February 2016 - Xymon - Xymon mailman web

Xymon disruption every night!
by linuxmasterjedi＠free.fr 19 Feb '16

19 Feb '16

Hi, I'm still running into troubles every night between ~0h30 and ~2h40 :-( 1) I checked the backup on my physical XYmon server : around 9pm and runs for 4:45 min. 2) We cross-monitored the DNS server from another monitoring tool : no DNS outage detected. 3) I monitored the Xymon server network link state with "mii-tool" every seconds : no troubles detected 4) I pinged my Xymon servers from 2 differents network places all night long : no troubles detected. 5) No firewalls between my Xymon server and the monitored hosts 6) Over 500 hosts, only ~30 are in trouble every night and mostly the same 7) Hosts are VM, physical servers, public internet website Here is what I've found in the xymond.log today : 2016-02-16 02:02:57 Flapping detected for www.foo1.com:http - 5 changes in 1708 seconds 2016-02-16 02:02:57 Flapping detected for www.foo2.com:http - 5 changes in 1708 seconds 2016-02-16 02:02:57 Flapping detected for www.microsoft.com:http - 5 changes in 1708 seconds 2016-02-16 02:06:14 Flapping detected for server01:http - 5 changes in 1678 seconds 2016-02-16 02:06:14 Flapping detected for server02:http - 5 changes in 1678 seconds 2016-02-16 02:06:29 Flapping detected for server03:conn - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server04:ldap - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server06:ssh - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server05:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server07:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server08:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server09:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for foo.bar1.com:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for foo.bar2.com:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for foo.bar3.fr:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server10:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server11-t:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server12:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server13:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server14:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server15:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server16:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server17:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server18:http - 5 changes in 1745 seconds 2016-02-16 02:07:21 Flapping detected for server19:http - 5 changes in 1745 seconds Here is a part of the configuration + errors displayed in the XYmon HTTP interface : hosts.cfg : 0.0.0.0 server03 # conn NAME:"server03" DESCR:"VM FOO BAR" Error : conn NOT ok : DNS lookup failed / Unable to resolve hostname server03 System unreachable for 2 poll periods (86 seconds) Everything looks like the DNS resolution failed. hosts.cfg : 10.X.Y.188 server05 # conn tse NAME:"Server 05" DESCR:"My comment" http://server05/ Error : DNS error red http://server05/ - DNS error - Why I have a "DNS error" here ? I set up the IP yesterday to this host to solve the issue. The "conn" error disappear since yesterday evening but the http still remains. Le 29 janvier 2016 13:22:06 GMT+01:00, Becker Christian <christian.becker at rhein-zeitung.net> a écrit : >My intention was the figure out if the network connection of the Xymon >server itself has a problem… >For example, if your Xymon server is hardware, then it has a wired >network interface that is connected to a network switch. That’s your >link between the Xymon server and all of your other VMs and physical >servers. >From my side, if you only see problems on the Xymon server, I’ld have a >look at this particular switch port or the cable infrastructure to the >Xymon server. Or could there be a firewall rule preventing the Xymon >server accessing the DNS server? > >By the way – do you have only one DNS server in /etc/resolv.conf? Did >you check the logs on your DNS server? Can you issue a continuous ping >to the Xymon server to see if it loses some packages in 24hours? > >Regards >Christian > > >Christian Becker >IT-Services > >Christian.Becker at rhein-zeitung.net<mailto:Christian.Becker at rhein-zeitung.net> >_________________________________ >Mittelrhein-Verlag GmbH >August-Horch-Straße 28 >D-56070 Koblenz >Verleger und Geschäftsführer: Walterpeter Twer >Reg.-Gericht Koblenz HRB 121 >Finanzamt Koblenz Str.Nr. 22 65 10 285 2 >www.rhein-zeitung.de<http://www.rhein-zeitung.de/> > >Von: Xymon [mailto:xymon-bounces at xymon.com] Im Auftrag von L-M-J >Gesendet: Freitag, 29. Januar 2016 13:07 >An: Xymon at xymon.com >Betreff: Re: [Xymon] Xymon disruption every night! > >Problems appears on VMs and physical servers and Lan and DMZ >equipments. I don't see a link between those devices :-( > >Le 29 janvier 2016 09:23:14 GMT+01:00, Becker Christian ><christian.becker at rhein-zeitung.net<mailto:christian.becker at rhein-zeitung.net>> >a écrit : >Hi L-M-J, > > >can you exclude that this behavior is coming from any network device >like a switch or default gateway? > > >Regards >Christian > > >Christian Becker >IT-Services > > >Christian.Becker at rhein-zeitung.net<mailto:Christian.Becker at rhein-zeitung.net> >_________________________________ >Mittelrhein-Verlag GmbH >August-Horch-Straße 28 >D-56070 Koblenz >Verleger und Geschäftsführer: Walterpeter Twer >Reg.-Gericht Koblenz HRB 121 >Finanzamt Koblenz Str.Nr. 22 65 10 285 2 >www.rhein-zeitung.de<http://www.rhein-zeitung.de/> > > >Von: Xymon [mailto:xymon-bounces at xymon.com] Im Auftrag von L-M-J >Gesendet: Freitag, 29. Januar 2016 08:57 >An: Xymon at xymon.com<mailto:Xymon at xymon.com> >Betreff: [Xymon] Xymon disruption every night! > > >Hi, > >I'm running Xymon since 6 years (4.3.17 atm) on Debian 7.8 >3.2.0-4-amd64 >Since 1 month now, every night, between 0h30 or 2h am at +/- 30 min, >around 30 hosts become unreachable : > >Fri Jan 29 01:16:38 2016 conn NOT ok : DNS lookup failed >Unable to resolve hostname foo.bar.local >System unreachable for 3 poll periods (170 seconds) >green 0.0.0.0 is alive (0.02 ms) [<- 127.0.0.1<http://127.0.0.1>] > > >- Got around 500 monitored hosts and looks like the same hosts are >lost every single night. >- Those monitored hosts are not necessary on the same network, not >the same OS. >- We cross monitored the same hosts and the other monitoring tool >doesn't have report the DNS outage. >- I ran a DNS lookup every seconds on the Hobbit server several days >and it never reported a DNS outage. >- I don't have any crontab installed on the server who could disturb >Xymon. >- Nothing strange in the Xymon logs nor the server logs, no memory >leaks or CPU overloaded. >- The rest of the day, Xymon server behavior is normal. >- What I've done on the server 1 month ago ? I don't know, no system >upgrade or so. >- I had DNSMASQ acting like a cache, I disabled it : same issue >- /etc/resolv.conf is quite light : search bar.local, next line : >nameserver IP.OF.OUR.DNS.SERVER1, just like other servers > >The issue could be anywhere : inside or outside the server, Xymon or >not... I have to confess, I'm running out of ideas to find the issue, >is >anyone here may have some leads, I will be thankful ! > >Have a nice day! > >-- >Envoyé de mon appareil Android avec K-9 Mail. Veuillez excuser ma >brièveté. -- Envoyé de mon appareil Android avec K-9 Mail. Veuillez excuser ma brièveté.

5 5

Looking for syncology client configuration
by jborissr＠gmail.com 19 Feb '16

19 Feb '16

I just installed the syncology client but can't locate the configuration file so I can point it at my xymon server. Is anyone using this and can point me to it? TIA -- John J. Boris, Sr.

1 0

windows server 2012 --purple
by AAJOSE＠telmex.com 19 Feb '16

19 Feb '16

Hello, I have a problem with monitoring Xymon for Windows 2012 servers, the tag's CPU, disk, memory, etc. They are in purple that means ceased to be monitored by Xymon. And turn off the firewall and does not work. Could you help me please. Thank you. [cid:image005.png at 01D16A8B.CECC50F0] Ing. José Trinidad Álvarez Operación Sun | Triara Querétaro Tel. 442 101 82 36 Cel. 442 5572303 [cid:image006.jpg at 01D16A8B.CECC50F0] Infinitum. Exceso de Velocidad. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any, is intended only for the person or entity to which it is addressed and may contain confidential and /or privileged material. Any review, use, disclosure or distribution of such confidential information without the written authorization of Teléfonos de México SAB de CV is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. By receiving this e-mail you acknowledge that any breach by you and/or your representatives of the above provisions may entitle Teléfonos de México SAB de CV to seek for damages. AVISO DE CONFIDENCIALIDAD: Este correo electrónico, incluyendo en su caso, los archivos adjuntos al mismo, pueden contener información de carácter confidencial y/o privilegiada, y se envían a la atención única y exclusivamente de la persona y/o entidad a quien va dirigido. La copia, revisión, uso, revelación y/o distribución de dicha información confidencial sin la autorización por escrito de Teléfonos de México SAB de CV está prohibida. Si usted no es el destinatario a quien se dirige el presente correo, favor de contactar al remitente respondiendo al presente correo y eliminar el correo original incluyendo sus archivos, así como cualesquiera copia del mismo. Mediante la recepción del presente correo usted reconoce y acepta que en caso de incumplimiento de su parte y/o de sus representantes a los términos antes mencionados, Teléfonos de México SAB de CV tendrá derecho a los daños y perjuicios que esto le cause.

3 2

Displaying to different categories
by harold.thurnstein＠gmail.com 18 Feb '16

18 Feb '16

Hi, Is it possible to for a host to send events back to the xymon server so that the events are displayed on the same page but under different categories. For example, if I have a set of machines with several of them being database servers, I would like all the OS information (I.e. CPUs, memory, etc) for each host to be displayed under one section (I.e. Hosts). However I would also like to generate events for the database servers (I.e. Table counts, space) to be sent back to be displayed under the same page but under a different heading (I.e. Databases). I've searched the xymon man pages and couldn't see if this could (or couldn't) be done. Thanks. Hal.

2 1

Client data not showing up on display
by jborissr＠gmail.com 17 Feb '16

17 Feb '16

I am still new to Xymon coming from a long time Big Brother user. I have my Xymon server up and running and working and I am systematically walking through my servers and resurrecting my Big Brother clients. The Big Brother clients are working fine so far but I am having an issue with one of them. The client is running but it looks like the data is not getting sent to the server. I am looking for a good how to that describes how to install the client on a machine or if someone has already moved from Big Brother to Xymon how did they handle the their client transition. TIA -- John J. Boris, Sr. Head Freshmen Football Coach Camden Catholic High School

2 3

Flapping status not in BBALPHAMSG
by g.ongaro＠varitt.it 17 Feb '16

17 Feb '16

Hi, I'm using Xymon on a server with an external dispatcher system. To integrate it, I use the "SCRIPT" command in alerts.cfg, but I have a problem with the flapping status messages. In the variable BBALPHAMSG I have not the "WARNING: Flapping Status" message and I see only a red status with a green message. Can you help me? Is possible to integrate the "flapping status" message? Thanks Best Regards -- * Gianluca Ongaro***

2 2

Question Regarding TCP Statistics Graph
by matt1299＠gmail.com 16 Feb '16

16 Feb '16

Hello, I'm a bit confused on what exactly this TCP Statistics graph is saying (image attached). What exactly are the units in this graph? The y axis shows ~1-2 events but the legend shows 100-600"m". What is the magnitude of "m" exactly? Do the numbers in the legend not line up with the graph axis units? Is there a reason for this? I would greatly appreciate if anyone could clear this up for me! Thanks!! -- Matt Vander Werf

2 1

lists.xymon.com ipv6 is broken
by feld＠feld.me 14 Feb '16

14 Feb '16

Whenever I try to access the Xymon mailing list archives I have to wait a long time for the ipv6 connection attempt to time out. Can someone remove the AAAA record or fix the issue? I can ping6, but port 80/443 is not open. Thanks! -- Mark Felder feld at feld.me

2 1

Does xymongrep work?
by john.thurston＠alaska.gov 13 Feb '16

13 Feb '16

I'm having difficulty with xymongrep, and it isn't related to 4.3.25 because I see the same behavior on 4.3.22. If I use the command: ~/server/bin/xymongrep --debug --hosts=./server/etc/hosts.cfg * I get > 7667 2016-02-12 12:37:15.937475 Loading host configuration from ./server/etc/hosts.cfg > 7667 2016-02-12 12:37:15.937872 Opening file ./server/etc/hosts.cfg > 7667 2016-02-12 12:37:15.939296 Opening file ./server/etc//retired_hosts > 7667 2016-02-12 12:37:15.939637 Opening file ./server/etc//external_hosts I can't get it to kick back anything. I've tried prefixing it with xymoncmd, using --test-untagged, naming specific tests. The undocumented --no-down causes it to > 12870 2016-02-12 12:44:53.038374 Connect status is 0 > 12870 2016-02-12 12:44:53.038414 Sent 52 bytes > 12870 2016-02-12 12:44:53.044933 Read 8192 bytes > 12870 2016-02-12 12:44:53.044985 Read 13829 bytes > 12870 2016-02-12 12:44:53.045010 Closing connection Does xymongrep work for anyone else? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 3

Phantom red statuses (Fwd: Xymon [750466] mgmtconsole:msgs CRITICAL (RED))
by earle＠isolar.DynDNS.ORG 13 Feb '16

13 Feb '16

> On Feb 12, 2016, at 3:00 AM, xymon-request at xymon.com wrote: > > Is there any chance you have multiple servers reporting in with the name > 'mgmtconsole'? Especially if you're not using FQDN (which it doesn't seem > like you are), that seems like something that might cause this: Two > different servers with the same name, each sending their own red/green > states every few minutes. Thanks JC. Interesting theory: you see, the old syslog server was on a separate machine and it never had this Flapping status issue, despite it getting all of the same syslog messages. "mgmtconsole" is my Xymon server so I thought "Oh maybe because it's acting as both server and client that's what's screwing it up", but before this I never got any anomalous alerts from "mgmtconsole" itself, just the expected reds/yellows from any (ab)normal condition that triggered them. So no, there aren't two different servers (and yes, I don't use FQHN's). The perma-red state is back, btw. So, given that the old syslog server wasn't in perma-red/Flapping state, why would the new syslog/Xymon combo server be in it? Also, given that the actual contents of "/var/log/messages" aren't causing red alerts, is the red alert state caused solely by it flapping between yellow and green? (I still don't get why the old machine wasn't in a similar perma-red/Flapping state.) Where should I look to try and cure this? Thanks, - Greg

2 1