July 2015 - Xymon - Xymon mailman web

query-frontend (CLI) for `clientlog`, `xymondboard` and `xymondlog`
by thomas.eckert＠it-eckert.de 17 Jul '15

17 Jul '15

Brothers, currently I’m building a fronted for the various query-commands that can be sent to `xymond`. It is still in it’s early stages but I found myself using it daily already. So others may benefit too. It’s named `xymonq` (“xymon query”). Two examples may give a basic idea: 1. Get a list of hosts on page `dc1`: Traditionally this looks like this: $ xymon 127.0.0.1 "xymondboard page=dc1 test=info fields=hostname" With xymonq $ xymonq -P dc1 -L 2. Get disk information this group of hosts: $ for my_host in $(xymon 127.0.0.1 "xymondboard page=dc1 test=info fields=hostname"); do echo “HOST=$my_host" xymon 127.0.0.1 "xymondlog $my_host.disk" done And again the short version with xymonq: $ xymonq -q clientlog -P dc1 -s df More information and download here: http://www.it-eckert.com/software/xymonq/ <http://www.it-eckert.com/software/xymonq/> Feedback welcome! All the best, Thomas

3 3

analysis.cfg PORT LOCAL syntax not working for powershell client netstat output?
by g.stone-tolcher＠its.uq.edu.au 17 Jul '15

17 Jul '15

Hi, has anyone got "ports" working with "LOCAL" criteria with client data from a powershell or bbwin client? It does not seem to work for me, but it works fine for unix clients: analysis.cfg line for windows host: HOST=windows.host PORT "LOCAL=%([.:]80)$" state=LISTEN TEXT=http PORT "LOCAL=%([.:]443)$" state=LISTEN TEXT=https PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen Display output: [red] http (found 0, req. 1 or more) [red] https (found 0, req. 1 or more) [green] Listen (found 43, req. none) Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:80 0.0.0.0:0 LISTENING TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:443 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING ... TCP [::]:80 [::]:0 LISTENING TCP [::]:135 [::]:0 LISTENING TCP [::]:443 [::]:0 LISTENING UDP 0.0.0.0:123 *:* UDP 0.0.0.0:500 *:* UDP 0.0.0.0:4500 *:* UDP 0.0.0.0:5355 *:* UDP 0.0.0.0:11211 *:* ... analysis.cfg lines for unix host HOST=unixhost.blah PORT "LOCAL=%([.:]80)$" state=LISTEN TEXT=http PORT "LOCAL=%([.:]22)$" state=LISTEN TEXT=ssh Display output: [green] http (found 3, req. 1 or more) [green] ssh (found 2, req. 1 or more) tcp4 0 0 127.0.0.1.80 127.0.0.1.54675 TIME_WAIT tcp4 0 0 *.1984 *.* LISTEN tcp4 0 0 *.22 *.* LISTEN tcp4 0 0 *.* *.* CLOSED tcp4 0 0 *.80 *.* LISTEN tcp4 0 0 10.0.1.1.80 *.* LISTEN tcp6 0 0 *.22 *.* LISTEN ..... A cursory glance at "xymond/xymond_client.c" found a "localcol" being defined as 4: 1989: int localcol = 4, remotecol = 5, statecol = 6, portcolor = COL_GREEN; I am not sure how it is handling the different number of columns from windows "netstat -an" which does not have the Recv-Q Send-Q columns present? Any help/advice appreciated! Cheers Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response Information Technology Services The University of Queensland Level 4, Prentice Building, St Lucia 4072 T: +61 7 334 66645, M: +61 401 140 838 E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au> ITS: Service. Team. Accountability. Results. IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include. Please consider the environment before printing this email. CRICOS Code 00025B

2 2

Two basic questions
by mshort＠corelogic.com 17 Jul '15

17 Jul '15

Hello All, I'm a new subscriber, moving from an old BB setup to Xymon. I had two questions that I hadn't been able to find the answer to. 1) How do you setup an external script to run only on certain hosts? I didn't see anything like the bb-bbexttab file. It seems if a script isn't present in the $XYMHOME/ext/ directory, it can't run. But that's not as clean a solution; makes it had to have one set of files to push to all clients. So what's the preferred method? 2) How do you read system logfiles on Linux hosts, when the files are root-only and the monitoring runs as user xymon? This is for Red Hat systems, where things like /var/log/messages are perm 700. I could set the perms to 744, but that's likely to get changed back when the logs rotate or the systems is patched. Do you run Xymon as root user on Linux systems? I didn't think so, or the install instructions wouldn't have you create a xymon user and group. So is there a better way? Thanks in advance for your help. ****************************************************************************************** This message may contain confidential or proprietary information intended only for the use of the addressee(s) named above or may contain information that is legally privileged. If you are not the intended addressee, or the person responsible for delivering it to the intended addressee, you are hereby notified that reading, disseminating, distributing or copying this message is strictly prohibited. If you have received this message by mistake, please immediately notify us by replying to the message and delete the original message and any copies immediately thereafter. Thank you. ****************************************************************************************** CLLD

3 5

Turning Hostname into Hyperlink Changes Graph Titles
by oakesbz＠gmail.com 16 Jul '15

16 Jul '15

Hi all, I’m using the below to turn my hostnames into hyperlinks to login to each server (which works great): 10.10.10.10 Hostname # NAME:"<a href=ssh://root at 10.10.10.10>Displayed Hostname</a>" Problem is, it now uses this ugly html string as the hostname in the title of my graphs. So it displays "<a href=ssh://root… > Disk Utilization”, etc. as the title… which is obviously not pretty. Any thoughts on how to fix this? By the way, it also changes the displayed hostname in several other places which I managed to fix by changing the variable &XYMWEBHOST to &XMH_HOSTNAME in several of the $xymon/server/web/*_header files… Thank you!

1 0

Attempt to change default port
by dewelker＠gmail.com 15 Jul '15

15 Jul '15

I've successfully installed Xymon 4.3.21, but tried to change it from the default port of 1984 by changing the XYMONDPORT variable in xymonserver.cfg. Unfortunately, this turned the cpu, disk, files, etc. all purple. The bbd, conn, http, and xymon status' are all green.. Is there something else I need to change to be able to run Xymon from another port? Thanks, David

2 4

Alerts stop working
by BDale＠kitchengroup.com.au 14 Jul '15

14 Jul '15

Hi Guys, Recently I have started to have a problem where alerts stop sending emails and I'm not sure how exactly to troubleshoot. This has happened a few times over the last few weeks, my solution at the moment is to restart the xymon service in Debian and this fixes the problem and I start seeing emails again. This is what I have done so far: - Check the notifications log when I notice the emails have stopped, log has not been updated although I would expect to see something here as I can see tests going yellow/red in xymon. - Pick a host that currently has a yellow/red alert and run xymoncmd xymond_alert --test hostname msgs it matches the rule and matches script to send an email - If I run a command like RCPT=bdale at kitchengroup.com.au BBHOSTSVC=my.host.dom.cpu BBCOLORLEVEL=red BBHOSTNAME=my.host.dom BBSVCNAME=cpu xymoncmd ./html_mail.pl it sends an email successfully. If I restart the xymon service then I start to see the notifications.log file start updating again.. how can I troubleshoot? This seems to happened every few days, I'm running 4.3.21. Regards, Brandon

1 0

Xymon server report purple because custom client script do not report often enough
by hobbit＠weiser.dk 11 Jul '15

11 Jul '15

Hey, I have made a script which count how many times a string appears in a log file. Nothing special. And it works fine. Doing the testing of this script I made the interval to 1m, just so I did not have to wait to long to test changes. Now that I finish with the script I want the interval, configured in clientlaunch.cfg, to run every 60m, so I have changed it in clientlaunch.cfg. But that result in the xymon server is complaining about stop reporting from the client on this custom check. I have tried to delete the test status from the server, but with no luck. Is there something I have misunderstood and is there a way to fix it? Clientlaunch.cfg [razor-count] ENVFILE $HOBBITCLIENTHOME/etc/hobbitclient.cfg CMD $HOBBITCLIENTHOME/ext/razor-report-count.sh LOGFILE /var/log/hobbit/razor-report-count.log INTERVAL 60m Thanks, Kim.

3 3

Errors for acknowledge alerts in 4.3.18
by nskyrca＠syr.edu 09 Jul '15

09 Jul '15

Hello, I just upgraded from 4.2.3 to 4.3.18, and we are getting errors when acknowledging alerts. I saw other people wrote to the list with similar problems, but I didn't really see a solution (or I just missed it.) So I apologize in advance for the duplicate question. Any help would be appreciated. This is the error we see in the web interface: The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator, xxxx at xxx.xxx and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log This is in the Apache error log: [Fri Jun 19 14:37:16 2015] [error] [client xxx.xxx.xxx.xxx] Premature end of script headers: acknowledge.sh, referer: https://hobbit-test.syr.edu/xymon-ackcgi/acknowledge.sh The messages file indicates it is creating a core file: Jun 19 14:39:59 hobbit-test kernel: acknowledge.cgi[8882]: segfault at 0 ip 0000000000402b4f sp 00007fffae050310 error 4 in acknowledge.cgi[400000+25000] Jun 19 14:39:59 hobbit-test abrtd: Directory 'ccpp-2015-06-19-14:39:59-8882' creation detected Jun 19 14:39:59 hobbit-test abrt[8883]: Saved core dump of pid 8882 (/usr/local/xymon/xymon-4.3.18/server/bin/acknowledge.cgi) to /var/spool/abrt/ccpp-2015-06-19-14:39:59-8882 (819200 bytes) Jun 19 14:39:59 hobbit-test abrtd: Executable '/usr/local/xymon/xymon-4.3.18/server/bin/acknowledge.cgi' doesn't belong to any package and ProcessUnpackaged is set to 'no' Since we want a certain group of people to be able to acknowledge alerts, I copied the acknowledge.sh script/link to another cgi directory: [root at hobbit-test xymon-current]# ls -al cgi-ack total 208 drwxr-xr-x 2 xymon xymon 4096 Jun 19 13:32 . drwxr-xr-x 8 xymon xymon 4096 Mar 5 10:28 .. lrwxrwxrwx 1 xymon xymon 49 Jun 19 13:32 acknowledge.sh -> /usr/local/xymon/xymon-current/server/bin/cgiwrap This is a portion of the httpd.conf file: ScriptAlias /xymon-ackcgi/ "/usr/local/xymon/xymon-current/cgi-ack/" <Directory "/usr/local/xymon/xymon-current/cgi-ack"> AllowOverride None Options ExecCGI FollowSymLinks Includes Order allow,deny Allow from all Require group ackers </Directory> Thanks, Nicole

2 5

Renaming Host
by neilsimmonds1808＠gmail.com 09 Jul '15

09 Jul '15

Hi all, I've had to rename a host in Xymon today and realised the shortcomings of Xymon for this. Has anyone got a script (linux Xymon server) that will move the histlogs data and hostdata to the new name rather than just the hist data like the built in rename command does? I'm not sure if I can just move the files to the new folders or if the data in the files needs tweaking as well. Any suggestions would be very welcome. Regards, Neil Simmonds

2 1

Rookie having trouble with disk test
by haley787＠erau.edu 08 Jul '15

08 Jul '15

I am running xymon 4.3.17 on both the server and client. The disk service status graph is not showing a mount I added a couple days ago, but the trends graph is. I'm pretty green with xymon and can't work out why there's a mismatch between the graphs. Any help would be appreciated. Thanks! Sincerely, Robert Haley Weather Systems Administrator Applied Aviation Sciences Embry-Riddle Aeronautical University Office: (386) 323-8033 haley787 at erau.edu [email-ERAU_DB_TM]

1 0