January 2016 - Xymon - Xymon mailman web

Need help with upgrade from 4.3.17 to 4.3.20
by vadud3＠gmail.com 17 Jul '18

17 Jul '18

I am not sure what I need to after the upgrade for the columns to show data instead of something like this ELF �� >� �� @��@�� Þ ��@�8� �@�%�"� �� @��@�@��@�@��ø ��ø �� 8 ��8 @��8 @�� @��@��ää��ää�� I removed FollowSymLinks from xymon-apache.conf file under /xymon-cgi/ and /xymon-seccgi/ and restarted. I am using ubuntu -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

9 29

Recovery notifications not generated when test goes red->yellow->green?
by hobbit＠elyograg.org 13 Dec '17

13 Dec '17

It appears that if a test goes from the red state, to the yellow state, and then to the green state, no recovery notification is sent. If it goes directly from red to green, then we get a notification. Initial notifications are only sent on RED and PURPLE. We have recovery notifications configured for most tests. Xymon server is 4.3.21, built using makerpm.sh and installed with yum on CentOS 6. I do not know whether our previous version (4.3.14) behaved similarly. It was almost an accident that I discovered the problem at all. Is this expected behavior? If it is, can I change it? Thanks, Shawn

4 3

DNS failures causing "runtime longer than time limit"
by jlaidman＠rebel-it.com.au 11 Sep '17

11 Sep '17

Hi I'm running Xymon v4.3.10 on Linux, and I'm quite sure it's compiled with c-ares support. I have 12 new DNS servers that were added to Xymon about one month ago. All of my server entries in hosts.cfg have "testip". The tasks.cfg runs xymonet with "--dns-timeout=3". The hosts entries look like so: 10.10.10.1 dnshost1.example.com # testip dns=NS:example.com,SOA: example.com About a week ago, connectivity to all of these servers failed, and at the same time, the xymonnet run time jumped from less than 15 seconds to about 330 seconds, so about 315 seconds extra. The xymonnet page says 295 seconds is taken up by DNS tests. If the increase in time taken is about 315 and is entirely due to the 12 servers failing, then each failed server is adding about 26 seconds to the total run time. I don't think this should be happening like this. With two DNS checks per server, the DNS checks should be taking 6 seconds each to time-out, not 26. If I run xymonnet with "--timing --no-update" and specify only one hostname, I can view the results and the timing. This shows that the ping check gets reported after about 3 seconds, and then the DNS tests are executed and take 26 seconds total. My naiive assumption was that when a server failed a ping (and didn't have "noclear" defined in hosts.cfg) then the network checks would be skipped. On re-reading the man page for hosts.cfg, it dawned on me that a failed ping simply suppresses failed test /results/, but doesn't stop the tests from being run. So the real problem is that the "--dns-timeout=3" is not being taken into consideration by xymonnet. If I run xymonnet with "--debug" it tells me: 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=2 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=6 1900 2015-06-03 12:02:20 Processing 0 DNS lookups with ARES 1900 2015-06-03 12:02:46 Finished ARES queue after loop 423 This is peculiar. Why would it say "processing 0 DNS lookups" when there are two lookups to test? Could this be because xymonnet hasn't actually been built with ARES support and I didn't know it? Is there a good way to tell? If I add "--no-ares" I get the same results perhaps suggesting a lack of ARES support. On the other hand, if I add "timeout:3" and "attempts:1" into resolv.conf, I also get the same results. If I run "nm /path/to/xymonnet | grep gethostby" it returns "ares_gethostbyname". Just for fun, I compiled Xymon v4.3.21 and ran the xymonnet binary from there, with no change in behaviour. I also tried removing the "--dns-timeout" option so that it defaults to 30 seconds, but still no change - 26 seconds for two DNS tests. So, I'm not really sure what the problem is, but xymonnet certainly isn't behaving as I would expect. Cheers Jeremy

2 3

EXTIME still valid ?
by rltexas1＠gmail.com 22 Jun '16

22 Jun '16

Is the EXTIME option still valid in the alerts.cfg I am having problems testing the following EXTIME=1:1140:1240 Should be exclude Monday's 11:40 to 12:40. Will test EXTIME=M:1140:1240 But if it's M for Monday what would Sunday be ? Thanks

4 4

Xymon disruption every night!
by linuxmasterjedi＠free.fr 19 Feb '16

19 Feb '16

Hi, I'm running Xymon since 6 years (4.3.17 atm) on Debian 7.8 3.2.0-4-amd64 Since 1 month now, every night, between 0h30 or 2h am at +/- 30 min, around 30 hosts become unreachable : Fri Jan 29 01:16:38 2016 conn NOT ok : DNS lookup failed Unable to resolve hostname foo.bar.local System unreachable for 3 poll periods (170 seconds) green 0.0.0.0 is alive (0.02 ms) [<- 127.0.0.1] - Got around 500 monitored hosts and looks like the same hosts are lost every single night. - Those monitored hosts are not necessary on the same network, not the same OS. - We cross monitored the same hosts and the other monitoring tool doesn't have report the DNS outage. - I ran a DNS lookup every seconds on the Hobbit server several days and it never reported a DNS outage. - I don't have any crontab installed on the server who could disturb Xymon. - Nothing strange in the Xymon logs nor the server logs, no memory leaks or CPU overloaded. - The rest of the day, Xymon server behavior is normal. - What I've done on the server 1 month ago ? I don't know, no system upgrade or so. - I had DNSMASQ acting like a cache, I disabled it : same issue - /etc/resolv.conf is quite light : search bar.local, next line : nameserver IP.OF.OUR.DNS.SERVER1, just like other servers The issue could be anywhere : inside or outside the server, Xymon or not... I have to confess, I'm running out of ideas to find the issue, is anyone here may have some leads, I will be thankful ! Have a nice day!

6 9

HTTP test accessible local only
by novosirj＠ca.rutgers.edu 03 Feb '16

03 Feb '16

Hi there, Figured I could use a little bit of collective wisdom here: I have an HTTP service that is only accessible from the local machine (either connected to by a local app or a web browser that is launched from the server). I’d like to test that it is available. I don’t need any more specialized functionality than I would have from the HTTP test (maybe I’d set up an HTTP POST to actually log in). Is there a way to somehow cause the client to do this, without writing an external script, or some other way to do what I’m talking about that I might not have considered? Thanks! -- ____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Senior Technologist || \\ and Health | novosirj at rutgers.edu - 973/972.0922 (2x0922) || \\ Sciences | OIRT/High Perf & Res Comp - MSB C630, Newark `'

3 3

RSS option with critical view
by Andy.Farrior＠victoriacollege.edu 03 Feb '16

03 Feb '16

Thought I'd experiment with the XYMONGENOPTS "-rss" option today. It's creating the RSS files for each page and the main, nongreen, and red status pages just fine; however, the critical.rss file doesn't match the critical view display. The critical.rss file does match the critical.html file that's created. So, in my case, critical.rss and critical.html both display "No Critical Alerts" However, my /xymon-cgi/criticalview.sh lists the systems with issues. What did I miss in the configuration? Thx, Andy Andy Farrior Director of Technology Services Victoria College 2200 E Red River Victoria, TX 77901 Andy.Farrior at VictoriaCollege.edu Office: 361.582.2547 Fax: 361.572.6492

2 1

xymond crashing! -- Please help!
by matt1299＠gmail.com 31 Jan '16

31 Jan '16

Hello, I'm having a major issue with xymond crashing shortly after the service starts. I'm using the the latest Terabithia RPM for RHEL 7 (4.3.24-3.el7.terabithia). When I check the status of the xymon service, it shows it as up but with only the xymonlaunch parent process and vmstat processes. Upon restarting the service, I see it start normally (all the normal channel processes, etc.) and then after a while they all go away, leaving the following process behind: ├─2760 xymon-signal 0.0.0.0 status+1d/group:signal <server hostname>.xymond red (Check time of report) - xymond program crashed Fatal signal caught! along with the xymonlaunch process and some vmstat processes. After a while that process goes away. Sometimes a single xymond_rrd will show up alongside the xymonlaunch and vmstat processes as well after a little while. I'm already running xymond in --debug mode. This is what I see in the xymond log around the time of the crash: 2773 2016-01-30 11:02:32.515505 Status: Host=<host>, test=ntp 2773 2016-01-30 11:02:32.515507 -- create_hostlist_t for <host> (<client IP address>) 2773 2016-01-30 11:02:32.515513 Status: Host=<host>, test=conn 2773 2016-01-30 11:02:32.515520 Status: Host=<host>, test=raid 2773 2016-01-30 11:02:32.515529 Status: Host=<host>, test=memory 2773 2016-01-30 11:02:32.515534 Status: Host=<host>, test=files 2773 2016-01-30 11:02:32.515670 Status: Host=<host>, test=procs 2773 2016-01-30 11:02:32.515879 Status: Host=<host>, test=inode 2773 2016-01-30 11:02:32.515891 Status: Host=<host>, test=disk 2773 2016-01-30 11:02:32.516004 Status: Host=<host>, test=cpu 2773 2016-01-30 11:02:32.516605 Loaded 14419 status logs 2016-01-30 11:02:32 Setting up network listener on 0.0.0.0:1984 2016-01-30 11:02:32.516677 Cannot bind to listen socket (Address already in use) 2016-01-30 11:02:59.538906 Whoops ! Failed to send message (Timeout) 2016-01-30 11:02:59.539020 -> 2016-01-30 11:02:59.539023 -> Recipient '<server IP address>', timeout 50 2016-01-30 11:02:59.539024 -> 1st line: 'status+1d/group:signal <server hostname>.xymond red (Check time of report) - xymond program crashed' It seems to get finished with loading all the hosts and then it crashes (the last host before it crashes is the last client I have alphabetically). I've tried stopping the service, killing off any remaining xymon owned processes, and started the service with the same results. I've also tried restarting the xymon server machine itself, with the same crash happening when the service starts the first time. This just started happening out of the blue a couple of hours ago... Looking in netstat, there are no active connections using port 1984 on the local side, just a bunch of clients trying to connect to the server with 1984 in the foreign address. ANY help would be much appreciated as currently our Xymon server is not working!! Thanks!! -- Matt Vander Werf

2 10

Memory data handling from Windows clients
by john.r.rothlisberger＠accenture.com 29 Jan '16

29 Jan '16

We recently experienced a series of memory alerts on our windows servers that didn't make sense. Although Xymon was indicating that virtual memory was completely used, logging into the server itself showed there were no issues. At first, I had thought there was something wrong with the data that the XymonPS client was sending and working with Zak Beck we found a small tidbit of code to resolve a "bbwin bug". By flopping a 0 to a 1 we could reverse the way the numbers were reported and yet this didn't resolve the problem. It became obvious that the data being sent from the XymonPS client was correct but once on the server something was getting handled differently. Below is a detailed look at what we were seeing and then how I corrected it. The corrections may or may not want to be included in future code releases. Here is what the XymonPS data looked like when we were getting alerts. As you can see there is nothing that would indicate a problem: [memory] memory Total Used physical: 4095 1266 virtual: 4506 4111 <--- These are the numbers we are interested in. page: 8600 5297 This is what was the Xymon server used to create our alert: Memory Used Total Percentage Physical 1266M 4095M 30% Actual 4111M >>> 4095M <<< 100% <--- Here is the alert Swap 5297M 8600M 61% As you can see - the "Total" available "Actual" memory is the same as the Total available Physical memory. But, this is not right, the total available Actual memory should have been 4506M. Just for the sake of having this information included, here is what the memory data looks like from a linux client (there is no issue here): Linux data: [free] total used free shared buffers cached Mem: 16556808 4895408 11661400 0 259376 2508448 -/+ buffers/cache: 2127584 14429224 Swap: 1340412 0 1340412 Displayed: Memory Used Total Percentage Physical 4780M 16168M 29% Actual 2077M 16168M 12% Swap 0M 1308M 0% So, I had to find out why the total physical memory was used to calculate the percentage of used space for the "Actual" memory when the client is a Windows server (XymonPS or BBWin). What I found was that although there is a variable used for memactused there was nothing for memacttotal. So I added a new value for memacttotal which then required me to add the same values to bbwin.c (see below). This also required a modification to linux.c (see below) which instead of using memacttotal, it simiply reususes the value for memphytotal which is essencially the same thing that is currently being done now. Although I have provided patch files for bbwin.c and linux.c ALL of the xymond/client/*.c files need to be modified. xymond_client.c patch: --- xymond_client.c.ORIG 2016-01-27 09:53:58.321793949 -0600 +++ xymond_client.c 2016-01-28 12:57:51.676006980 -0600 @@ -909,7 +909,7 @@ void unix_memory_report(char *hostname, char *clientclass, enum ostype_t os, void *hinfo, char *fromline, char *timestr, - long memphystotal, long memphysused, long memactused, + long memphystotal, long memphysused, long memacttotal, long memactused, long memswaptotal, long memswapused) { long memphyspct = 0, memswappct = 0, memactpct = 0; @@ -938,7 +938,7 @@ if (memswappct > swapred) swapcolor = COL_RED; } - if (memactused != -1) memactpct = (memphystotal > 0) ? ((100 * memactused) / memphystotal) : 0; + if (memactused != -1) memactpct = (memacttotal > 0) ? ((100 * memactused) / memacttotal) : 0; if (memactpct <= 100) { if (memactpct > actyellow) actcolor = COL_YELLOW; if (memactpct > actred) actcolor = COL_RED; @@ -965,30 +965,30 @@ memorysummary); addtostatus(msgline); - sprintf(msgline, " %-12s%12s%12s%12s\n", "Memory", "Used", "Total", "Percentage"); + sprintf(msgline, " %-16s%12s%12s%12s\n", "Memory", "Used", "Total", "Percentage"); addtostatus(msgline); - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(physcolor), "Physical", memphysused, memphystotal, memphyspct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(physcolor), "Real/Physical", memphysused, memphystotal, memphyspct); addtostatus(msgline); if (memactused != -1) { if (memactpct <= 100) - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(actcolor), "Actual", memactused, memphystotal, memactpct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(actcolor), "Actual/Virtual", memactused, memacttotal, memactpct); else - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%% - invalid data\n", - colorname(COL_CLEAR), "Actual", memactused, memphystotal, 0L); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%% - invalid data\n", + colorname(COL_CLEAR), "Actual/Virtual", memactused, memacttotal, 0L); addtostatus(msgline); } if (memswapused != -1) { if (memswappct <= 100) - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(swapcolor), "Swap", memswapused, memswaptotal, memswappct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(swapcolor), "Swap/Page", memswapused, memswaptotal, memswappct); else - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%% - invalid data\n", + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%% - invalid data\n", colorname(COL_CLEAR), "Swap", memswapused, memswaptotal, 0L); addtostatus(msgline); bbwin.c patch: --- bbwin.c.ORIG 2016-01-27 09:54:13.989793661 -0600 +++ bbwin.c 2016-01-27 09:54:17.709793593 -0600 @@ -487,7 +487,7 @@ if (p) sscanf(p, "\nvirtual: %ld %ld", &memacttotal, &memactused); dbgprintf("DEBUG Memory %ld %ld %ld %ld %ld\n", memphystotal, memphysused, memactused, memswaptotal, memswapused); /* DEBUG TODO Remove*/ unix_memory_report(hostname, clienttype, os, hinfo, fromline, timestr, - memphystotal, memphysused, memactused, memswaptotal, memswapused); + memphystotal, memphysused, memacttotal, memactused, memswaptotal, memswapused); } splitmsg_done(); linux.c patch: --- linux.c.ORIG 2016-01-27 09:54:23.861793480 -0600 +++ linux.c 2016-01-27 09:54:27.545793413 -0600 @@ -135,7 +135,7 @@ } unix_memory_report(hostname, clienttype, os, hinfo, fromline, timestr, - memphystotal, memphysused, memactused, memswaptotal, memswapused); + memphystotal, memphysused, memphystotal, memactused, memswaptotal, memswapused); } if (mdstatstr) { After modifications the data from the client remains the same but what the server acts upon and displays now looks like: Windows/XymonPS: Memory Used Total Percentage Real/Physical 1444M 5119M 28% Actual/Virtual 57M 2047M 2% Swap/Page 1742M 10237M 17% Linux: Memory Used Total Percentage Real/Physical 3625M 3949M 91% Actual/Virtual 889M 3949M 22% Swap/Page 6M 4092M 0% You will notice that I changed the labels of each line to include what the names are in the graphs. I figured if I was modifyng these scripts I might as well fix what has been annoying me for a long long time. :) I hope this all makes sense. Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

3 4

HTTP Status 301
by Foster.Patch＠accuweather.com 28 Jan '16

28 Jan '16

Hello, No matter what I do, I cannot get rid of this http error on xymon. Here is the line for my includes: 0.0.0.0 AccuWeatherStore # noconn http://www.accuweatherstore.com/ httpstatus=http;http://www.accuweatherstore.com/;301; And here is what the page prints: http://www.accuweatherstore.com/ - OK HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 28 Jan 2016 15:49:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Status: 301 Moved Permanently X-Frame-Options: DENY X-ShopId: 8909382 X-ShardId: 5 Content-Language: en Location: http://accuweatherstore.com/ Content-Security-Policy-Report-Only: default-src 'self' *; connect-src 'self' *; font-src 'self' * data:; frame-src 'self' *; img-src 'self' * data:; media-src 'self' *; object-src 'self' *; script-src 'self' * 'unsafe-inline' 'unsafe-eval'; style-src 'self' * 'unsafe-inline'; frame-ancestors www.accuweatherstore.com; report-uri /csp-report/63ec6a02-51ba-4f9c-8800-5a8e7a947a3b?source%5Baction%5D=index&source%5Bcontroller%5D=shop&source%5Bsection%5D=storefront; X-XSS-Protection: 1; mode=block; report=/xss-report/63ec6a02-51ba-4f9c-8800-5a8e7a947a3b?source%5Baction%5D=index&source%5Bcontroller%5D=shop&source%5Bsection%5D=storefront X-Request-Id: 63ec6a02-51ba-4f9c-8800-5a8e7a947a3b P3P: CP="NOI DSP COR NID ADMa OPTa OUR NOR" X-Dc: chi2,ash X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff Seconds: 0.159071000 I have tried to change around both URLs for the includes, with no success. Any suggestions?

2 1