March 2015 - Xymon - Xymon mailman web

Xymon Powershell Windows client
by zak.beck＠accenture.com 12 Mar '15

12 Mar '15

Hi all, Today I have uploaded a new version of the Xymon Powershell client to SVN (in sandbox/WinPSClient). We (Accenture) are very pleased to be contributing these changes to the open source community. I've been working on this now for around 8 months on and off and hopefully the changes made will be of benefit to everyone! Whilst making changes, we have focussed mainly on making it work, improving reliability and most importantly improving performance. In most cases, on our 64 bit OS virtual machines, a data collection now takes around 5 seconds. On heavily loaded (CPU load or event log load) servers, the script is now considerably faster than originally. Key to this has been reducing the amount of WMI usage as this was a major culprit. We have also implemented some new features, largely based on our in-house requirements but hopefully useful to others: * Showing the process owner and command line in [procs]. This has been implemented using c# code, compiled at runtime. * Adding Active Directory replication test, Terminal Services sessions test * Ability to restart any stopped Windows service * Client self-update * Dirsize and dirtime checks (which were originally external scripts) Some things have changed slightly; for example, the local configuration which was registry-based is now XML-based (you can still use registry settings if you prefer). In the SVN repository I have also uploaded a Word document which describes how to install and the configuration options. I have uploaded all the revisions we have made to SVN so there is a history of development. Whilst we will endeavour to continue contributing changes and improvements in coming months, this is an open source project and as such we are not offering any formal support. If anyone wishes to bugfix, branch or whatever, please do so! Zak Beck Accenture

12 26

Xymon / Devmon Graphs only on trends
by BDale＠kitchengroup.com.au 12 Mar '15

12 Mar '15

I am trying to setup Devmon 0.3.1-beta1 with Xymon 4.3.17. I am currently testing with the generic ups template. I can't work out how to make the graphs appear on the same page as the test. I think I have Devmon setup correctly and I have .rrd files being generated for the tests. If I add the tests to "GRAPHs=.." in xymonserver.cfg they appear on the trends page: GRAPHS="la,disk,inode,qtree,files,processes,memory,users,vmstat,iostat,tcp.http,tcp,ncv,netstat,ifstat,mrtg::1,ports,temperature,ntpstat,apache,bind,sendmail,mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,clock,lines,ops,stats,cifs,JVM,JMS,HitCache,Session,JDBCConn,ExecQueue,JTA,TblSpace,RollBack,MemReq,InvObj,snapmirr,snaplist,snapshot,devmon::1,if_load::1,temp,paging,mdc,mdchitpct,cics,dsa,getvis,maxuser,nparts,xymongen,xymonnet,xymonproxy,xymond,battery,power,powerin" The problem is if I add them to TEST2RRD using "devmon" syntax like below they do not display on the test page. TEST2RRD="cpu=la,disk,inode,qtree,memory,$PINGCOLUMN=tcp,http=tcp,dns=tcp,dig=tcp,time=ntpstat,vmstat,iostat,netstat,temperature,apache,bind,sendmail,mailq,nmailq=mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,files,procs=processes,ports,clock,lines,ops,stats,cifs,JVM,JMS,HitCache,Session,JDBCConn,ExecQueue,JTA,TblSpace,RollBack,MemReq,InvObj,snapmirr,snaplist,snapshot,if_load=devmon,temp=devmon,paging,mdc,mdchitpct,cics,dsa,getvis,maxuser,nparts,xymongen,xymonnet,xymonproxy,xymond,battery=devmon,power=devmon,powerin=devmon" If I remove "=devmon" like below they appear but the .rrd files stop updating. TEST2RRD="cpu=la,disk,inode,qtree,memory,$PINGCOLUMN=tcp,http=tcp,dns=tcp,dig=tcp,time=ntpstat,vmstat,iostat,netstat,temperature,apache,bind,sendmail,mailq,nmailq=mailq,socks,bea,iishealth,citrix,bbgen,bbtest,bbproxy,hobbitd,files,procs=processes,ports,clock,lines,ops,stats,cifs,JVM,JMS,HitCache,Session,JDBCConn,ExecQueue,JTA,TblSpace,RollBack,MemReq,InvObj,snapmirr,snaplist,snapshot,if_load=devmon,temp=devmon,paging,mdc,mdchitpct,cics,dsa,getvis,maxuser,nparts,xymongen,xymonnet,xymonproxy,xymond,battery,power,powerin " I cannot work out what I am doing wrong. Is there something in xymon I need to do to make this work? Separate Question - Is devmon still the best way to do SNMP monitoring with xymon? I can see there is a file called snmpmibs.cfg but a quick google and it looks like this was never fully developed? Regards, Brandon

3 4

DOWNTIME accross multiple days
by BDale＠kitchengroup.com.au 12 Mar '15

12 Mar '15

I can't work out if I can use DOWNTIME and span the downtime period across multiple days. I need to not alert on a column from 11:00pm on Fridays to 4:00am on Mondays This is what I have come up with: DOWNTIME=column:51:2300:0400:"offline during this period" The Config report shows: Planned downtime: Fri/Mon:2300:0400 (status:column) (cause:copy offline during this period) I think this is actually saying 2300-0400 on Friday and Monday which is not what I want. Is what I want to do possible and what is the correct syntax? Regards, Brandon

4 6

Ways to graph stats from BIND
by john.thurston＠alaska.gov 12 Mar '15

12 Mar '15

In an effort to get some performance and utilization information from our BIND servers, I've been exploring ways to get that data into rrds and graphed in Xymon. I am aware of two mechanisms for extracting statistical data from BIND. A) In the "old" way, BIND appends lines to a statically named text file. This is done by inserting lines like the following into the BIND configuration file: > zone-statistics yes; > statistics-file "/var/log/named.stats"; And then asking BIND to add new information to that file by using the "rndc stats" command. B) The "new" way is to publish statistics in an XML file over HTTP on a specific network port. This is done by inserting lines like the following into the BIND configuration file: > statistics-channels { > inet * port 8888 ; > }; And then querying http://localhost:8888/xml/v2 to receive a whole bunch of information in an XML file. Jeremy Laidman shared his script "xymon-rnamedstats" (thank you for sharing, Jeremy!) http://tools.rebel-it.com.au/xymon-rnamedstats/xymon-rnamedstats.sh which depends on Method-A. I've adjusted his script just enough to get it running on Solaris, and I'm pretty sure I'll be able to adjust it further to handle the counters and fields I want to have graphed. But before I invest more time customizing a solution dependent on Method-A, I'd like to explore Method-B. Has anyone already explored parsing the BIND-statistics XML file into RRDs? Do you have any comments or suggestions? How about generically parsing and selecting data from XML files and using it to add information to RRDs? Do you have suggestions of tools or techniques? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

3 3

Powershell Client - removing test
by BDale＠kitchengroup.com.au 11 Mar '15

11 Mar '15

1. I am testing the PowerShell client and I would like to remove the msgs column and not have it check that There is documentation for the powershell client here http://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/ To stop it checking events you would use <reportevt>0</reportevt> in the xymonclient_config.xml file that is stored on the machine you are monitoring. 2. Also, how would I set it to monitor a service? This isn't specific to the powershell client but you would specifiy this in the analysis.cfg file in xymon possibly something like HOST=SQL01 SVC MSSQLSERVER status=started startup=automatic More info on that here: https://www.xymon.com/help/manpages/man5/analysis.cfg.5.html SVCS status (Microsoft Windows clients) SVC servicename status=(started|stopped) [startup=automatic|disabled|manual] The PowerShell client also appears to have its own servicecheck option I haven't actually tried it but I think it's only for starting a stopped service rather than alerting on it. Which may be even better depending on your needs. Regards, Brandon

1 0

Powershell Client - removing test
by Russell.Blumenthal＠stonybrookmedicine.edu 11 Mar '15

11 Mar '15

Hey folks, Perhaps I missed this if it was mentioned in another email. I am testing the PowerShell client and I would like to remove the msgs column and not have it check that. How would I do that? Also, how would I set it to monitor a service? Thanks This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by e-mail and destroy all copies of the original.

1 0

Detecting read-only file system in Linux
by spah＠syntec.co.uk 11 Mar '15

11 Mar '15

Hi, I have been trying to find out if there is a way of Xymon detecting that a file-system in Linux has gone read-only as a result of a disk error (other than reporting it just the once via monitoring /var/log/messages). Nothing is showing up in my Xymon server, but my xymon-client is a bit old: xymon-client-4.3.7-26.1.el5.tnt I did a bit of Googling and I came up with these two links that may be relevant: http://sisyphus.ru/en/srpm/Sisyphus/xymon/sources/8 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=764197 It seems that a RPM maintainer may have made some modifications to their version in order to catch disks in a read-only state (in the first link) and that there is mount-ro plugin that is part of the hobbit-plugins package in Debian / Ubuntu. Does anyone have more information on either of these and whether any patches can be integrated upstream or plug-ins added to xymonton? CCing Axel Beckert as he seems to have committed something to the mount-ro plugin recently: https://www.openhub.net/p/hobbit-plugins/commits Although we have some Debian systems, I was looking for a solution for another Linux distro. If I was to write something myself to do it, I would check /proc/mounts and the best command I could find was: awk '$4~/(^|,)ro($|,)/' /proc/mounts which outputs: /dev/root / ext3 ro,data=ordered 0 0 with sample line: /dev/root / ext3 ro,data=ordered 0 0 This command also produced a nice summary output that might be good to have on a Xymon status page: cat /proc/mounts|sort|awk '{print $1 "\011" toupper(substr($4,0,2) The following was at the bottom of /var/log/messages, but it does not suggest any very obvious alarm strings to add other than the last line without the 'dm-0', but it would be nicer to have something more generic still as textual messages can change between different versions of the O/S. kernel: sd 0:0:0:0: Unhandled sense code kernel: sd 0:0:0:0: SCSI error: return code = 0x08100002 kernel: Result: hostbyte=invalid driverbyte=DRIVER_SENSE,SUGGEST_OK kernel: sda: Current: sense key: Hardware Error kernel: Add. Sense: Defect list error kernel: kernel: Buffer I/O error on device dm-0, logical block 1358756 kernel: lost page write due to I/O error on dm-0 Kind regards, SebA

6 10

rrd logs and graphs
by jlaidman＠rebel-it.com.au 11 Mar '15

11 Mar '15

Yes, apparently, "(null)" is what GNU's printf outputs when asked to print a string pointer that is null. The POSIX behaviour is not defined, and so in some systems, it dumps core rather than detecting the illegal string. This bit of code demonstrates: #include <stdio.h> int main() { printf("test: %s\n",NULL); } On Linux and FreeBSD, this prints out "test: (null)" but on Solaris 10 this dumps core. Fixing this is beyond my skill level. But I would start looking at the functions errprintf() and dbgprintf() to see if NULL strings can be detected and prevented from being passed through to *printf. But that might be somewhat tricky. Alternatively, updating dump_tcp_services() to do the same, is probably a much simpler task, but doesn't safeguard any other code from the same fate. J On 11 March 2015 at 17:38, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote: > Even simpler: > > #include <stdio.h> > int main() { > printf("test: %s\n",NULL); > } > > > > On 11 March 2015 at 17:33, Jeremy Laidman <jlaidman at rebel-it.com.au> > wrote: > >> On 11 March 2015 at 15:43, Vernon Everett <everett.vernon at gmail.com> >> wrote: >> >>> We have 4.3.12 >>> And the command dumps core in the same way. >>> >> >> That's good. >> >> Can you try this out? Plop into a text file, eg test.c, then "make test" >> and then "./test". >> >> #include <stdio.h> >> #include <stdarg.h> >> void dbgprintf(const char *fmt, ...) >> { >> va_list args; >> va_start(args, fmt); >> vfprintf(stdout, fmt, args); >> va_end(args); >> fflush(stdout); >> } >> int main() { >> dbgprintf("test: %s\n",NULL); >> } >> >> This is the essence of the Xymon code that prints the empty send/expect >> strings. But I've pared away all of the Xymon code to leave just the call >> to vprintf() and whatever is needed to make it run. >> >> On my systems I get the following output: >> >> test: (null) >> >> I'm guessing on your system you'll get a core dump. If so, it would >> suggest a difference in implementations of the standard library functions. >> If that's the case, we simply (!) need to catch the attempts to print NULL >> pointers, and substitute our own "(null)" string. >> >> Indeed, I just tested this on a Solaris system and it dumped core. On >> Linux and FreeBSD systems, it printed "(null)". >> >> J >> >> >

2 1

CRONDATE on 4.3.7
by jlaidman＠rebel-it.com.au 11 Mar '15

11 Mar '15

On 11 March 2015 at 07:18, usa ims via Xymon <xymon at xymon.com> wrote: > If the patch will fix it, how do I go about patching my xymon > client/server that was installed via 'apt-get install'? > You run "apt-get upgrade <packagename>". The patch is only useful if you're compiling the source code. If you do that, you will want to remove the package so it doesn't conflict or cause confusion. J

1 0

CRONDATE on 4.3.7
by usaims＠yahoo.com 10 Mar '15

10 Mar '15

I have heard there are issues with 'CRONDATE' on version 4.3.7 on a Linux ubuntu client. My issues is that if I use CRONDATE instead of INTERVAL, it won't obey my settings. No matter what settings I use, it runs the test ever 5 seconds.Here is my settings: [xxxxx] ENVFILE $HOBBITCLIENTHOME/etc/hobbitclient.cfg CMD $HOBBITCLIENTHOME/ext/xxxx.pl LOGFILE $HOBBITCLIENTHOME/logs/xxxx.log CRONDATE 16 2 * * * There is a patch for a CRONDATE fix but I don't know if the patch will fix it. http://sourceforge.net/p/xymon/mailman/message/28718513/ If the patch will fix it, how do I go about patching my xymon client/server that was installed via 'apt-get install'? Thanks in advance. usaims

1 0