October 2017 - Xymon - Xymon mailman web

Notification Issues
by Paul.Root＠CenturyLink.com 19 Oct '17

19 Oct '17

And notifications.log says that it is running /etc/xymon/custom/alert.sh User2 at domain.com? I'd look in /etc/xymon/custom/alert.sh then. From: John Tullis [mailto:john at executech.com] Sent: Wednesday, October 11, 2017 1:52 PM To: Root, Paul T; KC Kuhns; xymon at xymon.com Subject: RE: Notification Issues I've worked with KC on this issue for some time now and still have had no success. This is the result we're getting when we test with xymond_alert. $ xymond_alert --test DC.Comcast disk --duration=500 00007222 2017-10-11 11:46:08 Matching host:service:dgroup:page ''DC.Comcast:disk:NONE: User2/Client2' against rule line 1 00007222 2017-10-11 11:46:08 Failed 'PAGE=%.*User1/' (pagename not in include list) 00007222 2017-10-11 11:46:08 Matching host:service:dgroup:page 'DC.Comcast:disk:NONE:User2/Client2' against rule line 3 00007222 2017-10-11 11:46:08 *** Match with 'PAGE=%.*User2/' *** 00007222 2017-10-11 11:46:08 Matching host:service:dgroup:page 'DC.Comcast:disk:NONE: User2/Client2' against rule line 4 00007222 2017-10-11 11:46:08 *** Match with 'SCRIPT=/etc/xymon/custom/alert.sh user2 at domain.com<mailto:user2 at domain.com> COLOR=red,yellow RECOVERED REPEAT=720 DURATION>10' *** 00007222 2017-10-11 11:46:08 Script alert with command '/etc/xymon/custom/alert.sh' and recipient user2 at domain.com<mailto:user2 at domain.com> This is a sample of alerts.cfg: PAGE=%.*User1/ SCRIPT=/etc/xymon/alerts/alert.sh user1 at domain.com<mailto:user1 at domain.com> COLOR=red,yellow RECOVERED REPEAT=720 DURATION>10 PAGE=%.*User2/ SCRIPT=/etc/xymon/custom-alerts/alert.sh User2 at domain.com<mailto:User2 at domain.com> COLOR=red,yellow RECOVERED REPEAT=720 DURATION>10 User2 matches correctly but the email is still going to User1 even though we get a failed message for User1. We've tried deleting the User1 folder in the www folder. Restarting Xymon and the entire server and it doesn't ever really seem to go away. I can see that the emails were sent in the logs. I also added the matching line number to the alert email using $CFID and the matching line points to line 1 for User1. Any more help would be appreciated. Thanks, John. From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Root, Paul T Sent: Wednesday, October 11, 2017 10:22 AM To: KC Kuhns <kc.kuhns at executech.com<mailto:kc.kuhns at executech.com>>; xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] Notification Issues You can use xymond_alert to test the alert system to see where it is sending. xymond_alert --test DC.Comcast procs --duration=500 |grep -v Failed From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of KC Kuhns Sent: Wednesday, October 11, 2017 9:27 AM To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Notification Issues Good morning, We're using Xymon 4.3.25 and are running into a strange issue. We use Armor to monitor servers and various things at all of our clients. Our host file is setup something like this: Page User1 User One Subpage Client1 Client One 8.8.8.8 DC.Google # NOCONN Page User2 User Two Subpage Client2 Client Two 75.75.75.75 DC.Comcast # NOCONN Each technician that we have has a page, and each client has its own subpage under the related technician. We often move clients around to different technicians so in the above example, we may decide to move Client2 to User1. When we do that, it seems that User2 still receives email alerts for DC.Comcast even though it has been moved under User1. When looking at the info tab for DC2, it would show only User1 and nothing tied to User2. There's also nothing relating to that client in the alerts file. Is there some type of cache that we need to clear when we move clients around to different technicians to prevent this? Appreciate the help. This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 4

no client results arrive, lot of TIME_WAIT at server
by norbert.kriegenburg＠de.ibm.com 19 Oct '17

19 Oct '17

Yes, that's what i checked at first. But i assume that also the info from the servers own client data are captured by the same client channel listener, and that obviously works. Nothing in the clientdata.log, even if i activate the DEBUG mode with a kill -USR2 PID My clientdata section: # The client back-end module. You need this if you are running the Xymon client on any system. [clientdata] ENVFILE $XYMONSERVERHOME/etc/xymonserver.cfg NEEDS xymond CMD /home/xymon/server/bin/xymond_channel --channel=client \ --log=$XYMONSERVERLOGS/clientdata.log xymond_client \ --no-clear-files \ --no-clear-ports \ --no-port-listing \ --uptime-status INTERVAL 2m ps listing: $ ps -ef|grep "xymond_channel --channel=client"|grep -v grep xymon 18865 18705 0 05:13 ? 00:00:00 /home/xymon/server/bin/xymond_channel --channel=client --log=/home/xymon/server/logs/clientdata.log xymond_client --no-clear-files --no-clear-ports --no-port-listing --uptime-status I have a lot of TIME_WAITS from time to time, no idea why this goes up and down: $ netstat -atn|grep 1984 tcp 0 0 0.0.0.0:1984 0.0.0.0:* LISTEN tcp 0 0 10.137.56.43:37752 10.137.56.43:1984 TIME_WAIT tcp 0 0 10.137.56.43:37822 10.137.56.43:1984 TIME_WAIT ... 10.137.56.43 is the Xymon server IP. $ netstat -atn|grep 1984|wc -l 165 (sometimes much much more) (But goes down to 7 after some mins) From: Thomas Eckert <thomas.eckert at it-eckert.de> To: xymon <xymon at xymon.com> Date: 19/10/2017 11:14 Subject: Re: [Xymon] no client results arrive, lot of TIME_WAIT at server Sent by: "Xymon" <xymon-bounces at xymon.com> Norbert, I assume your manual (BB way) is something like `xymon 1.2.3.4 “status example.com.test …”`. The xymon-client send `clientdata` that is processed by a “channel listener” and _that_ sends status-messages similar to above (a bit simplified). That channel-listener may not be running/crashing: Check our `tasks.cfg` for the section `[clientdata]` and verify, if the `xymond_channel`-process is running (I suspect it’s not). Maybe the `clientdata.log` helps with debugging. You may also run the task manually to get further information. What’s your problem with the "lot of TIME_WAIT”? Are these just for tcp/1984-connections? Cheers Thomas On 19 Oct 2017, at 07:30, Norbert Kriegenburg < norbert.kriegenburg at de.ibm.com> wrote: experts, i have a new (not my first) Xymon installation (4.3.28 on RH 7.4, self compiled). All looks good, but the clients only show the network tests (conn, ssh). Only the Xymon server itself shows everything (disk, cpu,...). - all clients are RH 7.4, same install image used (i just copied over the client part with client config, create a cronjob for automatic start, so no root access nor extra install needed) - nothing suspicious in server or client logs (even in debug mode) - no ghosts - if i send a test manually (the old BB way) this shows at Xymon immediately (so the client settings are ok) - if i shutdown the xymond at server, the client logs complains: 2017-10-19 05:09:18.051994 Whoops ! Failed to send message (Connection failed) 2017-10-19 05:09:18.052104 -> Could not connect to Xymon daemon at 10.137.56.43:1984 (Connection refused) (so obviously they communicate) Querying the xymond shows: xymon 127.0.0.1 "query clientname.ssh" green  Thu Oct 19 05:21:29 2017 ssh ok is ok, but xymon 127.0.0.1 "query clientname.disk" shows nothing Any ideas? Norbert _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

2 1

no client results arrive, lot of TIME_WAIT at server
by norbert.kriegenburg＠de.ibm.com 19 Oct '17

19 Oct '17

experts, i have a new (not my first) Xymon installation (4.3.28 on RH 7.4, self compiled). All looks good, but the clients only show the network tests (conn, ssh). Only the Xymon server itself shows everything (disk, cpu,...). - all clients are RH 7.4, same install image used (i just copied over the client part with client config, create a cronjob for automatic start, so no root access nor extra install needed) - nothing suspicious in server or client logs (even in debug mode) - no ghosts - if i send a test manually (the old BB way) this shows at Xymon immediately (so the client settings are ok) - if i shutdown the xymond at server, the client logs complains: 2017-10-19 05:09:18.051994 Whoops ! Failed to send message (Connection failed) 2017-10-19 05:09:18.052104 -> Could not connect to Xymon daemon at 10.137.56.43:1984 (Connection refused) (so obviously they communicate) Querying the xymond shows: xymon 127.0.0.1 "query clientname.ssh" green  Thu Oct 19 05:21:29 2017 ssh ok is ok, but xymon 127.0.0.1 "query clientname.disk" shows nothing Any ideas? Norbert

2 1

how to monitor SharePoint Online with Xymon
by kspringer＠innovateteam.com 16 Oct '17

16 Oct '17

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20171016/521194a7/attach…>

1 0

xymon ntp check issue
by satish.txt＠gmail.com 16 Oct '17

16 Oct '17

Damn!! you got damn! right :) +1 On Mon, Oct 16, 2017 at 4:50 AM, Christian Hettler <christian.hettler at asknet.de> wrote: > Hello Satish, > > if you configure more than one xymon server on the client and > the first one isn't reachable, the second xymon server reports > such a clock offset. It is related to the timeout for the first > xymon server. > > regards, > > Christian > > On Sun, Oct 15, 2017 at 09:20:26PM -0400, Satish Patel wrote: >> We have two remove machine running on UTC timezone and our xymon >> server located in EST timezone, now i am seeing very strange issue, in >> those two remote server one of server has 47s time difference, even it >> has right time all other servers in remote location showing correct >> time in xymon except single machine which is showing 47s off i have >> checked everything and nothing wrong in server, even configuration of >> ntpclient is identical, not sure how to troubleshoot this issue, >> something is wrong with xymon server but not sure where? >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon

1 0

xymon ntp check issue
by satish.txt＠gmail.com 16 Oct '17

16 Oct '17

We have two remove machine running on UTC timezone and our xymon server located in EST timezone, now i am seeing very strange issue, in those two remote server one of server has 47s time difference, even it has right time all other servers in remote location showing correct time in xymon except single machine which is showing 47s off i have checked everything and nothing wrong in server, even configuration of ntpclient is identical, not sure how to troubleshoot this issue, something is wrong with xymon server but not sure where?

1 0

500 error for historylog.sh
by bferrell＠baywinds.org 14 Oct '17

14 Oct '17

I've got xymon 4.3.28 with apache 2.4.25 and I'm seeing a 500 error for historylog.sh with the sanitized log entry in the error_log AH02429: Response header name '3360 2017-10-13 19' contains invalid characters, aborting request, referer: http://my-site.site/xymon-cgi/history.sh?HISTFILE=my-site.site.procs&ENTRIE… Thoughts?

1 0

https URL in xymon recipient field causes 'Cannot resolve hostname' error
by spah＠syntec.co.uk 13 Oct '17

13 Oct '17

Hi to you all, It was suggested on this list recently that a way of getting Xymon client sending encrypted messages to the server using the currently Staple version would be to use *xymoncgimsg.cgi* on the web server over TLS. The xymon man page says one can use a URL in the recipient field for HTTP transport. There is no mention of HTTPS anyway in the man pages, but because it was suggested on the list I have tried it and it does not work: It seems to try and resolve https as hostname 'https' rather than interpreting it as a URL. For example: $ xymon https://www.google.com/xymon-cgi/xymoncgimsg.cgi "test" 2017-10-13 12:55:10.323994 Whoops ! Failed to send message (Cannot resolve hostname) 2017-10-13 12:55:10.324124 -> Cannot determine IP address of message recipient https $ xymon "https\://www.google.com/xymon-cgi/xymoncgimsg.cgi" "test" 2017-10-13 12:55:33.408007 Whoops ! Failed to send message (Cannot resolve hostname) 2017-10-13 12:55:33.408073 -> Cannot determine IP address of message recipient https\ I wonder if there is a trivial fix for this? P.S. Using plain old http does work: $ xymon http://www.google.com/xymon-cgi/xymoncgimsg.cgi "test" <!DOCTYPE html> <html lang=en> ... Many thanks, SebA

1 0

Notification Issues
by kc.kuhns＠executech.com 11 Oct '17

11 Oct '17

Good morning, We're using Xymon 4.3.25 and are running into a strange issue. We use Armor to monitor servers and various things at all of our clients. Our host file is setup something like this: Page User1 User One Subpage Client1 Client One 8.8.8.8 DC.Google # NOCONN Page User2 User Two Subpage Client2 Client Two 75.75.75.75 DC.Comcast # NOCONN Each technician that we have has a page, and each client has its own subpage under the related technician. We often move clients around to different technicians so in the above example, we may decide to move Client2 to User1. When we do that, it seems that User2 still receives email alerts for DC.Comcast even though it has been moved under User1. When looking at the info tab for DC2, it would show only User1 and nothing tied to User2. There's also nothing relating to that client in the alerts file. Is there some type of cache that we need to clear when we move clients around to different technicians to prevent this? Appreciate the help.

3 2

Regex escaping in 'cont=' test
by john.thurston＠alaska.gov 09 Oct '17

09 Oct '17

I'm fighting with the correct escaping and encoding for http content checks using the "cont=" tag: > cont[=COLUMN];URL;[expected_data_regexp|#digesttype:digest] > This tag is used to specify a http/https check, where it is also > checked that specific content is present in the server response. . . . > The regex is pre-processed for backslash "\" escape sequences. . . I can't find the expression to match the string: <a href="foo/bar"> (Which I hope your email client isn't going to try to render as html!) The closest I can manage is: a\x20href=\x22foo/bar\x22> Where \x20 is an ASCII space, and \x22 is a double-quote If I put a leading \x3D (which is an equal-sign), that renders in the search string and obviously doesn't match my supplied content. If, however, I put a leading \x3C (which is the less-than sign) the rest of the expression is eaten and is not rendered. I've tried leading the \x3C with \x5C (which is a backslash), with no effect. I also tried leading with \x5C\x78\x33\x43 (which is \x3C), which renders as such, but does not match my string. The upshot is, I can match enough of my string to be unique on my page. But it seems like something isn't right in the regex escaping and cleansing for this test. The supplied string should be accepted as a string, but the "<" seems to be interpreted during the parsing instead. Can anyone else find a way to use a "<" in the regex of the cont= test? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Department of Administration State of Alaska

2 4