January 2017 - Xymon - Xymon mailman web

xymon disk not alerting at 100%, need another set of eyes
by Scot.Kreienkamp＠la-z-boy.com 05 Jan '17

05 Jan '17

After re-reading I can see how that may not be totally clear. By alerting, I mean that the disk test is still green, even though a partition is at 100%full. I found two hosts that weren't alerting on disk full condition and started digging into the problem further. As I understand it, xymon matches the first entry from analysis config files. So I dumped the analysis config for disks: Client line: [collector:] client corpvskreienl,na,lzb,hq.linux linux [root at monvxymon hosts.d]# /usr/libexec/xymon/xymond_client --dump-config --config=etc/analysis.cfg |grep -i ^disk DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%(mondbexec.*|mondb.*|retmaildb.*).na.lzb.hq (line: 515) DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=%(mondbexec.*|mondb.*|retmaildb.*).na.lzb.hq (line: 516) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%(mon|new|red|neo|taz|sil|kin|sal|hpt)exch.*.na.lzb.hq (line: 527) DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=%(mon|new|red|neo|taz|sil|kin|sal|hpt)exch.*.na.lzb.hq (line: 528) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%dayexch.*.na.lzb.hq (line: 539) DISK %^T IGNORE HOST=%dayexch.*.na.lzb.hq (line: 540) DISK %^(1|2|3|4|5|6|7|8|9|0|).* IGNORE HOST=%dayexch.*.na.lzb.hq (line: 541) DISK C 204800U 102400U 0 -1 red HOST=mdas4000.mdmza.dmz.hq (line: 567) DISK E 101% 101% 0 -1 red HOST=mdas4000.mdmza.dmz.hq (line: 568) DISK F 99% 100% 0 -1 red HOST=mons6000.na.lzb.hq (line: 576) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red PAGE=infrastructure/fileserv (line: 582) DISK D 99% 100% 0 -1 red HOST=lzbv5223.na.lzb.hq,lzbv6016.na.lzb.hq (line: 746) DISK * 90% 95% 0 -1 red HOST=%dvrvas(0|1)\.mdmza.dmz.hq (line: 762) DISK * 90% 95% 0 -1 red CLASS=powershell (line: 1054) DISK * 90% 95% 0 -1 red CLASS=win32 (line: 1073) DISK * 90% 95% 0 -1 red CLASS=linux (line: 1090) DISK * 90% 95% 0 -1 red (line: 1132) I can't find any lines above where the hostname matches, it's on page Infrastructure/Miscellaneous so none of the page statements match, so it should match on the class. Or the very last line is the system default which should apply if nothing else. My server is sitting at 100%full on one partition so it SHOULD be alerting. Thanks for any help. Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: Scot.Kreienkamp at la-z-boy.com This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

1 0

xymon disk not alerting at 100%, need another set of eyes
by Scot.Kreienkamp＠la-z-boy.com 05 Jan '17

05 Jan '17

Hi everyone I found two hosts that weren't alerting on disk full condition and started digging into the problem further. As I understand it, xymon matches the first entry from analysis config files. So I dumped the analysis config for disks: Client line: [collector:] client corpvskreienl,na,lzb,hq.linux linux [root at monvxymon hosts.d]# /usr/libexec/xymon/xymond_client --dump-config --config=etc/analysis.cfg |grep -i ^disk DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%(mondbexec.*|mondb.*|retmaildb.*).na.lzb.hq (line: 515) DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=%(mondbexec.*|mondb.*|retmaildb.*).na.lzb.hq (line: 516) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%(mon|new|red|neo|taz|sil|kin|sal|hpt)exch.*.na.lzb.hq (line: 527) DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=%(mon|new|red|neo|taz|sil|kin|sal|hpt)exch.*.na.lzb.hq (line: 528) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red HOST=%dayexch.*.na.lzb.hq (line: 539) DISK %^T IGNORE HOST=%dayexch.*.na.lzb.hq (line: 540) DISK %^(1|2|3|4|5|6|7|8|9|0|).* IGNORE HOST=%dayexch.*.na.lzb.hq (line: 541) DISK C 204800U 102400U 0 -1 red HOST=mdas4000.mdmza.dmz.hq (line: 567) DISK E 101% 101% 0 -1 red HOST=mdas4000.mdmza.dmz.hq (line: 568) DISK F 99% 100% 0 -1 red HOST=mons6000.na.lzb.hq (line: 576) DISK %^(D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z) 15728640U 10485760U 0 -1 red PAGE=infrastructure/fileserv (line: 582) DISK D 99% 100% 0 -1 red HOST=lzbv5223.na.lzb.hq,lzbv6016.na.lzb.hq (line: 746) DISK * 90% 95% 0 -1 red HOST=%dvrvas(0|1)\.mdmza.dmz.hq (line: 762) DISK * 90% 95% 0 -1 red CLASS=powershell (line: 1054) DISK * 90% 95% 0 -1 red CLASS=win32 (line: 1073) DISK * 90% 95% 0 -1 red CLASS=linux (line: 1090) DISK * 90% 95% 0 -1 red (line: 1132) I can't find any lines above where the hostname matches, it's on page Infrastructure/Miscellaneous so none of the page statements match, so it should match on the class. Or the very last line is the system default which should apply if nothing else. My server is sitting at 100%full on one partition so it SHOULD be alerting. Thanks for any help. Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * Scot.Kreienkamp at la-z-boy.com<mailto:%7BE-mail%7D> www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> | facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<https://twitter.com/lazboy> | youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy> [cid:lzbVertical_hres.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

1 0

4.3.28 RC1 Released
by cleaver＠terabithia.org 04 Jan '17

04 Jan '17

Hello all! 4.3.28 RC1 has been released and should now be available on the SourceForge mirrors. You can download it at https://sourceforge.net/projects/xymon/files/Xymon/4.3.28-rc1/ Notable bug fixes are involve 'summary' message parsing and some performance and logic problems within xymond_alert that could cause increased load. Additionally, version-specific TLS testing is now available for HTTPS checks. The bundled version of c-ares has been increased to 1.12.0, however it is still recommended that system libraries be used when available (for ease of maintenance). If there were any fixes that I accidentally missed -- or if you notice any issues with this RC -- please reply back. (I will be building additional RPMS for testing later on tonight.) If there are no major outstanding issues, a release version will follow this weekend or (likely) right after the 1st of the month. Regards, -jc

2 2

Disk not being reported
by Scot.Kreienkamp＠la-z-boy.com 04 Jan '17

04 Jan '17

Hi everyone, I am having a problem with some of my disk reporting. Postgres requires 700 permissions on its data directory, which in my case is also a mount. That causes non-root users (xymon) to get a permission denied error when running checks like inode and df. I can't change the permissions on the directory or postgres won't start so the only other options I can come up with are to make xymon run as root (not a good idea), or have it use sudo to run its disk tests somehow. Anyone run into this before? Any words of wisdom on if it's possible to use sudo to run the df/inode tests in xymon? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * Scot.Kreienkamp at la-z-boy.com<mailto:%7BE-mail%7D> www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> | facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<https://twitter.com/lazboy> | youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy> [cid:lzbVertical_hres.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

3 3

Request change for init.d/xymon-client
by gregory＠bulot-fr.com 04 Jan '17

04 Jan '17

Hi, Because i'm using xymon also in the master host in lxc (with debian), so "ps" show all xymonlaunch used inside containers. start-stop-daemon answer "already running" Is it possible to change /etc/init.d/xymon-client, like that : > 22a23 >> DAEMONNAME=xymonhyperv > 51c52 > < start-stop-daemon --exec $DAEMON --chuid xymon --umask 022 > --start \ --- >> start-stop-daemon --name $DAEMONNAME --exec $DAEMON --chuid >> xymon --umask 022 --start --pidfile=$PIDFILE \ and the man say " Veuillez noter qu'à moins d'utiliser --pid ou --pidfile, le programme start-stop-daemon se comporte comme killall(1). start-stop-daemon recherche dans le tableau des processus tout pro‐ cessus qui correspond au nom, pid parent, uid et/ou gid du processus (si indiqué). Toute correspondance empêchera --start de démarrer le démon. Tous les processus qui correspondent recevront le signal TERM (ou le signal indiqué par --signal ou --retry) "

3 2

Tracking foreign ssh connections with PORT
by Alessandro.Tinivelli＠faacgroup.com 03 Jan '17

03 Jan '17

Hi all, I was trying to setup an alert when a server has established SSH connections with a "foreign" remote IP (i.e. not beginning with 192.168). It seem to be working so I'm posting, it maybe it's useful for someone. Any comment or correction will be appreciated. P.S.: change host name and the regex accordingly with your ip addressing HOST=host01 PORT "LOCAL=%([.:]22)$" "REMOTE=%^(?!(192\.168)).+" state=ESTABLISHED MAX=0 COLOR=red TRACK=SSH_fconn "TEXT=SSH foreign connections" P.P.S.: very useful site for composing regexp https://regex101.com/ :)

2 1