November 2017 - Xymon - Xymon mailman web

Graph patch
by stef.coene＠docum.org 15 Nov '17

15 Nov '17

Hi, I added option filter and filelist to showgraph.sh to enhance the graphing availabilities. The filter filters the rrd files and only graphs the matching files. With file filelist option, you can specify a list of rrd files. | is used between the files. Example, if you have file system /home and /home/users, you can add filter=,home to filter for filesystems containing /home at the end of the showgraph.sh url. Or you can add ,home|,home,users to only show /home and /home/users. I think this is a nice feature for Xymon. But I need some help.... The only issue I have is that for filter it works fine, but for filelist, the graphs are missing the filenames in the comments. Stef

1 0

Clean up logs
by manojbiswakarma＠yahoo.com 14 Nov '17

14 Nov '17

Hi Xymon Team, I have xymon running at my work place for quite a long time and was wondering ways I can cleanup the old logs. 1. Is there some tools or feature in xymon which I can use to remove old logs or do I use command such as find to remove them ? 2. And if suppose I remove the old files from under "histlogs and hostdata" manually using find command, will it impact my xymon afterward ? The area for cleanup which I am referring to is pasted below: 4.0K acks 4.0K data 4.0K disabled 991M hist 56 G histlogs 195 G hostdata 4.0K logs 2.0G rrd $ pwd /home/xymon/data $ ls -l drwxr-xr-x. 2 xymon xymon 2 Sep 24 2014 acks drwxr-xr-x. 2 xymon xymon 2 Sep 24 2014 data drwxr-xr-x. 2 xymon xymon 2 Sep 24 2014 disabled drwxr-xr-x. 2 xymon xymon 8954 Oct 11 22:18 hist drwxr-xr-x. 483 xymon xymon 483 May 31 13:15 histlogs drwxr-xr-x. 264 xymon xymon 264 Apr 20 2017 hostdata drwxr-xr-x. 2 xymon xymon 2 Sep 24 2014 logs drwxr-xr-x. 483 xymon xymon 483 May 31 13:15 rrd Thank you in advance. Regards Manoj Biswakarma (Manoj)

1 0

Custom plugin Interval/Crondate turning purple quickly
by rich＠corporationpop.co.uk 14 Nov '17

14 Nov '17

I have a custom plugin that is set to run every Tuesday at 10am on the server itself, that all runs fine and as expected, however it seems that shortly after the task has reported back to Xymon (20/30 mins) the task turns purple. I was expecting the status to stay green (or red etc) until the next run time. Any ideas why this is happening? Running Xymon 4.3.28 and the server side tasks.cfg looks like this: [sometask] ENVFILE /usr/local/xymon/server/etc/xymonserver.cfg CMD /usr/local/xymon/server/ext/sometask.sh LOGFILE $XYMONSERVERLOGS/sometask.log CRONDATE 0 10 * * 2 This did happen last week when I originally implemented the task, but I figured it was due to manually running xymoncmd... though that doesn't seem to be the case. Cheers

3 3

logfetch segfault using deltacount after a find command... and deltacount always returns 0 when no segfault
by spah＠syntec.co.uk 14 Nov '17

14 Nov '17

It seems that when using deltacount after a log statement with a 'find' in it like in the example below causes a seg fault in logfetch: log:`find /opt/tomcat/logs/myapp.$(date +%F).log`:10240 # deltacount after a find causes a seg fault. deltacount WarningDeltaCount "WARNING" It does not seem to matter if the find statement is actually in a different higher up log line that should not be affecting this deltacount. The workaround to that is to re-order the log statements such that your find is below the deltacount, but that still means they can not be used together, which means we can not use deltacount in the example above. This core backtrace does not look very helpful to me, but maybe because I am using a non-debug version of the 4.3.28 xymon-client RPM ( https://terabithia.org/rpms/xymon/el6/x86_64/xymon-client-4.3.28-1.el6.x86_… ): core_backtrace: :{ "signal": 11 :, "executable": "/usr/bin/logfetch" :, "stacktrace": : [ { "crash_thread": true : , "frames": : [ { "address": 4217378 : , "build_id": "40398b05a94e8227d573537651e7f595e5ef0d96" : , "build_id_offset": 23074 : , "file_name": "/usr/bin/logfetch" : } ] : } ] :} It was the same on 4.3.26-1 RPM. *Separately*, I believe that even when there is no segfault (because I hard code the filename), and the clientlog is all present and correct, that deltacount actually returns the wrong number of lines - it always seems to be 0 in my tests (with --debug, run from command line): 550 2017-11-14 13:12:38.042701 logfetch: -> logdata (/opt/tomcat/logs/myapp.2017-11-14.log) 550 2017-11-14 13:12:38.043112 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 0, loc 2558853 550 2017-11-14 13:12:38.043133 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 1, loc 2557130 550 2017-11-14 13:12:38.043149 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 2, loc 0 550 2017-11-14 13:12:38.043181 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 3, loc 0 550 2017-11-14 13:12:38.043199 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 4, loc 0 550 2017-11-14 13:12:38.043224 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 5, loc 0 550 2017-11-14 13:12:38.043240 - fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 6, loc 0 550 2017-11-14 13:12:38.043274 logfetch: Current size (ending): 2560538 bytes. Last end was 2558853. Looking 6 spots before that, which is 0. bytestocurrent: 2558853 550 2017-11-14 13:12:38.043322 - compiling DELTACOUNT regex: "WARNING" 550 2017-11-14 13:12:38.064073 - Last position was 2558853, found curpos location at 2558853 in current buffer. 550 2017-11-14 13:12:38.064121 - line forced as a trigger: <...CURRENT...> 14-Nov-2017 13:11:09.259 FINE [pool-1-thread-6923] [edited out] 550 2017-11-14 13:12:38.064135 - first trigger line encountered; preparing trigger START & END positioning store 550 2017-11-14 13:12:38.064146 - new trigger anchor START position set 550 2017-11-14 13:12:38.064164 - trigger END position set 550 2017-11-14 13:12:38.064194 Marked 1 pairs of START and END anchors for consideration. 550 2017-11-14 13:12:38.064206 Found 1674 bytes of trigger data, 8566 bytes available space for non-trigger data; last trigger ended 961 bytes from end. Max bytes allowed is 10240. 550 2017-11-14 13:12:38.064222 Staging replacement buffer, 10272 bytes. 550 2017-11-14 13:12:38.064233 Copying buffer content for trigger 1. 550 2017-11-14 13:12:38.064247 logfetch: More space was available than between last trigger and eof; reducing to 961 bytes 550 2017-11-14 13:12:38.064259 logfetch: Delta from end of final trigger to beginning of final section: 0 bytes 550 2017-11-14 13:12:38.064268 Copying 961 final bytes of non-trigger content 550 2017-11-14 13:12:38.064351 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 0, loc 2560538 550 2017-11-14 13:12:38.064362 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 1, loc 2558853 550 2017-11-14 13:12:38.064372 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 2, loc 2557130 550 2017-11-14 13:12:38.064382 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 3, loc 0 550 2017-11-14 13:12:38.064394 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 4, loc 0 550 2017-11-14 13:12:38.064403 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 5, loc 0 550 2017-11-14 13:12:38.064413 -- fn: /opt/tomcat/logs/myapp.2017-11-14.log, pos 6, loc 0 550 2017-11-14 13:12:38.064424 logfetch: <- logdata (/opt/tomcat/logs/myapp.2017-11-14.log) [msgs:/opt/tomcat/logs/myapp.2017-11-14.log] Can anyone help? Thanks, SebA

1 0

Windows PowerShell Client
by john＠executech.com 10 Nov '17

10 Nov '17

I have a team of 100 users that monitor 1 to 50 Windows servers in completely different environments and I don't like having to create a separate threshold for each server or group or tweaking them individually. It has become unmanageable. Plus, when the analysis.cfg was formatted incorrectly it caused issues. My goal is to let users manage their own servers in their own environment while still having a central dashboard for all servers. We aren't in a position to have a separate xymon server in every environment. Sent from my Android phone using TouchDown (www.symantec.com)

1 0

Windows PowerShell Client
by john＠executech.com 10 Nov '17

10 Nov '17

I think the goal is to configure thresholds from the client like we do with bbwin, not necessarily the alerts. If it's not currently an option, is anyone working on making it possible? -----Original Message----- From: Beck, Zak [zak.beck at accenture.com] Received: Friday, 10 Nov 2017, 2:30AM To: KC Kuhns [kc.kuhns at executech.com] xymon at xymon.com [xymon at xymon.com] Subject: Re: [Xymon] Windows PowerShell Client Hi You cannot manage alerts locally from the Powershell client, it is simply not supported. Sorry! Zak From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of KC Kuhns Sent: 09 November 2017 15:11 To: xymon at xymon.com Subject: [External] [Xymon] Windows PowerShell Client I’m trying to configure alerts to be managed locally on the Windows PowerShell clients instead of controlling them from the Xymon server. I want to have the clients manage their own thresholds in this situation. I have my xymonclient_config.xml set to use local settings and reference a localclient.cfg file that has all the values in it. Even with it setup this way, it isn’t reporting on the correct thresholds. I can have my CPU at 101 and still receive alerts when it hits 6%. Am I missing something since the localclient.cfg comes defined with Linux values? I.e. 6.5 9.5 instead of 65% 95%? I know it’s designed to managed all from Xymon but I’d like the option to manage locally on some machines. Xymonclient_config.xml <?xml version="1.0"?> -<XymonSettings> <servers>xymon.example.com</servers> <clientlogfile>c:\Xymon\xymonclient.log</clientlogfile> <clientconfigfile>c:\xymon\localclient.cfg</clientconfigfile> <clientname>Server.Name</clientname> <clientfqdn>0</clientfqdn> <clientlower>0</clientlower> <clientremotecfgexec>0</clientremotecfgexec> </XymonSettings> Localclient.cfg DEFAULT # These are the built-in defaults. UP 30 LOAD 95.0 100.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 Thanks for the help! This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com Sent from my Android phone using TouchDown (www.symantec.com)

2 1

Windows PowerShell Client
by kc.kuhns＠executech.com 10 Nov '17

10 Nov '17

I'm trying to configure alerts to be managed locally on the Windows PowerShell clients instead of controlling them from the Xymon server. I want to have the clients manage their own thresholds in this situation. I have my xymonclient_config.xml set to use local settings and reference a localclient.cfg file that has all the values in it. Even with it setup this way, it isn't reporting on the correct thresholds. I can have my CPU at 101 and still receive alerts when it hits 6%. Am I missing something since the localclient.cfg comes defined with Linux values? I.e. 6.5 9.5 instead of 65% 95%? I know it's designed to managed all from Xymon but I'd like the option to manage locally on some machines. Xymonclient_config.xml <?xml version="1.0"?> -<XymonSettings> <servers>xymon.example.com</servers> <clientlogfile>c:\Xymon\xymonclient.log</clientlogfile> <clientconfigfile>c:\xymon\localclient.cfg</clientconfigfile> <clientname>Server.Name</clientname> <clientfqdn>0</clientfqdn> <clientlower>0</clientlower> <clientremotecfgexec>0</clientremotecfgexec> </XymonSettings> Localclient.cfg DEFAULT # These are the built-in defaults. UP 30 LOAD 95.0 100.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 Thanks for the help!

2 1

xymonnet not working for basic authentication with # in password
by Max.Xu＠servicenow.com 09 Nov '17

09 Nov '17

I am have something like httpstatus;https://admin_name:passwdXY#Z at abc.com/abc;200 in hosts.cfg. Xymonnet fails to parse it. Log says: ------------------------------------------------------ URL : https://admin_name:443/#Z at abc.com/abc HTTP status : 0 Looking at code(version 4.3.24), ‘#' causes NULL auth, which will cause user name part be use as host name. Can this be confirmed? Thanks, -Max

3 4

Big RRD files causing problems
by jlaidman＠rebel-it.com.au 09 Nov '17

09 Nov '17

David RRD files are fixed in size - they never grow. The only grooming that would need to be repeated periodically, would be RRD filenames that are dynamic in nature. These are for things such as mounted filesystems, which can change over time (but usually don't), and for tracked logfile linecounts where the logfilenames are populated by backticks. These types of dynamic RRD files typically have commas in their names, such as "lines.,var,log,messages#error.rrd" or "disk,home.rrd". I can imagine a situation where an automounter magically mounts a USB stick to some random mountpoint dirname, and Xymon dutifully starts collecting data for it, but when the USB stick removed, the RRD file stays. Then the next USB stick that's inserted gets a new random mountpoint dirname, and hence a new RRD file. And so on. I would be looking for new RRD files that appear out of nowhere, or ones that have not been updated for a while, and try to find out where they come from. Cheers Jeremy On 12 September 2017 at 15:53, Mills,David (HHSC Contractor) < David.Mills at hhsc.state.tx.us> wrote: > Hi! > > > > Since upgrading to a new Xymon ( 4.3.28-1.el6.terabithia > <http://xymon.sourceforge.net/> / Linux from 4.3.3 on Solaris ) , my RRD > file storage consumption is **much** greater than on the old server. It’s > gotten so I have to manually groom the RRD files every 48 hours or they > overflow the file system. Here are some stats: > > > > NOTE: Same set of hosts with same tests on both the old server (4.3.3 / > Solaris) and the Terabithia distro for RHEL 6: > > > > Picking out the current biggest offender (the list varies but tracks > pretty much along the lines of the largest hosts with the most data to > send): > > > > NEW Server OLD Server > > Total space consumed for …/rrd 90GB 14GB > > # of files beneath …/rrd/pwow706/ 1,916 25,815 > > Avg file size (eyeballing it) 423K 38K > > > > Any ideas? > > > > Where can I read up on what RRD files Xymon puts into the RRD directory? > > Thx! > > > > ;-) > > > > David Mills > > ~~~~~~~~~~~~~~~~~~~~~~~~ > > System Administrator > > Northrop Grumman > > Texas Health and Human Services Commission > > > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > >

2 1

possible to test against "who"?
by john.r.rothlisberger＠accenture.com 09 Nov '17

09 Nov '17

Is anyone doing any tests against the "who" test? I would possibly like to alert if root (linux) or administrator (windows) is logged into a server. I have never seen this done before nor do I find anything in the docs for analysis.cfg. With today's heightened security awareness this may be something others would be interested in also. Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

4 3