August 2015 - Xymon - Xymon mailman web

Compiling xymon-4.3.19 on Solaris 10
by earle＠isolar.DynDNS.ORG 18 Aug '15

18 Aug '15

> On Aug 17, 2015, at 4:14 PM, Scott.Rebman at hhsc.state.tx.us wrote: > > Jeremy, > > Thanks for the info provided. > > This is the output of crle with no options: > > Default configuration file (/var/ld/ld.config) not found > Platform: 32-bit MSB SPARC > Default Library Path (ELF): /lib:/usr/lib (system default) > Trusted Directories (ELF): /lib/secure:/usr/lib/secure (system default) > > I will try the other methods and let you know what worked out. Why build 4.3.19 when 4.3.21 is out? You should definitely use "crle" to create a "/var/ld/ld.config" so you can pick up those PCRE libraries. I just built 4.3.21 on a Solaris 10 1/13 box yesterday with -- sol10testmule:1:1001 [/] # crle Configuration file [version 4]: /var/ld/ld.config Default Library Path (ELF): /lib:/usr/lib:/usr/sfw/lib:/opt/mysql/lib/mysql:/usr/local/lib Trusted Directories (ELF): /lib/secure:/usr/lib/secure (system default) Command line: crle -c /var/ld/ld.config -l /lib:/usr/lib:/usr/sfw/lib:/opt/mysql/lib/mysql:/usr/local/lib -- If you run something similar with "/usr/local/lib" in the argument list, it should pick up libpcre.so.0 after that. You could even throw your RRD path path (i.e. /usr/local/rrdtool-1.2.19/lib) in there as well, for good measure. Speaking of Solaris, make sure "/usr/bin" is at the front of $PATH when you do the build. Xymon unfortunately in a couple of places hard-codes the direct use of "sed" and "tr" (without making them be settable variables e.g. "${SED}"/"${TR}"), and the only pair that work properly are the ones in "/usr/bin". (For example, if you put "/usr/xpg4/bin" in front, then "sed" will work - but "tr" does not. If you have "/usr/ucb" in front, the "sed" it will pick up won't work. "/usr/bin/sed" and "/usr/bin/tr" both work properly.) - Greg

1 0

Compiling xymon-4.3.19 on Solaris 10
by Scott.Rebman＠hhsc.state.tx.us 17 Aug '15

17 Aug '15

Any help will be greatly appreciated. Having issues when compiling xymon 4.3.19 on Solaris 10. I have even used the following command line options: ./configure --server --pcreinclude /usr/local/include --pcrelib /usr/local/lib --rrdinclude /usr/local/rrdtool/include --rrdlib /usr/local/rrdtool/lib It shows during the configuration phase that libpcre is located: Checking for PCRE ... Compiling with PCRE library works OK Linking with PCRE library works OK PCRE contents of Makefile: # PCRE settings PCREINCDIR = -I/usr/local/include PCRELIBS = -L/usr/local/lib -lpcre RPATHVAL += /usr/local/lib PCRE libraries are located under /usr/local/lib. but there are no references to /usr/local/lib/libpcre* during the make just /usr/local/include running ldd against built files which require PCRE shows libpcre.so.0 as "file not found": cgiwrap.cgi: libresolv.so.2 => /lib/libresolv.so.2 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 librt.so.1 => /lib/librt.so.1 libpcre.so.0 => (file not found) libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libaio.so.1 => /lib/libaio.so.1 libdoor.so.1 => /lib/libdoor.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 libm.so.2 => /lib/libm.so.2 /platform/SUNW,SPARC-Enterprise-T5120/lib/libc_psr.so.1 /platform/SUNW,SPARC-Enterprise-T5120/lib/libmd_psr.so.1 RDD Contents of Makefile: # RRDtool settings RRDDEF = -DRRDTOOL12 RRDINCDIR = -I/usr/local/rrdtool-1.2.19/include RRDLIBS = -L/usr/local/rrdtool-1.2.19/lib -lrrd -L/opt/csw/lib -lpng RPATHVAL += /usr/local/rrdtool-1.2.19/lib DORRD = yes also librrd.so.2 appears as missing perfdata.cgi: libresolv.so.2 => /lib/libresolv.so.2 libsocket.so.1 => /lib/libsocket.so.1 libnsl.so.1 => /lib/libnsl.so.1 librt.so.1 => /lib/librt.so.1 libpcre.so.0 => (file not found) librrd.so.2 => (file not found) libpng12.so.0 => /usr/lib/libpng12.so.0 libm.so.2 => /lib/libm.so.2 libc.so.1 => /lib/libc.so.1 libmp.so.2 => /lib/libmp.so.2 libmd.so.1 => /lib/libmd.so.1 libscf.so.1 => /lib/libscf.so.1 libaio.so.1 => /lib/libaio.so.1 libz.so.1 => /usr/lib/libz.so.1 libdoor.so.1 => /lib/libdoor.so.1 libuutil.so.1 => /lib/libuutil.so.1 libgen.so.1 => /lib/libgen.so.1 /platform/SUNW,SPARC-Enterprise-T5120/lib/libc_psr.so.1 /platform/SUNW,SPARC-Enterprise-T5120/lib/libmd_psr.so.1 Scott Allen Rebman Solaris System Administrator HHS/HHSC/Contractor TIERS Operations (512)873-6864 (CrossPark) (512) 549-0278 (Work Cell) Scott.Rebman at hhsc.state.tx.us<mailto:Scott.Rebman at hhsc.state.tx.us>

3 3

Process change
by dewelker＠gmail.com 17 Aug '15

17 Aug '15

I've used BB, then hobbit, and now Xymon, to monitor clients by always sending back status messages that already include the appropriate alerting. Unfortunately, this is very inflexible when it comes to making configuration changes (min/max) for alerting. What I'd like to do, now, is send back just the status data, and be able to manipulate the alerting configuration from the server-side, (centralized monitoring, what a concept!) just like what is done for the other server columns - conn, cpu, disk, etc. What is the best way to do this (process-wise)? I was thinking to run a server-side script that monitors/intercepts the client stream and re-sends the same status message with the additional alert, or is there a better, or even preferred/standard method? Also, how would one add to the client data collector, short of coding in C? Thanks! David

2 3

Xymon 4.3.21
by jlaidman＠rebel-it.com.au 15 Aug '15

15 Aug '15

Are you referring to the "info" and "trends" dots? I think those are hard-coded into the code that generates the non-green page. Or are you referring to other non-gree dots for tests you don't want displayed? I'm not sure that it would make sense for a non-green dot to not show up on the non-green page. If you don't want to see them, you could make them blue by disabling the tests. Also, you can specify tests to not show on the non-green page by adding "--nongreen-ignorecolums=test1,test2" to the command line for the xymongen command. This can be done either by appending to the xymongen command in tasks.cfg, or by appending to the XYMONGENOPTS setting in xymonserver.cfg. Cheers Jeremy On 13 August 2015 at 08:41, usa ims via Xymon <xymon at xymon.com> wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From: usa ims <usaims at yahoo.com> > To: usa ims <usaims at yahoo.com>, "xymon at xymon.com" <xymon at xymon.com> > Cc: > Date: Wed, 12 Aug 2015 22:30:21 +0000 (UTC) > Subject: Re: [Xymon] Xymon 4.3.21 > Sorry about the span. My issue is resolved. > > > > On Wednesday, August 12, 2015 6:05 PM, usa ims via Xymon <xymon at xymon.com> > wrote: > > > I'm sorry I meant the Current non-green Systems' window > > > > On Wednesday, August 12, 2015 5:51 PM, usa ims <usaims at yahoo.com> wrote: > > > Hi, > > How do I remove certain tests that appear on my "Current Status" window? > > I only want 'cpu', 'disk', and 'conn' to appear on the main screen. > > Thanks in advance. > > usaims > > > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > >

2 1

4.3.21 Monitoring log files
by usaims＠yahoo.com 14 Aug '15

14 Aug '15

I have resolved the issue by removing '--local' from clientlaunch.cfg. Sorry for the repeated emails -- I don't know why this is happenings. On Friday, August 14, 2015 3:28 PM, usa ims via Xymon <xymon at xymon.com> wrote: Hello, I'll try not to span this time. I just installed '4.3.21' server on a Raspberry Pi Debian. Additionally, I just compiled '4.3.21' as a client on a Raspberry Pi Debian. Xymon is going to be used to monitor one server, a network intrusion software called snort. I'm going to monitor one log file which has all the detected alerts. If an alert comes in, I want Xymon to be red. So, I went to the xymon server and modified the 'client-local.cfg': [snort] log:/var/log/snort/alert:4096 'snort' is the name of the sniffer server and I only want to monitor '/var/log/snort/alert' file. Then I went to the 'analysis.cfg' on the xymon server and added: HOST=snort LOG /var/log/snort/alert ERROR COLOR=red I waited 20 minutes and I'm getting: No log data available The client did not report any logfile data I do see green happy faces on conn, disk, info, memory but 'msgs' is white. I had this working on a very old version of 'xymon' a while ago but this is the first time I'm using the latest and greatest. Please help. usaims _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

4.3.21 Monitoring log files
by jglouisjr＠gmail.com 14 Aug '15

14 Aug '15

Can Xymon read that snort log? On Fri, Aug 14, 2015 at 2:28 PM, usa ims via Xymon <xymon at xymon.com> wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > ---------- Forwarded message ---------- > From: usa ims <usaims at yahoo.com> > To: Xymon Mailinglist <xymon at xymon.com> > Cc: > Date: Fri, 14 Aug 2015 19:19:34 +0000 (UTC) > Subject: 4.3.21 Monitoring log files > Hello, > I'll try not to span this time. > > I just installed '4.3.21' server on a Raspberry Pi Debian. > Additionally, I just compiled '4.3.21' as a client on a Raspberry Pi > Debian. > > Xymon is going to be used to monitor one server, a network intrusion > software called snort. > I'm going to monitor one log file which has all the detected alerts. If an > alert comes in, I want Xymon to be red. > > So, I went to the xymon server and modified the 'client-local.cfg': > [snort] > log:/var/log/snort/alert:4096 > > 'snort' is the name of the sniffer server and I only want to monitor > '/var/log/snort/alert' file. > > Then I went to the 'analysis.cfg' on the xymon server and added: > > HOST=snort > LOG /var/log/snort/alert ERROR COLOR=red > > I waited 20 minutes and I'm getting: > > No log data available > The client did not report any logfile data > > I do see green happy faces on conn, disk, info, memory but 'msgs' is white. > > I had this working on a very old version of 'xymon' a while ago but this > is the first time I'm using the latest and greatest. > > Please help. > > usaims > > -- * Jim Louis \\\\||//// \ ~ ~ / | @ @ |* *--oOo---(_)---oOo--* 'If a Neanderthal came and sat next to you on a bus, you'd probably get up and change seats. But if a *Homo erectus* came and sat next to you on a bus, you'd probably get off the bus.' ~ unknown

1 0

4.3.21 Monitoring log files
by usaims＠yahoo.com 14 Aug '15

14 Aug '15

Hello, I'll try not to span this time. I just installed '4.3.21' server on a Raspberry Pi Debian. Additionally, I just compiled '4.3.21' as a client on a Raspberry Pi Debian. Xymon is going to be used to monitor one server, a network intrusion software called snort. I'm going to monitor one log file which has all the detected alerts. If an alert comes in, I want Xymon to be red. So, I went to the xymon server and modified the 'client-local.cfg': [snort] log:/var/log/snort/alert:4096 'snort' is the name of the sniffer server and I only want to monitor '/var/log/snort/alert' file. Then I went to the 'analysis.cfg' on the xymon server and added: HOST=snort LOG /var/log/snort/alert ERROR COLOR=red I waited 20 minutes and I'm getting: No log data available The client did not report any logfile data I do see green happy faces on conn, disk, info, memory but 'msgs' is white. I had this working on a very old version of 'xymon' a while ago but this is the first time I'm using the latest and greatest. Please help. usaims

1 0

Xymon 4.3.21
by usaims＠yahoo.com 12 Aug '15

12 Aug '15

Sorry about the span. My issue is resolved. On Wednesday, August 12, 2015 6:05 PM, usa ims via Xymon <xymon at xymon.com> wrote: I'm sorry I meant the Current non-green Systems' window On Wednesday, August 12, 2015 5:51 PM, usa ims <usaims at yahoo.com> wrote: Hi, How do I remove certain tests that appear on my "Current Status" window? I only want 'cpu', 'disk', and 'conn' to appear on the main screen. Thanks in advance. usaims _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

Getting "ATT0001.bin" attachments sometimes -- MAILC fix is already in place
by hobbit＠elyograg.org 12 Aug '15

12 Aug '15

Xymon server is version 0.1.4, the client in this instance is BBWin 0.13 on a Server 2012 R2 system. Occasionally, I am seeing xymon alarms with ATT00001.bin attachments instead of an actual message. I already googled this, and applied the MAILC fix that I found to xymonserver.cfg, but it's still happening sometimes. I discovered some other bad characters that needed to be removed, so my tr command is set up to remove three characters: # For the xymond_alert module MAILC="/usr/bin/tr -d '\\001\\004\\015' | mail" # Command used to send an e-mail with no subject #MAILC="mutt -x" # Command used to send an e-mail with no subject MAIL="$MAILC -s" # Command used to send an e-mail with a subject Looking in the attachment that I just received, I can see hex 0D characters (carriage returns, octal 015) ... but the "tr" command that I implemented should have removed them. Either there's a bug, or I am missing something simple. Can anyone help? I have not yet tried upgrading Xymon to the latest version. Thanks, Shawn

2 5

Xymon 4.3.21
by usaims＠yahoo.com 12 Aug '15

12 Aug '15

Hi, How do I remove certain tests that appear on my "Current Status" window? I only want 'cpu', 'disk', and 'conn' to appear on the main screen. Thanks in advance. usaims

1 1