February 2015 - Xymon - Xymon mailman web

Xymon PowerShell Windows client
by BDale＠kitchengroup.com.au 23 Feb '15

23 Feb '15

Hi Zak, I have been testing this on a few machines and playing around with it. I'm trying to work out how best to handle the rules for filtering and alerting on event logs if there are both bbwin and PowerShell clients being used as the PowerShell client is slightly different in the way it collects the event logs. Question 1: In bbwin the raw data contains: [collector:] client testserver01.bbwin win32 In the updated PowerShell client it contains: [collector:] client testserver01.powershell PowerShell XymonPS on the xymon server in client-local.cfg I have a setup like this. [win32] eventlog:security:10240 ignore blahblahblah eventlog:system:10240 ignore blahblahblah eventlog:application:10240 ignore blahblahblah and then in analysis.cfg: CLASS=win32 LOG %.* %^critical.* COLOR=red LOG %.* %^error.* COLOR=red LOG %.* %^failure.* COLOR=yellow LOG %.* %^warning.* COLOR=yellow I don't think Bbwin has an equivalent to the eventlogswanted:event_log_name:max_size command it seems to just pull all the event logs by default (all the logs listed in Get-EventLog -List | FT log). Now because bbwin pulls all the logs by default, if I have a situation like the example below I get all the event logs on both servers and filters listed in client-local.cfg apply to the security,application,system logs which are the ones that contain most of the noise. Example two servers, event logs collected in bbwin by default: Server 1 (generic member server, nothing special) [msgs:eventlog_application] [msgs:eventlog_hardwareevents] [msgs:eventlog_internet explorer] [msgs:eventlog_key management service] [msgs:eventlog_security] [msgs:eventlog_system] [msgs:eventlog_windows PowerShell] Server 2 (Domain Controller) [msgs:eventlog_application] [msgs:eventlog_dfs replication] [msgs:eventlog_directory service] [msgs:eventlog_dns server] [msgs:eventlog_file replication service] [msgs:eventlog_internet explorer] [msgs:eventlog_security] [msgs:eventlog_system] You can see the extra event logs present on the domain controller. In the PowerShell client I can't work out how I can replicate this behaviour as by default it only collects Application,System,Security logs. I know I can specify additional logs using wantedeventlogs but I can't see how I can do that in a single general rule It seems like I would need to either 1. Have an entry in client-local.cfg under [PowerShell] with eventlogswanted and list every possible event log, this would mean on all clients these would display under msgs even if the log doesn't exist on the client 2. Create a separate entry with the [hostname] in client-local.cfg for each server where I want to collect anything outside of the three default logs and then list the ignore filters each time. Have I misunderstood how this works or is there an easy way to replicate the same behaviour as bbwin? Question 2: I read through the documentation but I can't work out what is the advantage of setting any of these to 1: EnableWin32_Product, EnableWin32_QuickFixEngineering, EnableWMISections ? I understand they are disabled by default for performance but what do you actually gain if you enable them? I can see you get more info in the raw data but how is this used for the tests in xymon? Question 3: Would it be worth adding a filter to the client so get-winevents only returns critical,error,failure,warning events rather than everything. That would remove the need to have as many ignore rules in the client-local.cfg and I am guessing most people don't alert on events that are level=information. From memory I think that is how the original PowerShell client worked. I think ideally you should be able to specify this in the config xml or something similar. Regards, Brandon From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of zak.beck at accenture.com Sent: Friday, 13 February 2015 8:53 PM To: xymon-developer at lists.sourceforge.net; xymon at xymon.com Subject: [Xymon] Xymon Powershell Windows client Hi all, Today I have uploaded a new version of the Xymon Powershell client to SVN (in sandbox/WinPSClient). We (Accenture) are very pleased to be contributing these changes to the open source community. I've been working on this now for around 8 months on and off and hopefully the changes made will be of benefit to everyone! Whilst making changes, we have focussed mainly on making it work, improving reliability and most importantly improving performance. In most cases, on our 64 bit OS virtual machines, a data collection now takes around 5 seconds. On heavily loaded (CPU load or event log load) servers, the script is now considerably faster than originally. Key to this has been reducing the amount of WMI usage as this was a major culprit. We have also implemented some new features, largely based on our in-house requirements but hopefully useful to others: * Showing the process owner and command line in [procs]. This has been implemented using c# code, compiled at runtime. * Adding Active Directory replication test, Terminal Services sessions test * Ability to restart any stopped Windows service * Client self-update * Dirsize and dirtime checks (which were originally external scripts) Some things have changed slightly; for example, the local configuration which was registry-based is now XML-based (you can still use registry settings if you prefer). In the SVN repository I have also uploaded a Word document which describes how to install and the configuration options. I have uploaded all the revisions we have made to SVN so there is a history of development. Whilst we will endeavour to continue contributing changes and improvements in coming months, this is an open source project and as such we are not offering any formal support. If anyone wishes to bugfix, branch or whatever, please do so! Zak Beck Accenture

2 2

xymonclient.ps1 questions
by zak.beck＠accenture.com 23 Feb '15

23 Feb '15

Hi Martin At the moment you're correct, dirsize does not support files. We had reason to amend dirtime to support files, so I can put this on the todo list. Secondly, I've not seen that error before but then it does look like you're using double your total :) - might be something weird in the way Windows is reporting back the data. Memory Used Total Percentage clear Actual 8734M 4096M 0% - invalid data Zak From: Henrik Størner [mailto:henrik at hswn.dk] Sent: 20 February 2015 05:36 To: martin.wojak at delwp.vic.gov.au; Beck, Zak Subject: Re: xymonclient.ps1 questions Hi Martin, I'm glad that You like Xymon and find it useful. You really should post questions on the mailing list xymon at xymon.com <mailto:xymon at xymon.com> . First, a lot of helpful people there to answer questions - so you are more likely to get a fast reply. Second, questions sent to the mailing list end up in the mail archives, so others can search for them and find the answers. Best regards, Henrik Størner Den 20-02-2015 kl. 00:43 skrev martin.wojak at delwp.vic.gov.au <mailto:martin.wojak at delwp.vic.gov.au> : Hi Zak and Henrik, First off, I love the xymon powershell client! Totally awesome work! I'm a sys admin in Melbourne, Victoria, Australia, looking after about 300 servers (windows and linux - all in Xymon), that support the Bushfire staff around Victoria. I have a couple of quick questions around the xymon ps client... I use dirsize and it works great, but can't find a file size checker? How can a run external VBS scripts, like I used to with bbwin? (eg. winUpdates.vbs, WinUpdateReboot.vbs) The Memory column (report) shows up an error on "Actual": Fri 20 Feb 10:32:05 2015 - Memory OK Memory Used Total Percentage green Physical 1976M 4096M 48% clear Actual 8734M 4096M 0% - invalid data green Swap 10818M 13935M 77% Thanks! Let me know if I should be posting these to the Xymon forums, rather than direct email? Thanks, Martin. Martin Wojak | Senior Infrastructure Support Officer (Fire) |Information Services Division Corporate Services | Department of Environment, Land, Water & Planning Level 9, 8 Nicholson St, East Melbourne, Victoria 3002 T: 03 9637 8470 | M: 0421 445 529 | E: martin.wojak at delwp.vic.gov.au <mailto:martin.wojak at delwp.vic.gov.au>

1 0

Allow HTML email from xymon?
by glauber.ribeiro＠experian.com 20 Feb '15

20 Feb '15

Has there been any consideration about allowing HTML email from xymon alerts? HTML email may be a good fit, since the same text is used for onscreen alerts (which are in HTML) and email alerts. glauber

1 1

4.3.18 install issues. /home/xymon permissions, missing FollowSymLinks
by landrew＠pnnl.gov 20 Feb '15

20 Feb '15

FYI, I installed xymon-4.3.18 from scratch last week, and ran into a couple of problems. The system I installed on is running RedHat Enterprise Linux v5.11, and I used almost all default answers in the Configure setup (changed location of man pages to /usr/local/share/man from /usr/local/man, if I recall.) First was that I installed xymon into its own home directory (/home/xymon), and I needed to change directory permissions so the web server (running as login 'apache') could see any of the xymon directory. By default, home directories are set to mode 700 (user only.) I added group read and execute permissions and added user 'apache' to the 'xymon' group, although I'm not sure if this exposes more than should be exposed. I also added user 'xymon' to the 'apache' group when I created the login. Secondly, I needed to add "FollowSymLinks" to the cgi options sections in the apache config file for xymon before any of the scripts would work. Once that was in place, and Apache restarted, we seemed to have a working xymon install. I'm assuming when doing a "./configure --server" I'm also configuring the client (as it's now running on the server.) Can I just grab a tarball of the /home/xymon/client directory and use it for client installations on the same architecture systems, or do I need to run a separate configure and build for "--client"? -Andrew

3 3

Renaming a test from UPPERCASE to NormalCase
by christian.becker＠rhein-zeitung.net 20 Feb '15

20 Feb '15

All, i want to rename a test column from UPPERCASE to NormalCase. I tried this using the command: xymon localhost "rename MYHOST DATANODE DataNode" Unfortunately this doesn't seem to work. I did restart the webserver (apache2), the Xymon services, I did drop the test and the whole node MYHOST, all without success. Even if I "hover" with the mouse over the test column DATANODE, the link pointing the the test page still points to a link URL containin the keyword DATANODE and not DataNode. Is there anything I'm missing or anythind I did the wrong way? My Xymon is 4.3.11. Regards Christian Christian Becker IT-Services Christian.Becker at rhein-zeitung.net<mailto:Christian.Becker at rhein-zeitung.net> _________________________________ Mittelrhein-Verlag GmbH August-Horch-Straße 28 D-56070 Koblenz Verleger und Geschäftsführer: Walterpeter Twer Reg.-Gericht Koblenz HRB 121 Finanzamt Koblenz Str.Nr. 22 65 10 285 2 www.rhein-zeitung.de<http://www.rhein-zeitung.de/>

9 18

Hellow
by jeremy.ruffer＠gmail.com 20 Feb '15

20 Feb '15

How about apt-get install xymon Jeremy Sent from my iPad > On 19 Feb 2015, at 15:25, Ales Krek via Xymon <xymon at xymon.com> wrote: > > <mime-attachment> > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

2 1

display of last scheduled disable still broken in 4.3.18?
by g.stone-tolcher＠its.uq.edu.au 20 Feb '15

20 Feb '15

Hi, Can the fix to display scheduled disabled tests as per http://lists.xymon.com/pipermail/xymon/2014-July/039947.html please be committed to the next release. I am still seeing the same issue with 4.3.18. Cheers, Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au> ITS: Service. Team. Accountability. Results. IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include. Please consider the environment before printing this email. CRICOS Code 00025B

3 2

xymon file size checking
by martin.wojak＠delwp.vic.gov.au 20 Feb '15

20 Feb '15

I'm using the new Xymon Powershell Client (xymonclient.ps1). I use dirsize and it works great for directories, but can't find a file size checker? Thanks, Martin.

2 2

Blocking unwanted agents reporting
by jlaidman＠rebel-it.com.au 20 Feb '15

20 Feb '15

It's worth noting that --status-senders limits what IP addresses can send updates on behalf of other IP addresses. It does not stop hosts from sending updates from their own IP address, even if not listed in --status-senders. So I could just set --status-senders=127.0.0.1 and it should not stop me getting updates from any devices. On 20 February 2015 at 09:45, Eli via Xymon <xymon at xymon.com> wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From: Eli <eliap09 at yahoo.com> > To: Torsten Richter <bb4 at richter-it.net> > Cc: xymon at xymon.com > Date: Thu, 19 Feb 2015 15:45:45 -0700 > Subject: Re: [Xymon] Blocking unwanted agents reporting > Thanks much that helpful. I wish I can block by host name. :) > > > > Torsten Richter <bb4 at richter-it.net> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Eli, > > take a look at the manpage of xymond. > There are several command line options for this binary which control who > can send status messages, maintenance commands or admin commands to the > server. > In your case you might want to add something like > --status-senders=IP/MASK > to tasks.cfg into the [xymond] block to allow status updates only from > IP/MASK. > > HTH > Torsten > > On 19.02.2015 16:57, Eli via Xymon wrote: > > _______________________________________________ > > Xymon mailing list > > Xymon at xymon.com > > http://lists.xymon.com/mailman/listinfo/xymon > > > > - -- > +---------------------------------------------------------+ > | E-mail : bb4 [at] richter-it.net | > | | > | Homepage: http://www.richter-it.net/ | > +---------------------------------------------------------+ > Download my public key from: > http://gpg-keyserver.de/pks/lookup?search=0x899093AC&op=get > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (MingW32) > > iEYEARECAAYFAlTmCtsACgkQ7DlmxomQk6xWEgCePYNSNc3IPASBFcJqvZaXD5yn > 3yMAoLNWKvC7ps7gINSvpVwLR06HQKHp > =jH6r > -----END PGP SIGNATURE----- > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > >

1 0

xymon powershell client and external scripts
by martin.wojak＠delwp.vic.gov.au 20 Feb '15

20 Feb '15

I'm using the new Xymon Powershell Client (xymonclient.ps1). How can a run external VBS scripts, like I used to with bbwin? (eg. winUpdates.vbs, WinUpdateReboot.vbs) Thanks, Martin.

1 0