March 2016 - Xymon - Xymon mailman web

PORTS and STATE syntax
by dboldt＠usgs.gov 18 Mar '16

18 Mar '16

I'm not successful filtering on the connection state associated with a port. None of the syntax variations I have tried have been successful. If I remove the STATE specifier, matches are found. There are multiple hosts connecting to the same port: ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57765 ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57766 ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57768 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45096 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45104 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45107 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36141 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36150 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36151 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34320 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34321 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34324 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50726 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50727 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50729 LISTEN 0 0 *:61617 *:* I've set up several port monitoring specifications, but none of them match the state (the first example where no state is specified succeeds): PORT LOCAL=%[:](61617) REMOTE=%10.160.8.132 MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-DHCP PORT LOCAL=%[:](61617) REMOTE=%10.160.8.133 STATE=ESTABLISHED MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-nsp.er PORT LOCAL=%[:](61617) REMOTE=%136.177.16.3 STATE=ESTAB MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.cr PORT LOCAL=%[:](61617) REMOTE=%137.227.240.32 STATE=%ESTAB MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.er PORT LOCAL=%[:](61617) REMOTE=%130.118.4.2 STATE=%ESTAB* MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.wr Note: On this server netstat does not exist and ss is being used,. Observation: Discovering the syntax for REMOTE was trial and error. Specifying the IP address alone did not work, and I found no examples for the type of filtering above. -- -- David Boldt <dboldt at usgs.gov> "Discovery consists of seeing what everybody has seen and thinking what nobody has thought." --Albert Szent-Gyorgyi (1893 - 1986)

2 4

OS version tags
by johan.karlsson＠deltait.se 18 Mar '16

18 Mar '16

Hi! We have an issue with RHEL7 and xymon-client 4.3.26 In client-local.cfg on our xymon server we have these log rules: [linux] log:/var/log/daemon.log:102400 log:/var/log/kern.log:102400 log:/var/log/syslog:102400 log:/var/log/messages:102400 ignore MARK [rhel3] log:/var/log/messages:102400 ignore MARK We have an old RHEL5 server which reports the following to Xymon and thus get matched against [rhel3] in client-local.cfg: [collector:] client oldserver,xxx,com.rhel3 rhel3 However, unconfigured the RHEL7 server reports: [collector:] client newserver,xxx,com.linux linux Setting CLIENTOS="rhel3" in /etc/sysconfig/xymon-client only changes the first: [collector:] client newserver,xxx,com.rhel3 linux We need it to report: [collector:] client newserver,xxx,com. rhel3 rhel3 Any idea where to change the setting for that? The issue is that RHEL doesn't have daemon.log, kern.log etc, so these turn up as warnings in the msgs test Regards, Johan

2 2

information about alerts
by velpulavenkat6＠gmail.com 17 Mar '16

17 Mar '16

Hi, this is venkat am using xymon monitoring tool i want to know some information about sound alerts to alert mails like yellow and red marks. -- *Regards* *Venkat Yadav*

2 1

Server to Server communication
by trevor.t.woods＠lmco.com 17 Mar '16

17 Mar '16

Hi, what's the best way to send data between xymon servers when http is not available. Our network will be very restricted and we can only send files through. I have setup a centralized master xymon server ready to go just trying to find the best solution of getting the data to it from the child servers. All I have found so far is creating pre generated report for the master server to read. Regards, Trev

3 2

How Xymon invokes an SSH connection to the Client?
by cs＠agege.com 17 Mar '16

17 Mar '16

Greetings, Please what kind of code or internal scripts Xymon runs to invoke an SSH connection to the client and what runs the Xymon client scripts. In order words, please could you enlighten me with the actual commands or codes or scripts that Xymon uses for the SSH connection and any Xymon codes running on each Client. Thanks, Agege

5 13

Purple Interval
by john＠executech.com 17 Mar '16

17 Mar '16

Is it possible to shorten the purple for the entire server? We have servers that don't have ICMP access so when the server goes offline, we rely on the purple alert to let us know that the server is down. With the 30 minute delay, I'm not getting those alerts until much after the server needs to be back up. Is it possible to change the delay so I would know sooner if the server is down? John Tullis

4 3

Xymon Digest, Vol 62, Issue 8
by cs＠agege.com 17 Mar '16

17 Mar '16

Greetings, Is there anyway to get an Xymon alert on Windows server that has been running for over 120days. -Agege > On Mar 10, 2016, at 5:00 AM, xymon-request at xymon.com wrote: > > Send Xymon mailing list submissions to > xymon at xymon.com > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.xymon.com/mailman/listinfo/xymon > or, via email, send a message with subject or body 'help' to > xymon-request at xymon.com > > You can reach the person managing the list at > xymon-owner at xymon.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Xymon digest..." > > > Today's Topics: > > 1. PORTS and STATE syntax (Boldt, David) > 2. Re: jmxstat (Andy Smith) > 3. The testip option does not seem to be honored by the http > test (Shawn Heisey) > 4. Re: The testip option does not seem to be honored by the http > test (John Thurston) > 5. How to change the refresh time for acknowledgements (john boris) > 6. Re: How to change the refresh time for acknowledgements > (Ryan Novosielski) > 7. Re: How to change the refresh time for acknowledgements > (Ryan Novosielski) > 8. Re: How to change the refresh time for acknowledgements > (john boris) > 9. Re: jmxstat (Galen Johnson) > 10. Always purple history after time shift on server - how to fix > (Andrey Chervonets) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Mar 2016 09:09:16 -0500 > From: "Boldt, David" <dboldt at usgs.gov> > To: <xymon at xymon.com> > Subject: [Xymon] PORTS and STATE syntax > Message-ID: > <CAC_ry0YJfGtLA9sHeqLH6RnwRfMYeKbq+3S7EnS5AEBVsfcFng at mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > I'm not successful filtering on the connection state associated with a port. > None of the syntax variations I have tried have been successful. > If I remove the STATE specifier, matches are found. > > There are multiple hosts connecting to the same port: > > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57765 > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57766 > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57768 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45096 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45104 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45107 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36141 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36150 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36151 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34320 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34321 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34324 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50726 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50727 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50729 > LISTEN 0 0 *:61617 *:* > > I've set up several port monitoring specifications, but none of them > match the state (the first example where no state is specified > succeeds): > > PORT LOCAL=%[:](61617) REMOTE=%10.160.8.132 MIN=3 MAX=3 COLOR=yellow > TEXT=ActiveMQ-DHCP > PORT LOCAL=%[:](61617) REMOTE=%10.160.8.133 STATE=ESTABLISHED MIN=3 > MAX=3 COLOR=yellow TEXT=ActiveMQ-nsp.er > PORT LOCAL=%[:](61617) REMOTE=%136.177.16.3 STATE=ESTAB MIN=3 MAX=3 > COLOR=yellow TEXT=ActiveMQ-ns.cr > PORT LOCAL=%[:](61617) REMOTE=%137.227.240.32 STATE=%ESTAB MIN=3 MAX=3 > COLOR=yellow TEXT=ActiveMQ-ns.er > PORT LOCAL=%[:](61617) REMOTE=%130.118.4.2 STATE=%ESTAB* MIN=3 > MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.wr > > Note: On this server netstat does not exist and ss is being used,. > > > Observation: Discovering the syntax for REMOTE was trial and error. > Specifying the IP address alone did not work, and I found no examples > for the type of filtering above. > > -- > -- David Boldt > <dboldt at usgs.gov> > > > "Discovery consists of seeing what everybody has seen and thinking > what nobody has thought." > --Albert Szent-Gyorgyi (1893 - 1986) > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Mar 2016 16:36:44 +0000 > From: Andy Smith <abs at shadymint.com> > To: Galen Johnson <Galen.Johnson at sas.com>, "xymon at xymon.com" > <xymon at xymon.com> > Subject: Re: [Xymon] jmxstat > Message-ID: > <CAFz9LfvL-9XVo5BOui2oDy4XXqRPmajP-yhAyfEfrObzxB6Y=g at mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > ---------- Forwarded message ---------- >> From: Galen Johnson <Galen.Johnson at sas.com> >> Date: 9 March 2016 at 00:26 >> Subject: [Possible Spam] [Xymon] jmxstat >> To: "xymon at xymon.com" <xymon at xymon.com> >> >> Hey, >> >> I don't think this is specific to jmxstat but I'm trying to implement. I'm getting the > following in apache log when I hit the page: >> >> Setup error: Service GCInfo has a graph GCInfo, but no graph-definition,... >> >> However, the definition does exist and I can view the graphs if I select a different > > service and change the name in the URL. RRDs are being created. >> >> Anyone else run into this and overcome it? >> >> thanks > > Not seen that before, but just check for me please, is GCInfo mentioned in > both TEST2RRD and GRAPHS in xymonserver.cfg? > -- > Andy > > > ------------------------------ > > Message: 3 > Date: Wed, 9 Mar 2016 10:53:08 -0700 > From: Shawn Heisey <hobbit at elyograg.org> > To: xymon at xymon.com > Subject: [Xymon] The testip option does not seem to be honored by the > http test > Message-ID: <56E06304.6040301 at elyograg.org> > Content-Type: text/plain; charset=utf-8 > > I have the following in my hosts.cfg file: > > 10.100.2.131 fourqueens.REDACTED.com # testip ssh > mgmt=10.2.6.131[http,https,ssh] https://megaagency.REDACTED.com > delayred=http:10 > 10.100.2.132 fitzgeralds.REDACTED.com # testip ssh > mgmt=10.2.6.132[http,https,ssh] https://megaagency.REDACTED.com > delayred=http:10 > > The "mgmt" option controls a custom server-side script we wrote that > verifies reachability of the out-of-band server management (Dell DRAC in > this case). > > I had expected the "testip" option to force the https URL test to be > sent directly to the server, not the DNS address (which is a load > balancer), but I can see the load balancer cookie in the response and > requests in the load balancer's log. > > Is there any way to get the intended behavior? > > The server is running 4.3.23 with the patch to fix http response code > interpretation. > > Thanks, > Shawn > > > ------------------------------ > > Message: 4 > Date: Wed, 09 Mar 2016 09:00:09 -0900 > From: John Thurston <john.thurston at alaska.gov> > To: xymon at xymon.com > Subject: Re: [Xymon] The testip option does not seem to be honored by > the http test > Message-ID: <56E064A9.300 at alaska.gov> > Content-Type: text/plain; CHARSET=US-ASCII; format=flowed > > On 3/9/2016 8:53 AM, Shawn Heisey wrote: > - snip - >> I had expected the "testip" option to force the https URL test to be >> sent directly to the server, not the DNS address (which is a load >> balancer), but I can see the load balancer cookie in the response and >> requests in the load balancer's log. > > The TESTIP controls the behavior of the CONN test. To make the HTTP test > use an IP address instead of resolving the name, use the following syntax: > http://www.sample.com=1.2.3.4/index.html > > From the hosts.cfg man page: > >> Testing sites by IP-address >> xymonnet ignores the "testip" tag normally used to force a test to use the IP-address from the hosts.cfg file instead of the hostname, when it performs http and https tests. >> The reason for this is that it interacts badly with virtual hosts, especially if these are IP-based as is common with https-websites. >> Instead the IP-address to connect to can be overridden by specifying it as: >> http://www.sample.com=1.2.3.4/index.html >> The "=1.2.3.4" will case xymonnet to run the test against the IP-address "1.2.3.4", but still trying to access a virtual website with the name "www.sample.com". >> The "=ip.address.of.host" must be the last part of the hostname, so if you need to combine this with e.g. an explicit port number, it should be done as >> http://www.sample.com:3128=1.2.3.4/index.html > > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Enterprise Technology Services > Department of Administration > State of Alaska > > > ------------------------------ > > Message: 5 > Date: Wed, 9 Mar 2016 13:03:13 -0500 > From: john boris <jborissr at gmail.com> > To: xymon at xymon.com > Subject: [Xymon] How to change the refresh time for acknowledgements > Message-ID: > <CAOk1TCyYkPqGEVNE=6eXDfOwpxd=_0_AneWivxn0WBjgaXdO0w at mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > How can you change the response time when you acknowledge an issue so that > it shows up as a check and you don't get pinged repeatedly. It looks like > it takes about 5 minutes for the acknowledgement to take place. > > -- > John J. Boris, Sr. >

3 2

error running report.sh
by cleaver＠terabithia.org 17 Mar '16

17 Mar '16

On Tue, March 15, 2016 6:09 pm, Jason Brockdorf wrote: > I'm still working on setting up Xymon (from the terabithia RPMs) and my > manager tells me today that there's an error message when trying to run > reports, like the availability report, snapshot report, etc. > I'm getting an error message:Â Cannot create output directory > When examining the logs for more details I don't get a whole lot to go on. > Â I checked with both httpd and xymon logs and I didn't see anything > relevant to this problem. > > I'm really trying to help myself and not make my problems everyone else's > problems, and I'd really like to contribute to the community in some way, > so here's what I've done so far to try to fix it: > 1. going to the /var/cache/xymon/ directory and creating a rep directory2. > giving rwxrwxrwx permissions to that directory > I then managed to download the srpms from terabithia, find the offending > file and examine the source to see what happens. > TheÂ XYMONREPDIR environment variable is used in creating the directory > where the report will go, but I don't know: > 1. How to check which process is running the file that's encountering the > problem (httpd or some xymon process)2. How to check for the presence or > value of this variable in the environment that process is using > So I decided to see if I could modify the source and make xymon give me a > little more information. Â The resultant patch file is attached, though be > forewarned, my C experience is limited to a primer class I took as a > freshman in highschool and on top of not having that much knowledge in the > first place, I'm very rusty. > >>From what I understand in the source there's not much error checking or >> information provided if it fails. Â I do see: > envcheck(reqenv); > But this by itself doesn't prevent continued execution if say my > $XYMONREPDIR is not found. > Well, I added a line to report which directory xymon is attempting to > create, and another which should report the error message if the attempt > was unsuccessful. Â I did manage to create the attached patch file, but I > was unable to recompile using the srpm *sniffle* <-- I'm crying from > frustration at this point > So, I downloaded the source from sourceforge, replaced the report.c file > with the one I made, compiled using that, copied the report.sh file to a > working xymon server to try to test it... and I get internal server error > :( > I then went back to test it on xymon compiled from sourceforge source, and > I get an error that I don't have permission to access that directory. > *rips hair out* > Thus, it would seem that I am unable to reproduce the problem with "stock" > xymon, and I'm apparently not bright enough to fix it with terabithia > srpms either. Â At this point, I feel like I've put in enough effort to > warrant asking for help. Â Anyone, please help? Hi, This appears, from my testing, to be an SELinux issue -- although I'm still trying to debug precisely what is happening here on the EL7 side. A quick workaround would be to set SELinux to permissive ('setenforce 0') on the main server, which should let snapshoting/reporting work. It's definitely not a normal unix permissions/ownership issue. Can you check /var/log/audit/audit.log on your system and verify that snapshot.cgi is being denied? Also, can you post the output of `semodule -l | grep xymon`? If 'xymon' is not listed, can you try running: /usr/sbin/semodule -s targeted -i /usr/share/selinux/targeted/xymon.pp and post the result? Regards, -jc

3 4

error running report.sh
by apocalysque＠yahoo.com 16 Mar '16

16 Mar '16

The patch I submitted before is no bueno. Looks like I forgot an include line and to replace a stub variable name with the actual name. Sorry :\ I think the include(s) needed are: #include <errno.h> And the line that says: + sprintf(msg, "Cannot create output directory:<br>\n%s<br>\n%s", somepath, strerror(errno));should read: + sprintf(msg, "Cannot create output directory:<br>\n%s<br>\n%s", outdir, strerror(errno)); I'll try again tonight after work to download, recompile, and submit a valid patch. I already deleted the test VM I was using.________________________________ From: Jason Brockdorf via Xymon <xymon at xymon.com> To: "xymon at xymon.com" <xymon at xymon.com> Sent: Tuesday, March 15, 2016 8:09 PM Subject: [Xymon] error running report.sh I'm still working on setting up Xymon (from the terabithia RPMs) and my manager tells me today that there's an error message when trying to run reports, like the availability report, snapshot report, etc. I'm getting an error message: Cannot create output directory When examining the logs for more details I don't get a whole lot to go on. I checked with both httpd and xymon logs and I didn't see anything relevant to this problem. I'm really trying to help myself and not make my problems everyone else's problems, and I'd really like to contribute to the community in some way, so here's what I've done so far to try to fix it: 1. going to the /var/cache/xymon/ directory and creating a rep directory 2. giving rwxrwxrwx permissions to that directory I then managed to download the srpms from terabithia, find the offending file and examine the source to see what happens. The XYMONREPDIR environment variable is used in creating the directory where the report will go, but I don't know: 1. How to check which process is running the file that's encountering the problem (httpd or some xymon process) 2. How to check for the presence or value of this variable in the environment that process is using So I decided to see if I could modify the source and make xymon give me a little more information. The resultant patch file is attached, though be forewarned, my C experience is limited to a primer class I took as a freshman in highschool and on top of not having that much knowledge in the first place, I'm very rusty. >From what I understand in the source there's not much error checking or information provided if it fails. I do see: envcheck(reqenv); But this by itself doesn't prevent continued execution if say my $XYMONREPDIR is not found. Well, I added a line to report which directory xymon is attempting to create, and another which should report the error message if the attempt was unsuccessful. I did manage to create the attached patch file, but I was unable to recompile using the srpm *sniffle* <-- I'm crying from frustration at this point So, I downloaded the source from sourceforge, replaced the report.c file with the one I made, compiled using that, copied the report.sh file to a working xymon server to try to test it... and I get internal server error :( I then went back to test it on xymon compiled from sourceforge source, and I get an error that I don't have permission to access that directory. *rips hair out* Thus, it would seem that I am unable to reproduce the problem with "stock" xymon, and I'm apparently not bright enough to fix it with terabithia srpms either. At this point, I feel like I've put in enough effort to warrant asking for help. Anyone, please help? _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

After trimhistory, no more events on nongreen page
by j.hillen＠draads.nl 16 Mar '16

16 Mar '16

Good day one and all, I ran the trimhistory command as root, which I realize afterwards, probably caused this problem - confirmed by messages of yore in this mailing list. However, restarting xymon / setting permissions on contents of history files (/var/lib/xymon/hist/) to xymon:xymon doesn't seem to help. The rest of Xymon is working, /var/lib/xymon/hist/allevents shows current changes. I do see the following in /var/log/xymon/history.log: 2016-03-16 11:51:05.989979 xymond_channel: Peer not up, flushing message queue I make use the latest Xymon release from Terebathia on CentOS 7, Xymon 4.3.26- 1.el7.terabithia. Any suggestions would be greatly appreciated.

1 1