March 2015 - Xymon - Xymon mailman web

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

> Try changing "df -hP" to "df -P" and see if that works better. this works! thanks a lot! I just wanted to increase the human readability and didn't think of problems which could arise. M -----Ursprüngliche Nachricht----- > Von:Jeremy Laidman <jlaidman at rebel-it.com.au> > Gesendet: Mon 30 März 2015 14:56 > An: Marcus Mundt <marcus.mundt at forsa.de> > CC: xymon at xymon.com > Betreff: Re: [Xymon] Error in parsing of filesystem usage when monitoring NFS mounts > > > > On 26 March 2015 at 21:37, Marcus Mundt <marcus.mundt at forsa.de <mailto:marcus.mundt at forsa.de>> wrote: > I monitor filesystems on one of my xymon clients. This went really well until switching to NFS. I managed to list and monitor the NFS mount, but the parsing of the transmitted string for the disk usage seems to go wrong at some point > > I would think that NFS-mounted filesystems would be monitored on the server that hosted them, rather than other servers that mount them. > > > #df -Pl -x iso9660 -x $EXCLUDES | sed -e /^[^ ][^ ]*$/{ > > > # without "l" lists NAS_BACKUP_DAILY> df -hP -x iso9660 -x $EXCLUDES | sed -e /^[^ ][^ ]*$/{ > > Youve replaced "df -Pl" with "df -hP". The "-h" changes the headers. This is important because the [df] parser specifically looks for columns with the titles "Available", "Capacity" and "Mounted" to work out what each column is for. By adding "-h" you instead get "Avail", "Use%" and "Mounted". I think when the column headers cant be found, the parser will assume that the values are in position 1, hence the "172" being interpreted as disk space usage. > > Try changing "df -hP" to "df -P" and see if that works better. > > J > >

1 0

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

Dear fellow xymon users, I monitor filesystems on one of my xymon clients. This went really well until switching to NFS. I managed to list and monitor the NFS mount, but the parsing of the transmitted string for the disk usage seems to go wrong at some point: Xymon says: /BACKUP (172% used) has reached the PANIC level (95%) But in reality, some lines below, it shows the correct value of 64%: 172.X.X.X:/Backup 26T 17T 9.3T 64% /BACKUP I guess xymon parses the IP address of the NFS and takes this as the disk usage. Any hints on how to edit the parsing or other help on how to solve this would be highly appreciated. Kind Regards, i. A. Marcus Mundt --------------------------------- forsa Gesellschaft für Sozialforschung und statistische Analysen mbH Schreiberhauer Straße 30 10317 Berlin Telefon: (0 30) 6 28 82-0 Telefax: (0 30) 6 28 82-4 00 E-Mail: Marcus.Mundt at forsa.de AG Berlin-Charlottenburg HRB 80391 Geschäftsführer: Prof. Manfred Güllner

3 2

Xymon Digest, Vol 50, Issue 27
by A.Chervonets＠cominder.eu 30 Mar '15

30 Mar '15

Hello, Tracy I was going to make this too, but for some reasons it is not implemented yet. So if You will make this good - it would be very nice for many admins. Best regards, Andrey Chervonets ---------------------- "Xymon" <xymon-bounces at xymon.com> wrote on 28.03.2015 13:00:01: > Message: 2 > Date: Fri, 27 Mar 2015 11:02:57 -0500 > From: Tracy Di Marco White <gendalia at iastate.edu> > Message-ID: > <CAFAt0ET2na9abY+1MxS-Odr4tMa0ki6t2KRn8-p0cRaLNCXRig at mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi all, > > We've been adding a lot of servers and services to our xymon monitoring > deployment, and it's become somewhat more complex to manage changes to > monitored hosts/services, as well as what's critical when, and what alerts > are needed when. I'd like to deploy a web interface, with access controls > of course, where people can change what systems are monitored, and what > services on those systems are monitored, as well as what alerts they get > when. Because there is so much flexibility in xymon, this can get fairly > complex, and I want to add an error checking web interface to people's > ability to change these settings. > > Does anyone already have something like this? > > -Tracy

2 1

Error in parsing of filesystem usage when monitoring NFS mounts
by marcus.mundt＠forsa.de 30 Mar '15

30 Mar '15

Hello J. C., xymon client version 4.3.3 on openSUSE 13.1 (i586) in /home/xymon/client/bin/xymonclient-linux.sh I edited the excludes to get the info on the NFS: echo "[df]" #EXCLUDES=`cat /proc/filesystems | grep nodev | awk '{print $2}' | xargs echo | sed -e 's! ! -x !g'` EXCLUDES="sysfs -x rootfs -x bdev -x proc -x cgroup -x cpuset -x tmpfs -x devtmpfs -x d ebugfs -x securityfs -x sockfs -x pipefs -x anon_inodefs -x devpts -x ramfs -x hugetlbf s -x pstore -x mqueue -x autofs -x ncpfs -x binfmt_misc" #df -Pl -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ # without "l" lists NAS_BACKUP_DAILY df -hP -x iso9660 -x $EXCLUDES | sed -e '/^[^ ][^ ]*$/{ N s/[ ]*\n[ ]*/ / }' This is the client data reported in the web GUI: [df] Filesystem Size Used Avail Use% Mounted on /dev/sda1 15G 1.7G 12G 13% / /dev/sdc1 1.8T 1.3T 468G 74% /WD_BACKUP_WEEKLY /dev/sda2 21G 49M 20G 1% /home 172.X.X.X:/volume1/Backup 26T 17T 9.0T 65% /NAS_BACKUP_DAILY /dev/sdb1 1.8T 962G 780G 56% /WD_BACKUP_MONTHLY Xymon Server Version: 4.3.0-0.20101114.beta3 Thanks for any help! Found a similar entry in the Mailing List from 2008, but there is no solution provided as far as I can see. http://lists.xymon.com/archive/2008-January/016885.html All the best from Berlin, Marcus --------------------------------- forsa Gesellschaft für Sozialforschung und statistische Analysen mbH Schreiberhauer Straße 30 10317 Berlin Telefon: (0 30) 6 28 82-0 Telefax: (0 30) 6 28 82-4 00 E-Mail: Marcus.Mundt at forsa.de AG Berlin-Charlottenburg HRB 80391 Geschäftsführer: Prof. Manfred Güllner -----Ursprüngliche Nachricht----- > Von:J.C. Cleaver <cleaver at terabithia.org> > Gesendet: Don 26 März 2015 22:02 > An: Marcus Mundt <marcus.mundt at forsa.de> > CC: xymon at xymon.com > Betreff: Re: [Xymon] Error in parsing of filesystem usage when monitoring NFS mounts > > On Thu, March 26, 2015 3:37 am, Marcus Mundt wrote: > > Dear fellow xymon users, > > > > I monitor filesystems on one of my xymon clients. This went really well > > until switching to NFS. I managed to list and monitor the NFS mount, but > > the parsing of the transmitted string for the disk usage seems to go wrong > > at some point: > > > > Xymon says: > > /BACKUP (172% used) has reached the PANIC level (95%) > > > > But in reality, some lines below, it shows the correct value of 64%: > > 172.X.X.X:/Backup 26T 17T 9.3T 64% /BACKUP > > > > I guess xymon parses the IP address of the NFS and takes this as the disk > > usage. Any hints on how to edit the parsing or other help on how to solve > > this would be highly appreciated. > > > > > Marcus, > > Can you provide the OS type you're running on, along with a copy of the > full '[df]' section that's coming back in the client report? > > Also, which version are you running on the server? > > > Regards, > > -jc > > >

1 0

Migrating from BBWin to Xymon PS Client
by Timothy_Persoon＠axi.be 30 Mar '15

30 Mar '15

Hi, I'm migrating from BBWin to the newest Xymon PS Client. However, there are some settings in the BBWin.cfg file that I can't seem to migrate to the analysis.cfg file. In BBWin there are several message checks: <msgs> <setting name="alwaysgreen" value="false" /> <ignore logfile="Application" eventid="1000" /> <ignore logfile="Application" eventid="16385" /> <ignore logfile="Application" eventid="8198" /> <ignore logfile="Application" eventid="489" /> <ignore logfile="System" eventid="6038" /> <setting name="delay" value="1h" /> <match logfile="System" type="error" alarmcolor="red" /> <match logfile="System" type="warning" alarmcolor="yellow" /> <match logfile="Application" type="error" alarmcolor="red" /> <match logfile="Application" type="warning" alarmcolor="yellow" /> <match logfile="Security" type="fail" /> </msgs> but how do I migrate those to analysis.cfg? There seem to be two options: 1) LOG eventlog_application %^warning COLOR=red 2) LOG eventlog:Application %warning COLOR=red Is there a difference between these two notations and is it even possible to migrate the settings of BBWin.cfg to the analysis.cfg? Kind regards, Timothy

3 2

web configuration of xymon
by gendalia＠iastate.edu 27 Mar '15

27 Mar '15

Hi all, We've been adding a lot of servers and services to our xymon monitoring deployment, and it's become somewhat more complex to manage changes to monitored hosts/services, as well as what's critical when, and what alerts are needed when. I'd like to deploy a web interface, with access controls of course, where people can change what systems are monitored, and what services on those systems are monitored, as well as what alerts they get when. Because there is so much flexibility in xymon, this can get fairly complex, and I want to add an error checking web interface to people's ability to change these settings. Does anyone already have something like this? -Tracy

1 0

svcstatus.sh
by aleskrek＠yahoo.com 27 Mar '15

27 Mar '15

Hi me again. I was thinking that i fix it but i didn't. Today i try ed to open the detailed info on some monitored device and its the same problem like yesterday, the browser gives me only the download option of the svcstatus.sh. From yesterday when it worked i didn't edit anything. I don't know what to do. And another thing i don't have xymon-apache.conf in ~/server/etc/xymon-apache.conf. My "xymon-apache.conf" is only located in /etc/apache2/conf.d/xymon I'm sending you my apache.conf and xymon.conf Alias /xymon "/usr/lib/xymon/server/www" <Directory "/usr/lib/xymon/server/www"> Options Indexes FollowSymLinks Includes MultiViews Order allow,deny Allow from all </Directory> ScriptAlias /xymon-cgi "/usr/lib/xymon/cgi-bin" <Directory "/usr/lib/xymon/cgi-bin"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all </Directory> ScriptAlias /xymon-seccgi "/usr/lib/xymon/cgi-secure" <Directory "/usr/lib/xymon/cgi-secure"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all # Password file where users with access to these scripts are kept. # Create it with "htpasswd -c /usr/lib/xymon/server/etc/xymonpasswd USERNAME" # Add more users / change passwords with "htpasswd /usr/lib/xymon/server/etc/xymonpasswd USERNAM AuthUserFile /usr/lib/xymon/server/etc/xymonpasswd AuthType Basic AuthName "Xymon Administration" Require valid-user </Directory> On Friday, March 27, 2015 8:05 AM, Ales Krek <aleskrek at yahoo.com> wrote: Thank you for reply. I solved a problem. The problem was that i didn't have correct configuration in apache.conf. I fix it and now it opens in browser but :) here is a thing the browser gives me - /xymon-cgi/svcstatus.sh?HOST=XymonServer&SERVICE=conn - Not Found - The requested URL /xymon-cgi/svcstatus.sh was not found on this server. Do u have any ideas? :) I will try on my own, but any help or idea is welcome. Thank you! Aleš Krek On Thursday, March 26, 2015 10:11 PM, J.C. Cleaver <cleaver at terabithia.org> wrote: On Thu, March 26, 2015 1:28 am, Ales Krek wrote: > Hi.I can't get svcstatus.sh on the web browser. The only option i get when > i click on conn icon of som monitored device in to download svcstatus.sh. > Can some one please tell me what I'm missing or doing wrong. I would be > wary glad if some one could send me an example of the configuration. > > I'm wary new to xymon. Manny Thanks to all of you guy. > Ales Krek.Â > It sounds like ".sh" files might not be being recognized as a CGI script by your web server. Depending on your version, you may need a line something like this: AddHandler cgi-script .sh ...in your apache config. Alternatively, you might want to compare the xymon-apache.conf file that came with the package with the version that you have installed and look for any discrepancies. HTH, -jc

1 1

Escaping special characters in analysis.cfg
by timothy_persoon＠hotmail.com 27 Mar '15

27 Mar '15

Hi all, I'm trying to monitor the Windows Internal Database service. The Service Name is the following: MSSQL$MICROSOFT##WID However, thanks to the ## it shows all the characters that follow as comment so I added this line with regex to my analysis.cfg SVC ^MSSQL\$MICROSOFT##WID status=started This gives following (wrong) output on my webpage: ^MSSQL\$MICROSOFT: No matching service - want started/Any Is there a way I can monitor this particular service? Kind regards, Timothy

4 6

hosts.cfg "mutlihomed" tag broken?
by g.stone-tolcher＠its.uq.edu.au 27 Mar '15

27 Mar '15

>From man hosts.cfg GENERAL PER-HOST OPTIONS multihomed Tell Xymon that data from the host can arrive from multiple IP-adresses. By default, Xymon will warn if it sees data for one host coming from different IP-adresses, because this usually indicates a mis-configuration of the hostname on at least one of the servers involved. Some hosts with multiple IP-adresses may use different IPâs for sending data to Xymon, however. This tag disables the check of source IP when receiving data. In my testing, it appears the "multihomed" hosts.cfg tag is broken. i.e does not allow a client to report in if it comes from an alternate IP on that host. Looking at 4.3.18 code. I see in lib/loadhosts.c: 169 xmh_item_key[XMH_FLAG_MULTIHOMED] = "MULTIHOMED"; 170 xmh_item_name[XMH_FLAG_MULTIHOMED] = "XMH_MULTIHOMED"; Is that looking for "MULTIHOMED" in CAPS, not "multihomed" lowercase? Also, should line 170 have "XMH_FLAG_MULTIHOMED" rather than "XMH_MULTIHOMED" e.g. xmh_item_name[XMH_FLAG_MULTIHOMED] = "XMH_FLAG_MULTIHOMED"; similar items appear to be that way? "man 5 xymon-xmh" suggests the relevant xmh item should be: XMH_FLAG_MULTIHOMED Value of the MULTIHOMED tag. Doing a xymondborad query against a host with "multihome" produces no result for that field: xymon localhost "xymondboard host=pf-parkingguide.pf.uq.edu.au fields=XMH_FLAG_MULTIHOMED" This section in xymond.c from line 1520 seems to be the code doing a check that XMH_FLAG_MULTIHOMED is NULL: xymond/xymond.c 1520 /* * If we have an existing status, check if the sender has changed. * This could be an indication of a mis-configured host reporting with * the wrong hostname. */ if (*(log->sender) && (strcmp(log->sender, sender) != 0)) { /* * There are a few exceptions: * - if sender is "xymond", then this is an internal update, e.g. a status going purple. * - if the host has "pulldata" enabled, then the sender shows up as the host doing the * data collection, so it does not make sense to check it (thanks to Cade Robinson). * - some multi-homed hosts use a random IP for sending us data. */ if ( (strcmp(log->sender, "xymond") != 0) && (strcmp(sender, "xymond") != 0) && (strcmp(sender, "0.0.0.0") != 0)) { if ((xmh_item(hinfo, XMH_FLAG_PULLDATA) == NULL) && (xmh_item(hinfo, XMH_FLAG_MULTIHOMED) == NULL)) { log_multisrc(log, sender); } } } strncpy(log->sender, sender, sizeof(log->sender)-1); *(log->sender + sizeof(log->sender) - 1) = '\0'; } Any ideas on this one? Currently I have to add multihomed hosts to "--status-senders" otherwise. Cheers, Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au> ITS: Service. Team. Accountability. Results. IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include. Please consider the environment before printing this email. CRICOS Code 00025B

3 4

xymond_history: program crashed
by paul＠arrowtel.net 26 Mar '15

26 Mar '15

Hi, First post. Thanks for supporting this fantastic app! In order to reclaim some disk space I ran: "su xymon -c '/home/xymon/server/bin/trimhistory --drop --cutoff=`date +%s --date="1 Oct 2013"` —droplogs’" Afterwards xymond_history went purple, with the message "program crashed - fatal error” I then ran "xymon localhost "drop <hostname> xymond_history” and now xymond_history has disappeared. I should add that the first time I ran trimhistory as root which messed up permissions on the allevents file. chmod xymon:xymon appears to have fixed it. How to get xymond_history working again? Also, for some long-running hosts, the hostdata directory remains at over 2GB. Is there a way to prune the hostdata directory? Can I safely delete hostdata with "rm <hostfile>" for hosts that are no longer monitored? -paul

2 2