July 2015 - Xymon - Xymon mailman web

All Xymon rrd graphs suddenly haywire
by rectifier＠gmail.com 06 Aug '15

06 Aug '15

Hi all, This weekend, something happened with all our graphs. Every hosts' graphs are either corrupted or distorted and the history is unusable. I have checked all the usual places for graphs logging, rrd-data.log and rrd-status.log and other system log files but I am stumped as to where to start fixing this. We are looking at restoring rrds from previous snapshot which may or may not work but still would like to solve this mystery. I have attached 2 screens but I do not know if these are viewable on the mailing list. It is hard to explain without but essentially there are huge numbers in our graphs such 3945789385793485793847593847593847593847593847593845793485739 and lots of '?' and there is no usable history, just a straight line along the base with one peak (or two) around the time this all happened (with a day or two out either way). If you try to zoom in, you get to a screen that just says 'zoom source image' and it's a black screen but if you hover your mouse over the screen you can find an area that is selectable and this shows a close up of the zoom area rrdtool info example (for the same screenshot host test): filename = "disk,C.rrd" rrd_version = "0003" step = 300 last_update = 1436270189 ds[pct].type = "GAUGE" ds[pct].minimal_heartbeat = 600 ds[pct].min = 0.0000000000e+00 ds[pct].max = 1.0000000000e+02 ds[pct].last_ds = "89" ds[pct].value = 7.9210000000e+03 ds[pct].unknown_sec = 0 ds[used].type = "GAUGE" ds[used].minimal_heartbeat = 600 ds[used].min = 0.0000000000e+00 ds[used].max = NaN ds[used].last_ds = "28436524" ds[used].value = 2.5308506360e+09 ds[used].unknown_sec = 0 rra[0].cf = "AVERAGE" rra[0].rows = 576 rra[0].pdp_per_row = 1 rra[0].xff = 5.0000000000e-01 rra[0].cdp_prep[0].value = NaN rra[0].cdp_prep[0].unknown_datapoints = 0 rra[0].cdp_prep[1].value = NaN rra[0].cdp_prep[1].unknown_datapoints = 0 rra[1].cf = "AVERAGE" rra[1].rows = 576 rra[1].pdp_per_row = 6 rra[1].xff = 5.0000000000e-01 rra[1].cdp_prep[0].value = 4.4500000000e+02 rra[1].cdp_prep[0].unknown_datapoints = 0 rra[1].cdp_prep[1].value = 1.4218146600e+08 rra[1].cdp_prep[1].unknown_datapoints = 0 rra[2].cf = "AVERAGE" rra[2].rows = 576 rra[2].pdp_per_row = 24 rra[2].xff = 5.0000000000e-01 rra[2].cdp_prep[0].value = 2.0470000000e+03 rra[2].cdp_prep[0].unknown_datapoints = 0 rra[2].cdp_prep[1].value = 6.5402986560e+08 rra[2].cdp_prep[1].unknown_datapoints = 0 rra[3].cf = "AVERAGE" rra[3].rows = 576 rra[3].pdp_per_row = 288 rra[3].xff = 5.0000000000e-01 rra[3].cdp_prep[0].value = 1.2727000000e+04 rra[3].cdp_prep[0].unknown_datapoints = 0 rra[3].cdp_prep[1].value = 4.0657944878e+09 rra[3].cdp_prep[1].unknown_datapoints = 0 This weekend we had a network intervention in that we moved some network connections in one of the 2 data centers but there was no downtime as we switched the network connectivity to the other data room. Our Xymon server is running on a virtual server (RHEL5) and the version we are using is 4.3.19. All graphs were fine until this point. Any ideas?

4 7

Why IGNORE HOST and EXHOST work differently with UNMATCHED?
by mart.laak＠active.ee 03 Aug '15

03 Aug '15

Hi Henrik and others who help to develop this invaluable piece of software, Xymon! I've been used BB more than 15 years for now and now trying to migrate to Xymon because it seems more flexible and powerful to me. Now I'm in the middle of converting my existing (fairly complex) bbwarnrules to alerts.cfg Everything works great except some strange to me cases with UNMATCHED. For example, if you look at these two configurations - they seem similar to human eye: 1: using IGNORE --- HOST=* IGNORE HOST=somehost MAIL admin at domain.com HOST=* MAIL supervisor at domain.com UNMATCHED --- 2: using EX... --- HOST=* EXHOST=somehost MAIL admin at domain.com HOST=* MAIL supervisor at domain.com UNMATCHED --- However, the first (IGNORE HOST) construction does NOT send alert to supervisor at admin.com in case of somehost alert, as expected. Is it bug or is there some explanation for this behavior? With kindest regards, Märt

2 2

Monitor the Microsoft SQL with Xymon
by A.Chervonets＠cominder.eu 31 Jul '15

31 Jul '15

Ms-SQL is running on Windows. So : 1) install old good BBWin as XyMon monitoring agent and setup it to sent basic information (cpu, ram, disk, etc.) to XyMon server 2) configure BBWin to report services availability with names, including "SQL" , optionally with auto-restart feature 3) Monitor anything You need using custom scripts as BBWin extensions or find ready ones in the web. P.S. May be You can expand on the question in more details? What is not clear or what troubles do You have in configuring monitoring Microsoft SQL Server? Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/

1 0

Core File Alerts Problem
by Nick＠pettefar.com 31 Jul '15

31 Jul '15

We are using Xymon 4.3.10 to monitor Solaris hosts, mostly Solaris 10. We want to have a Yellow alert when we get a core dump file in /var/core and a Green diamond when there isn't one. Currently the behaviour is erratic with either a white face or a green diamond if there is a core file and a grey square if there isn't one. We have the following in our client-local.cfg file on the Xymon server: [sunos] file:`ls /var/core/core*` and this in the analysis.cfg file for each relevant server: FILE %^/var/core/core.* NOEXIST yellow but it obviously doesn't work! Regards, Nick Pettefar

3 3

Monitor the Microsoft SQL with Xymon
by pbadiger＠enstage.com 30 Jul '15

30 Jul '15

Hi Team, Can you please help me out to monitor the Microsoft SQL with details need your guidelines for configuring XYMON. Thanks & Regards, Pradeep B Sr.System Admin-Linux Information Technology Department enStage ……………………………………………………………………………………………. Cell: +91 9845719456; Desk: +91 80 4342 8197 | [ http://www.enstage.com ]( http://www.enstage.com/ ) This message contains confidential information and is intended only for the individual named or entity to whom they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

2 1

Possible bug in protocol tests
by hobbit＠elyograg.org 30 Jul '15

30 Jul '15

I had a thread on the mailing list about this previously. In the recent past, I had to rebuild my xymon server and now I'm ready to declare that I think the behavior I'm seeing is a bug. http://lists.xymon.com/oldarchive/2010/11/msg00189.html The original problem is that the default smtp settings which come with xymon in protocols.cfg produce a warning/error in the postfix log about improper command pipelining, so I am adjusting the xymon config to keep that from happening. Here's a transcript of a session with my mail server: root at nexus2:~# telnet localhost 25 Trying ::1... Connected to localhost. Escape character is '^]'. 220 nexus2.REDACTED.com ESMTP Postfix (Ubuntu) mail 503 5.5.1 Error: send HELO/EHLO first quit 221 2.0.0 Bye Connection closed by foreign host. The following config duplicates that transcript, but it generates a yellow status on a 4.3.14 server: [smtp] expect "220" send "mail\r\n" expect "503" send "quit\r\n" expect "221" options banner port 25 With the following config, I get a green status, but in fact I should get red, because "220" is *not* in the response to the quit command: [smtp] send "mail\r\n" expect "503" send "quit\r\n" expect "220" options banner port 25 Here's the bug, which might be two separate bugs: The first group of settings above should produce a green status, the second group of settings should produce a red status. In protocols.cfg, "expect" does not work as expected. I've got no idea why the first case comes out as yellow. For the second case, the 'expect "220"' line is passing because of the 220 in the initial banner from the server. That line should fail. Thanks, Shawn

4 4

Future request - config report
by john.r.rothlisberger＠accenture.com 29 Jul '15

29 Jul '15

First let me say that I am different - all of our alerts are done via external scripts that look like this: HOST=somehost SCRIPT /home/xymon/server/ext/pg/exalert_WINPURPLE purple_alert COLOR=purple DURATION>30 REPEAT=12h FORMAT=TEXT UNMATCHED SCRIPT /home/xymon/server/ext/pg/exalert_DBACRIT disk_alert DURATION>20 REPEAT=15 COLOR=red SERVICE=disk FORMAT=TEXT UNMATCHED SCRIPT /home/xymon/server/ext/pg/exwarn_DBACRIT disk_warn DURATION>30 REPEAT=8h COLOR=yellow SERVICE=disk FORMAT=TEXT UNMATCHED STOP My issue is with the config report (this has always been a sore spot for me for a number of reasons) where the information provided could be better. Ex. disk purple_alert (S,U) 30m 1s - 12h - purple disk_alert (U) 20m 1s - 15m - red disk_warn (U) 30m 1s - 8h - yellow Normally, this would be ok, but in my case the alerts.cfg file has a large number of host, page, or other sections with scripts that also use "disk_alert" or "disk_warn" as the receivers. If the config report could include the line number from the alerts.cfg it would be most helpful when alert rules apply (unintentionally) multiple times. My age old question(s), which I asked years ago and still don't know the answer: - Why do some rules show up in red? - What is the meaning of the (S,U) or (U) in the config report? Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

Future request - Ghost Clients
by john.r.rothlisberger＠accenture.com 29 Jul '15

29 Jul '15

I have a suggestion for the ghost clients page: - Reverse the order of hostname/IP. Being able to cut-n-paste right into the hosts.cfg file would be much easier. - Include a button which would show the actual client data being sent (clientlog file). There have been multiple occasions when the IP displayed on the list is not the actual IP of the server. Being able to look at the actual clientlog file would aid in identifying the server and why it is on the list. Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

3 3

CGI Security
by bruno＠redix.com.br 29 Jul '15

29 Jul '15

Hi, Im using xymon to monitoring my clients servers. The clients access the xymon on the URL like above: http://host.com/client1 http://host.com/client<http://host.com/client1>2 http://host.com/client<http://host.com/client1>3 Every client has his own directory for all servers. When the client access the directory client1 for example, i use a .htpasswd to authenticate the user. The user only has access to his directory I notice that there is a security problem for a specific item link like above: http://host.com/cgi/svcstatus.sh?HOST=server1.client1.com&SERVICE=files If im logged with user client1 i can see the item correctly, but if i manually change the url for another client, like somenting: http://host.com/cgi/svcstatus.sh?HOST=server2.client2.com&SERVICE=files I can see the content of another client. There is a way to restrict or block the access from users that dont have permission? Att [http://www.redix.com.br/email/2014/assinaturadigital2014_bruno.jpg]

3 2

Migrating Existing Disabled Tests When Migrating Xymon to New Server?
by mvanderw＠nd.edu 28 Jul '15

28 Jul '15

Hello, We are in the process of preparing to migrate our existing/current Xymon server (running 4.3.10 from source on RHEL 5) onto a new Xymon server (running 4.3.21-4.el7.terabithia from Terabithia RPM on RHEL 7). I was able to find some really helpful and great stuff in the list archives regarding migrating tips and just general help in getting the new server set up, and I greatly appreciate all of that!! However, I was wondering if there was a way to migrate existing Disabled tests' statuses/info (i.e. we have X machine currently disabled for XYZ tests until some date or for a certain amount of time, Y machine disabled for YZ tests for Z amount of time, etc., etc.) from our current Xymon server to our new Xymon server, so I won't have to disable all the tests on the new Xymon server by hand after the migration is complete? While possible to put them in all by hand, I'd rather not have to if there is way to migrate that info over! ;) Is this possible to do? Or will I have to just put in the disabled tests by hand? I wasn't able to really find much in the list archives that really fully answers my question. I did find this in the list archives: http://lists.xymon.com/archive/2005-November/004600.html, which looks like it could be of use (even though I'm not migrating from BB). However, it looks like my disabled directory in the Xymon data directory on our current Xymon server is completely empty, even though we have quite a few disabled tests in place on the system. (Is this normal?) Is there by chance another place where the disabled tests info might be located on disk? Or is there a way to grab all the current disabled tests info and put that info into one of more files on disk for use with the attached script in the above archived message link? Any guidance or assistance is greatly appreciated!! Thanks in advance!! -- Matt Vander Werf

2 1