March 2016 - Xymon - Xymon mailman web

NTP test flapping for remote systems
by bferrell＠baywinds.org 04 Mar '16

04 Mar '16

I'm not sure what this is about. I have a few remote systems and to be sure ntp is working, I have them set for the ntp test. even though the time is never out of sync, I get periodic failures of the test. Any thoughts?

3 2

can Xymon monitor Linux defunct process or Zombie process
by cs＠agege.com 03 Mar '16

03 Mar '16

Greetings, I have a quick question. Is there a way to monitor defunct processes with Xymon. Please let me know if there is a script for this. Thanks, Agege

3 2

how to modify columns in Xymon dashboard
by cs＠agege.com 03 Mar '16

03 Mar '16

Greetings, I am new to Xymon and I need your help in the following areas. 1. How can I modify Xymon column headers in the Dashboard. ( i.e ssh cpu men). 2. I am looking for ways to get alerts when ever ipv6 is enable on the servers. Thank you for your considerations. Best regards, Agege

3 3

Alert Thresholds Linux Client Side
by john＠executech.com 03 Mar '16

03 Mar '16

Sorry if this has been answered. Is there any way to control thresholds on the Xymon-Client Linux client side like I can control thresholds in the bbwingui.exe utility for Windows? I have a lot of different people that like to control what alerts they get but don't have access to modify files on the Xymon server and it would be nice if they could define those thresholds on their own. Thanks, John Tullis

2 1

Ongoing problem with multiple recovery notices
by larry＠fni-stl.com 02 Mar '16

02 Mar '16

Finally figured out what I was doing wrong. RECOVERED was not part of the $STOP macro definition. So it worked fine on alerts but failed to stop (sometimes) on the recovery and would continue to search for matching rules. Both the script method and IGNORE work for me as they should now. # $STOP=SCRIPT /paging/bin/xymon-ignore.sh none FORMAT=SCRIPT RECOVERED STOP # Preferred since it is minimal. $STOP=IGNORE RECOVERED #--------------------------------------------------------------------------------------- HOST=* SERVICE=files $STOP HOST=%test-server* MAIL admin1 at fni-stl.com REPEAT=60 RECOVERED COLOR=yellow,red $STOP A question for J.C., I know that STOP and REPEAT=30 are automatically included in an IGNORE line. Is there any reason that RECOVERED shouldn't automatically be there as well? At least the way I'm using it there would never be an exception to that. But maybe for others there would be. Thanks. Larry RHEL 6.7 Xymon 4.3.26 -----Original Message----- From: Larry Bonham Sent: Friday, September 11, 2015 2:49 PM To: xymon at xymon.com Subject: Ongoing problem with multiple recovery notices with on a few tests I apologize if this is a mostly duplicate message from earlier today. It was too large due to an attachment. And I had some incorrect information in the example configuration I provided. This one is smaller and correct. -------------------------------------------------------------------------------------------------------------------- I'm having an ongoing problem with multiple recovery notices. I was really hoping that 4.3.21 would have fixed it but not so. The alert picks up the correct rule and stops at line 467. Recover hits that rule then continues on down the list. It will then duplicate on a secondary matching rule line 482 and then on my catch all default rule line 618. This isn't on all alert recoveries. Mostly appears to only happen on "server" names that have an underscore or dash in it. That may just be a coincidence. Here is an example of recent email notices showing the problem. It's really a small percentage of my total alerts that do this. But that subset will do it consistently. There has to be something different about that group. >From Subject Received Xymon STL Xymon [839283] qa_ccsic_ccs_red_alert:http CRITICAL (RED) [cfid:467] 7:11 AM Xymon STL Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:467] 7:40 AM Xymon STL Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:482] 7:40 AM Xymon STL Xymon qa_ccsic_ccs_red_alert:http recovered [cfid:618] 7:40 AM I got a response from J.C. on this around 3/4/15. He and I agreed that the problem is most likely in lib/loadalerts.c. Which is a pretty complicated piece of code. ANYWAY, I wanted to see if anyone else is experiencing this and, if so, were you able to adjust or work around it. It isn't a major problem. Just an annoyance. RHEL 6.6 Xymon 4.3.21 >From hosts.cfg 0.0.0.0 qa_ccsic_ccs_red_alert # noconn nosslcert https://qa.ccsic.fni-stl.com/cgi-bin/xxx_alert.pl Relevant section from alerts.cfg ### My email results represent admin3 at fni-stl.com ### macro to stop further rule checking. Also tried IGNORE. Same results. 180 $STOP=SCRIPT xymon-ignore.sh none FORMAT=SCRIPT STOP 465 PAGE=%url/CCS HOST=%(qa|test|launch)_ccsic_ccs.*_(redalert|red_alert) EXSERVICE=sslcert 466 MAIL admin1 at fni-stl.com DURATION>2 REPEAT=60 RECOVERED 467 MAIL admin3 at fni-stl.com DURATION>2 REPEAT=60 RECOVERED 468 $STOP <-- when alerting on fail it always stops here. But recovery notices keep going. ### catch all rule for the url page and not handled above. 480 PAGE=%url/.* EXSERVICE=sslcert 481 MAIL admin2 at fni-stl.com DURATION>2 REPEAT=60 RECOVERED COLOR=yellow,red 482 MAIL admin3 at fni-stl.com DURATION>2 REPEAT=60 RECOVERED COLOR=yellow,red ... Email other users. Line format identical to above. 490 SCRIPT xymon-page.sh grp1 DURATION>2 FORMAT=SCRIPT REPEAT=60 RECOVERED COLOR=red 491 SCRIPT xymon-page.sh grp3 DURATION>2 FORMAT=SCRIPT REPEAT=60 RECOVERED COLOR=red,purple 492 $STOP ### catch all rule for anything not handled above. 616 HOST=* 617 MAIL admin1 at fni-stl.com REPEAT=1440 RECOVERED COLOR=yellow,red 618 MAIL admin3 at fni-stl.com REPEAT=1440 RECOVERED COLOR=yellow,red 619 SCRIPT xymon-page.sh grp3 FORMAT=SCRIPT REPEAT=60 RECOVERED COLOR=red 620 $STOP Larry B. ________________________________ CONFIDENTIALITY NOTICE: This electronic mail message is intended exclusively for recipient to which it is addressed. The contents of this message and any attachments may contain confidential and privileged information. Any unauthorized review, use, print, storage, copy, disclosure or distribution is strictly prohibited. If you have received this message in error, please advise the sender immediately by replying to the message's sender and delete all copies of this message and its attachments without disclosing the contents to anyone, or using the contents for any purpose.

2 1

Issue with Regex and NORRDDISKS Setting
by matt1299＠gmail.com 02 Mar '16

02 Mar '16

Hello, Looking at past list e-mails, it is my understanding that the NORRDDISKS setting in xymonserver.cfg allows for PCRE regular expressions. Is this correct? Or does it only allow certain PCRE regular expressions, but not everything? I ask because I'm experiencing an issue with my NORRDDISKS setting. I'd like to ignore disks for graphing that have mount points "/tmp", but not ignore disks with mount points that have "tmp" in them, like "/tmpscratch". I noticed that for other disk mount point names that if you just use "^/<name>" with no modifiers, then it only ignores disk mount points with only exactly "^/<name>" and not "^/<name><additional text>" or "^/<name>/<more name>" (at least from what I can tell). For example when using: NORRDDISKS="^/dev|^/tmp|^/var" It ignores disks with mount points "/dev" and "/var", but also "/tmp" AND "/tmpscratch". But it doesn't look like it ignores "/var/tmp" (at least as far as I can tell). I tried using "^/tmp$" and that didn't work either (still ignored both names). Any idea what's going on here? Or how this can be done correctly? Is the "$" metacharacter not allowed in this setting? If it's needed, I'm running the latest 4.3.26-1 Terabithia RPM on RHEL 7. Thanks for any help!! -- Matt Vander Werf

2 5

Monitoring empty directory
by bert.willekens＠medialaan.be 02 Mar '16

02 Mar '16

Hi When I monitor a directory for file size I get " Could not determine size of directory" when it's empty. For me it's no problem that the directory is empty, I just want to TRACK the size of the directory. The directory is being cleaned automatically so I can't place a 1 KiB file there. How can I prevent the test from turning yellow? The configuration is as follows: ++ client-local.cfg [server.example.com] DIR:I:\watchfolder ++ analysis.cfg HOST=server.example.com DIR I:\watchfolder TRACK ++ client data [dir:I:\watchfolder] 0 I:\watchfolder ++ files test &yellow I:\watchfolder Could not determine size of directory I:\watchfolder Thanks -- Bert MEDIALAAN Disclaimer<http://medialaan.be/email>

2 1

Client startup on OS X
by rlhamil2＠gmail.com 01 Mar '16

01 Mar '16

Older tricks for this included StartupItems, which apparently no longer work as of Yosemite, let alone El Capitan. MacPorts has a really strange solution, but I'm not impressed at all with it. I see that xymonlaunch has a --no-daemon option, which would allow the sort of behavior that launchd expects. An old post mentions an approach using that: http://lists.xymon.com/oldarchive/2009/05/msg00244.html Seems to me that if runclient.sh handled an extra command line option to pass --no-daemon through to the xymonlaunch command line, it would simplify matters somewhat, not requiring people to check that their modified script was updated as needed; all that would be needed extra would be a com.xymon.client.plist file to put in /Library/LaunchDaemons; and that shouldn't vary from one update to the next. What I'm suggesting should probably work at least as far back as Snow Leopard (OS X 10.6) if not further. I haven't tried it yet, but I'm on my way to doing so.

3 4

Xymon 4.3.26 Released
by cleaver＠terabithia.org 01 Mar '16

01 Mar '16

Hello all, Xymon 4.3.26 has been released and is now available for download. This is primarily a bug fix release, resolving certain issues with web page display and browser compatibility introduced with the CSP and XSS fixes in 4.3.25, and providing additional layers of protection for incoming data: * Forms on 'info' pages for enabling and disabling hosts and services should now work reliably in more browsers * Redirects after enabling or disabling should work correctly again * Automatic page refreshes have been reverted from 30s to 60s and have been removed from 'info' and 'trends' pages * Page refreshes across more of the web frontend are now configurable with the XYMWEBREFRESH variable Additionally, unknown (ghost) hostnames and testnames now have tighter controls around allowed characters. (See the full Release Notes for details). DNS-safe hostnames are strongly recommended. 4.3.26 is available from the Xymon SourceForge page at https://sourceforge.net/projects/xymon/ Regards,

2 1