March 2015 - Xymon - Xymon mailman web

Xymon Digest, Vol 50, Issue 27
by A.Chervonets＠cominder.eu 01 Apr '15

01 Apr '15

Hello, Tracy I was going to make this too, but for some reasons it is not implemented yet. So if You will make this good - it would be very nice for many admins. Best regards, Andrey Chervonets ---------------------- "Xymon" <xymon-bounces at xymon.com> wrote on 28.03.2015 13:00:01: > Message: 2 > Date: Fri, 27 Mar 2015 11:02:57 -0500 > From: Tracy Di Marco White <gendalia at iastate.edu> > Message-ID: > <CAFAt0ET2na9abY+1MxS-Odr4tMa0ki6t2KRn8-p0cRaLNCXRig at mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi all, > > We've been adding a lot of servers and services to our xymon monitoring > deployment, and it's become somewhat more complex to manage changes to > monitored hosts/services, as well as what's critical when, and what alerts > are needed when. I'd like to deploy a web interface, with access controls > of course, where people can change what systems are monitored, and what > services on those systems are monitored, as well as what alerts they get > when. Because there is so much flexibility in xymon, this can get fairly > complex, and I want to add an error checking web interface to people's > ability to change these settings. > > Does anyone already have something like this? > > -Tracy

3 2

Run Single Test
by john＠executech.com 31 Mar '15

31 Mar '15

I'm currently running the DNSREG script. I'm querying over 250 domains and toward the end, the whois server blocks me so all of the domains after that point report red. I'm trying to figure out a way to fix that. It's set to run every 24 hours. 1) Is there a way to set it to check 50 domains every four hours or so instead of running all of them at midnight. 2) Does Xymon have a way to know when it queried the host last and then will wait, on that single host, 24 hours or will it just do all of them again after 24 hours? I did try putting a pause in the script and it wouldn't run at all after that. 3) When one does fail, I would like to run it later (when the registrar block has expired) for the 10 or so hosts that failed. I tried using bbcmd to kick off the script for just that host and just that test but nothing happened. (bbcmd bbtest-net domain.org.dnsreg) 4) I'm sure I can figure this out but if anyone knows off the top of their head: if the expires line returns blank (because no date could be found), how would I append the script to return a clear status instead of red? This is how I have the script set up: This is the cfg entry: [dnsreg] ENVFILE /usr/lib/hobbit/client/etc/hobbitclient.cfg CMD /usr/lib/hobbit/server/ext/dnsreg.sh LOGFILE $BBSERVERLOGS/bb-dnsreg.log INTERVAL 1440m This is the DNSREG file # Check DNS registrations in whois and warn when they are about to expire. # # NOTE: Requires a "whois" command that knows what servers to query. # Requires GNU date. # Should run only once a day. NOW=`date "+%s"` WARNTIME=`expr $NOW + 864000` # 10 days ALARMTIME=`expr $NOW + 432000` # 5 day /usr/lib/hobbit/server/bin/bbhostgrep dnsreg | while read L do set $L DOMAIN=$2 EXPIRESTRING="`whois $DOMAIN | egrep -i "Expires.*:|Expiration.*:|Renewal.*:|expir.*date:" | head -n 1 | cut -d: -f2- | sed -e's/^[ ]*//'`" EXPIRES=`date --date="$EXPIRESTRING" "+%s"` if test $EXPIRES -le $ALARMTIME then COLOR=red elif test $EXPIRES -le $WARNTIME then COLOR=yellow else COLOR=green fi $BB $BBDISP "status+90000 $DOMAIN.dnsreg $COLOR `date` Domain $DOMAIN expires on $EXPIRESTRING " done exit 0 John Tullis

2 5

remove or drop data with incorrect columns, with bad characters or perhaps linefeed as part of name
by sys1002＠yahoo.com 31 Mar '15

31 Mar '15

I have some bash scripts that do testing, and apparently because it is the last parameter read from a data file ( CSV) , it adds a linefeed or something. In the Hist and histlogs it shows up as a ? at the end of the name. How do I drop these, since they are all purple and alerting, after I fixed the issue. I really would like to keep all the other data, since it does have historical value( about 40 tests ) Thanks !

1 0

Reporting
by colin.coe＠gmail.com 30 Mar '15

30 Mar '15

Hi all I've been asked to report on the usage of some devices (Windows 7 tablet computers). I have not installed any agents but I've had them in the hosts.cfg file for a couple of months. All I need is to report on which devices have a 'conn' max of 0ms over 7, 14 and 28 days. Any ideas how I can get this info in text format? Thanks CC

3 6

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

> Try changing "df -hP" to "df -P" and see if that works better. this works! thanks a lot! I just wanted to increase the human readability and didn't think of problems which could arise. M -----Ursprüngliche Nachricht----- > Von:Jeremy Laidman <jlaidman at rebel-it.com.au> > Gesendet: Mon 30 März 2015 14:56 > An: Marcus Mundt <marcus.mundt at forsa.de> > CC: xymon at xymon.com > Betreff: Re: [Xymon] Error in parsing of filesystem usage when monitoring NFS mounts > > > > On 26 March 2015 at 21:37, Marcus Mundt <marcus.mundt at forsa.de <mailto:marcus.mundt at forsa.de>> wrote: > I monitor filesystems on one of my xymon clients. This went really well until switching to NFS. I managed to list and monitor the NFS mount, but the parsing of the transmitted string for the disk usage seems to go wrong at some point > > I would think that NFS-mounted filesystems would be monitored on the server that hosted them, rather than other servers that mount them. > > > #df -Pl -x iso9660 -x $EXCLUDES | sed -e /^[^ ][^ ]*$/{ > > > # without "l" lists NAS_BACKUP_DAILY> df -hP -x iso9660 -x $EXCLUDES | sed -e /^[^ ][^ ]*$/{ > > Youve replaced "df -Pl" with "df -hP". The "-h" changes the headers. This is important because the [df] parser specifically looks for columns with the titles "Available", "Capacity" and "Mounted" to work out what each column is for. By adding "-h" you instead get "Avail", "Use%" and "Mounted". I think when the column headers cant be found, the parser will assume that the values are in position 1, hence the "172" being interpreted as disk space usage. > > Try changing "df -hP" to "df -P" and see if that works better. > > J > >

1 0

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

Dear fellow xymon users, I monitor filesystems on one of my xymon clients. This went really well until switching to NFS. I managed to list and monitor the NFS mount, but the parsing of the transmitted string for the disk usage seems to go wrong at some point: Xymon says: /BACKUP (172% used) has reached the PANIC level (95%) But in reality, some lines below, it shows the correct value of 64%: 172.X.X.X:/Backup 26T 17T 9.3T 64% /BACKUP I guess xymon parses the IP address of the NFS and takes this as the disk usage. Any hints on how to edit the parsing or other help on how to solve this would be highly appreciated. Kind Regards, i. A. Marcus Mundt --------------------------------- forsa Gesellschaft für Sozialforschung und statistische Analysen mbH Schreiberhauer Straße 30 10317 Berlin Telefon: (0 30) 6 28 82-0 Telefax: (0 30) 6 28 82-4 00 E-Mail: Marcus.Mundt at forsa.de AG Berlin-Charlottenburg HRB 80391 Geschäftsführer: Prof. Manfred Güllner

3 2

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

Hello J. C., xymon client version 4.3.3 on openSUSE 13.1 (i586) in /home/xymon/client/bin/xymonclient-linux.sh I edited the excludes to get the info on the NFS: echo "[df]" #EXCLUDES=`cat /proc/filesystems | grep nodev | awk '{print $2}' | xargs echo | sed -e 's! ! -x !g'` EXCLUDES="sysfs -x rootfs -x bdev -x proc -x cgroup -x cpuset -x tmpfs -x devtmpfs -x d ebugfs -x securityfs -x sockfs -x pipefs -x anon_inodefs -x devpts -x ramfs -x hugetlbf s -x pstore -x mqueue -x autofs -x ncpfs -x binfmt_misc" #df -Pl -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ # without "l" lists NAS_BACKUP_DAILY df -hP -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' This is the client data reported in the web GUI: [df] Filesystem Size Used Avail Use% Mounted on /dev/sda1 15G 1.7G 12G 13% / /dev/sdc1 1.8T 1.3T 468G 74% /WD_BACKUP_WEEKLY /dev/sda2 21G 49M 20G 1% /home 172.X.X.X:/volume1/Backup 26T 17T 9.0T 65% /NAS_BACKUP_DAILY /dev/sdb1 1.8T 962G 780G 56% /WD_BACKUP_MONTHLY Xymon Server Version: 4.3.0-0.20101114.beta3 Thanks for any help! Found a similar entry in the Mailing List from 2008, but there is no solution provided as far as I can see. http://lists.xymon.com/archive/2008-January/016885.html All the best from Berlin, Marcus --------------------------------- forsa Gesellschaft für Sozialforschung und statistische Analysen mbH Schreiberhauer Straße 30 10317 Berlin Telefon: (0 30) 6 28 82-0 Telefax: (0 30) 6 28 82-4 00 E-Mail: Marcus.Mundt at forsa.de AG Berlin-Charlottenburg HRB 80391 Geschäftsführer: Prof. Manfred Güllner -----Ursprüngliche Nachricht----- > Von:J.C. Cleaver <cleaver at terabithia.org> > Gesendet: Don 26 März 2015 22:02 > An: Marcus Mundt <marcus.mundt at forsa.de> > CC: xymon at xymon.com > Betreff: Re: [Xymon] Error in parsing of filesystem usage when monitoring NFS mounts > > On Thu, March 26, 2015 3:37 am, Marcus Mundt wrote: > > Dear fellow xymon users, > > > > I monitor filesystems on one of my xymon clients. This went really well > > until switching to NFS. I managed to list and monitor the NFS mount, but > > the parsing of the transmitted string for the disk usage seems to go wrong > > at some point: > > > > Xymon says: > > /BACKUP (172% used) has reached the PANIC level (95%) > > > > But in reality, some lines below, it shows the correct value of 64%: > > 172.X.X.X:/Backup 26T 17T 9.3T 64% /BACKUP > > > > I guess xymon parses the IP address of the NFS and takes this as the disk > > usage. Any hints on how to edit the parsing or other help on how to solve > > this would be highly appreciated. > > > > > Marcus, > > Can you provide the OS type you're running on, along with a copy of the > full '[df]' section that's coming back in the client report? > > Also, which version are you running on the server? > > > Regards, > > -jc > > >

1 0

svcstatus.sh
by aleskrek＠yahoo.com 27 Mar '15

27 Mar '15

Hi me again. I was thinking that i fix it but i didn't. Today i try ed to open the detailed info on some monitored device and its the same problem like yesterday, the browser gives me only the download option of the svcstatus.sh. From yesterday when it worked i didn't edit anything. I don't know what to do. And another thing i don't have xymon-apache.conf in ~/server/etc/xymon-apache.conf. My "xymon-apache.conf" is only located in /etc/apache2/conf.d/xymon I'm sending you my apache.conf and xymon.conf Alias /xymon "/usr/lib/xymon/server/www" <Directory "/usr/lib/xymon/server/www"> Options Indexes FollowSymLinks Includes MultiViews Order allow,deny Allow from all </Directory> ScriptAlias /xymon-cgi "/usr/lib/xymon/cgi-bin" <Directory "/usr/lib/xymon/cgi-bin"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all </Directory> ScriptAlias /xymon-seccgi "/usr/lib/xymon/cgi-secure" <Directory "/usr/lib/xymon/cgi-secure"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all # Password file where users with access to these scripts are kept. # Create it with "htpasswd -c /usr/lib/xymon/server/etc/xymonpasswd USERNAME" # Add more users / change passwords with "htpasswd /usr/lib/xymon/server/etc/xymonpasswd USERNAM AuthUserFile /usr/lib/xymon/server/etc/xymonpasswd AuthType Basic AuthName "Xymon Administration" Require valid-user </Directory> On Friday, March 27, 2015 8:05 AM, Ales Krek <aleskrek at yahoo.com> wrote: Thank you for reply. I solved a problem. The problem was that i didn't have correct configuration in apache.conf. I fix it and now it opens in browser but :) here is a thing the browser gives me - /xymon-cgi/svcstatus.sh?HOST=XymonServer&SERVICE=conn - Not Found - The requested URL /xymon-cgi/svcstatus.sh was not found on this server. Do u have any ideas? :) I will try on my own, but any help or idea is welcome. Thank you! Aleš Krek On Thursday, March 26, 2015 10:11 PM, J.C. Cleaver <cleaver at terabithia.org> wrote: On Thu, March 26, 2015 1:28 am, Ales Krek wrote: > Hi.I can't get svcstatus.sh on the web browser. The only option i get when > i click on conn icon of som monitored device in to download svcstatus.sh. > Can some one please tell me what I'm missing or doing wrong. I would be > wary glad if some one could send me an example of the configuration. > > I'm wary new to xymon. Manny Thanks to all of you guy. > Ales Krek.Â > It sounds like ".sh" files might not be being recognized as a CGI script by your web server. Depending on your version, you may need a line something like this: AddHandler cgi-script .sh ...in your apache config. Alternatively, you might want to compare the xymon-apache.conf file that came with the package with the version that you have installed and look for any discrepancies. HTH, -jc

1 1

Escaping special characters in analysis.cfg
by timothy_persoon＠hotmail.com 27 Mar '15

27 Mar '15

Hi all, I'm trying to monitor the Windows Internal Database service. The Service Name is the following: MSSQL$MICROSOFT##WID However, thanks to the ## it shows all the characters that follow as comment so I added this line with regex to my analysis.cfg SVC ^MSSQL\$MICROSOFT##WID status=started This gives following (wrong) output on my webpage: ^MSSQL\$MICROSOFT: No matching service - want started/Any Is there a way I can monitor this particular service? Kind regards, Timothy

4 6

hosts.cfg "mutlihomed" tag broken?
by g.stone-tolcher＠its.uq.edu.au 27 Mar '15

27 Mar '15

>From man hosts.cfg GENERAL PER-HOST OPTIONS multihomed Tell Xymon that data from the host can arrive from multiple IP-adresses. By default, Xymon will warn if it sees data for one host coming from different IP-adresses, because this usually indicates a mis-configuration of the hostname on at least one of the servers involved. Some hosts with multiple IP-adresses may use different IPâs for sending data to Xymon, however. This tag disables the check of source IP when receiving data. In my testing, it appears the "multihomed" hosts.cfg tag is broken. i.e does not allow a client to report in if it comes from an alternate IP on that host. Looking at 4.3.18 code. I see in lib/loadhosts.c: 169 xmh_item_key[XMH_FLAG_MULTIHOMED] = "MULTIHOMED"; 170 xmh_item_name[XMH_FLAG_MULTIHOMED] = "XMH_MULTIHOMED"; Is that looking for "MULTIHOMED" in CAPS, not "multihomed" lowercase? Also, should line 170 have "XMH_FLAG_MULTIHOMED" rather than "XMH_MULTIHOMED" e.g. xmh_item_name[XMH_FLAG_MULTIHOMED] = "XMH_FLAG_MULTIHOMED"; similar items appear to be that way? "man 5 xymon-xmh" suggests the relevant xmh item should be: XMH_FLAG_MULTIHOMED Value of the MULTIHOMED tag. Doing a xymondborad query against a host with "multihome" produces no result for that field: xymon localhost "xymondboard host=pf-parkingguide.pf.uq.edu.au fields=XMH_FLAG_MULTIHOMED" This section in xymond.c from line 1520 seems to be the code doing a check that XMH_FLAG_MULTIHOMED is NULL: xymond/xymond.c 1520 /* * If we have an existing status, check if the sender has changed. * This could be an indication of a mis-configured host reporting with * the wrong hostname. */ if (*(log->sender) && (strcmp(log->sender, sender) != 0)) { /* * There are a few exceptions: * - if sender is "xymond", then this is an internal update, e.g. a status going purple. * - if the host has "pulldata" enabled, then the sender shows up as the host doing the * data collection, so it does not make sense to check it (thanks to Cade Robinson). * - some multi-homed hosts use a random IP for sending us data. */ if ( (strcmp(log->sender, "xymond") != 0) && (strcmp(sender, "xymond") != 0) && (strcmp(sender, "0.0.0.0") != 0)) { if ((xmh_item(hinfo, XMH_FLAG_PULLDATA) == NULL) && (xmh_item(hinfo, XMH_FLAG_MULTIHOMED) == NULL)) { log_multisrc(log, sender); } } } strncpy(log->sender, sender, sizeof(log->sender)-1); *(log->sender + sizeof(log->sender) - 1) = '\0'; } Any ideas on this one? Currently I have to add multihomed hosts to "--status-senders" otherwise. Cheers, Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au> ITS: Service. Team. Accountability. Results. IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include. Please consider the environment before printing this email. CRICOS Code 00025B

3 4