15

26 Feb '15

What was the exact problem with the intermediate certificate? What should be monitored? Maybe we can come up with a way to add additional monitoring parameters to Xymon's SSL monitoring if we know exactly what should be monitored. My first guess is expiration, but I'm not sure if you can sign a cert if it expires after your intermediate is due to expire. The only other thought is if the chain was incomplete...

1 0

Intermediate cert monitoring
by eliap09＠yahoo.com 26 Feb '15

26 Feb '15

Is there any one monitor intermediate cert with xymon? We had issue on intermidate cert but xymon show green because only check the primary cert. Thanks, Elias

1 0