March 2017 - Xymon - Xymon mailman web

Annyoing logic in alerts.cfg
by even.juberg＠ntnu.no 30 Mar '17

30 Mar '17

Hi! I've been using Xymon for years and have recently begun to play around with the alerts.cfg, however, there is something I have been banging my head against the wall with, for weeks now. So I am reaching out to this list in the hopes that someone out there might have the key to save me from eternal frustration. *snippet from my alerts.cfg* HOST=* RECOVERED=1 IGNORE HOST=* HOST=one-host SERVICE=http MAIL someuser at domain.local COLOR=red MAIL someuser at domain.local DURATION>5 COLOR=red What I'm trying to accomplish is to stop the "I'm OK - recovered" messages. Those messages are irrelevant, so I want those filtered out. The problem though, is that the logic is completely off on this point. The first rule for some reason takes presedense, even though I have explicitly told it to only use that rule IF the host has recovered, no? I want it to skip that rule, if it has not yet recovered, send mail to the first user immediately, then to the other user after 5 minutes, but leave those users alone if the service is OK again. Is there a way to accomplish this? Sincerely, Even

3 7

Could not load module xymond_rrd
by chaudharydeepak08＠gmail.com 29 Mar '17

29 Mar '17

Hello Everyone, I am seeing this erro on trying to start xymon - Could not load program xymond_rrd: Could not load module /usr/local/lib/libpcre.a(libpcre.so.1). Dependent module /opt/freeware/lib/libgcc_s.a(shr.o) could not be loaded. The module has an invalid magic number. Could not load module xymond_rrd. Dependent module /usr/local/lib/libpcre.a(libpcre.so.1) could not be loaded. Could not load module . I am very new to xymon, any pointers psl? Regards, Deepak

2 2

Applying Linux Memory Patch for rhel7 with kernel 3.10
by vsmoreland＠gmail.com 29 Mar '17

29 Mar '17

Hello All, I am trying to apply the following patch via the method below and I appear to be getting an error (patch: **** Only garbage was found in the patch input.). I have not applied patches before so please excuse my lack of experience. My server is currently running Xymon version 4.3.19. ******************************************************************************************** Generally, quick-fix patches such as this one are applied like this: cd xymon-4.3.4 patch -p0 </tmp/infocolumn-crash.diff make clean make sudo make install Since only the svcstatus.cgi binary is changed by the current patch, copying that file over to ~xymon/server/bin/ is fine instead of running "make install". Regards, Henrik ******************************************************************************************** I am trying to fix the memory display explained in the following article that also supplies the patch - http://lists.xymon.com/archive/2015-May/041671.html Please assist and explain the steps needed to apply patches and/or if a file can simply be edited/replaced for this specific task. Thanks, Michael

2 2

False positives on RAM and DISK F19
by john＠executech.com 29 Mar '17

29 Mar '17

I can't seem to find a solution for a problem I'm having: I'm running xymon-client on several Fedora 19 servers. The client version is 4.3.28 release 1.fc19. There isn't an option to upgrade the servers right now from F19. Memory report showing over 100%: server:memory red [758975] red Wed Mar 22 08:56:44 MDT 2017 - Memory CRITICAL Memory Used Total Percentage &red Physical 1236M 123M 1004% &red Actual 9293M 123M 7555% &green Swap 2266M 2867M 79% Disk showing 0 units free even though that isn't the case: server:disk red [208517] red Wed Mar 22 07:42:39 MDT 2017 - Filesystems NOT ok &red 11933080 4623272 73% / (0 units free) has reached the PANIC level (512 units) &red 636 6149980 1% /dev/shm (0 units free) has reached the PANIC level (512 units) &red 1016 6149600 1% /run (0 units free) has reached the PANIC level (512 units) &red 0 6150616 0% /sys/fs/cgroup (0 units free) has reached the PANIC level (512 units) &red 264948 5885668 5% /tmp (0 units free) has reached the PANIC level (512 units) &red 117488 62417 66% /boot (0 units free) has reached the PANIC level (512 units) Filesystem 1024-blocks Used A ail]ble Capacity Mounted on /dev/mapper/fedora_pvapp05-root 17411420 11933080 4623272 73% / tmpfs 6150616 636 6149980 1% /dev/shm tmpfs 6150616 1016 6149600 1% /run tmpfs 6150616 0 6150616 0% /sys/fs/cgroup tmpfs 6150616 264948 5885668 5% /tmp /dev/xvda1 194241 117488 62417 66% /boot Does anyone know if there is a patch for this or has anyone successfully run a newer version of the client on an older OS? Thanks, John

1 0

Alert transition yellow -> red with repeat problem
by john.r.rothlisberger＠accenture.com 29 Mar '17

29 Mar '17

This is a problem I have seen for a long long time and have actually brought it up on the list before. Xymon 4.3.21 Ubuntu 14.04LTS The problem I have (in this instance) a warning which is to be repeated daily suddenly goes red and triggers a single alert but doesn't repeat again until the repeat time of the warning has passed. >From the notification.log: Tue Mar 28 05:31:28 2017 ServerA.disk (IP) disk_warn 1490697082 100 <- warning sets a repeat time of 1 day Tue Mar 28 05:53:32 2017 ServerA.disk (IP) disk_alert 1490698405 100 <- minutes later it goes red (red repeat time is 15 minutes but no further alerts are generated) Next alert comes out 1 day after the above warning: Wed Mar 29 05:31:31 2017 ServerA.disk (IP) disk_alert 1490783486 100 <- 1 day after previous warning. This should have been repeated every 15 minutes. Wed Mar 29 05:46:40 2017 ServerA.disk (IP) disk_alert 1490784394 100 <- now, the repeat time is 15 minutes ... <- and continues every 15 minutes. This alert went a full 24 hours with only a single notification. :( I have seen this before (not always) where the repeat time in a warning overrides a follow up alert until the warning repeat time has expired. Alert rules: SCRIPT /home/xymon/server/ext/pg/exwarn_SCRIPT disk_warn DURATION>30 REPEAT=1d COLOR=yellow SERVICE=disk FORMAT=TEXT UNMATCHED SCRIPT /home/xymon/server/ext/pg/exalert_SCRIPT disk_alert DURATION>20 REPEAT=15 COLOR=red SERVICE=disk FORMAT=TEXT UNMATCHED Ideas/thoughts? Thanks, John Upcoming PTO: 4/3 _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

1 0

multiple xymonnet question -- duplicate hosts.cfg?
by Scot.Kreienkamp＠la-z-boy.com 28 Mar '17

28 Mar '17

Hi everyone, I am setting up a remote xymonproxy/xymonnet system that will report back to my central server. My question is, do I have to duplicate the hosts.cfg on the xymonproxy host for the systems I want it to network test or is there a way to tell xymonnet to get that list from the xymond server on my master display server? Thanks! Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * Scot.Kreienkamp at la-z-boy.com<mailto:%7BE-mail%7D> www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> | facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<https://twitter.com/lazboy> | youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy> [cid:lzbVertical_hres.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 3

Installing Xymon from terabithia; two weird issues
by peter.welter＠gmail.com 27 Mar '17

27 Mar '17

Hi JC, I'm still experiencing some difficulties with Xymon version (4.3.27-1.el6.terabithia) software, that is being deployed from http://terabithia.org/rpms/xymon/el6/i686/. There are two different types of problems: 1) Has to do with the integration of Xymon/Devmon. Although Devmon gets valid SNMP-data, for each poll, the values in the if_load.Ethernet3_1.rrd-file (for example) are showing gaps. The next value is so much larger than the rest, so the total graph is going beserk because of the spikes that are being shown. ...[snip]  <row><v>5.7197560484e+01</v><v>5.7540255376e+01</v></row>  <row><v>5.8052253788e+01</v><v>5.7062462121e+01</v></row>  <row><v>5.8039204545e+01</v><v>5.7738579545e+01</v></row>  <row><v>5.8352395833e+01</v><v>5.7912187500e+01</v></row>  <row><v>5.7961458333e+01</v><v>5.8807500000e+01</v></row>  <row><v>5.7040675403e+01</v><v>5.7108262769e+01</v></row>  <row><v>5.7984999119e+01</v><v>5.8214662436e+01</v></row>  <row><v>1.6832224569e+16</v><v>1.6832224569e+16</v></row>  <row><v>4.4656922344e+16</v><v>4.4656922343e+16</v></row>  <row><v>5.7648150173e+01</v><v>5.7687031165e+01</v></row>  <row><v>5.9068884188e+01</v><v>5.9453689406e+01</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>1.9398478192e+07</v><v>1.8707899982e+07</v></row>  <row><v>5.6938284153e+01</v><v>5.6770437158e+01</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>NaN</v><v>NaN</v></row>  <row><v>3.5775056887e+07</v><v>3.4501518955e+07</v></row>  <row><v>5.7219344262e+01</v><v>5.7417704918e+01</v></row>  <row><v>5.7166338798e+01</v><v>5.9383825137e+01</v></row>  <row><v>5.6769617486e+01</v><v>5.6981202186e+01</v></row>  <row><v>5.7549617486e+01</v><v>5.7382732240e+01</v></row> ...[snip] This behaviour does NOT occur on my current Xymon server (version 4.2.3) running on SLES11 SP4. First I thought that this has to do with vmware, but that is not the case. VM or bare metal; the behaviour is the same. I made sure to see that even the devmon module is not causing the problems. The same devmon software works fine on SLES and RHEL. The snmpwalk-command does get valid SNMP-data, when writing to a files. It just seems that Xymon does not update the rrd-file correctly!?!? Any suggestions how to proceed? 2) Is a memory leak that only occurs when the NetApp-plugin ( https://sourceforge.net/projects/hobbit-perl-cl/) is being used for trending data. Unfortunately, this not maintained anymore. In the past I have been trying to troubleshoot this problem with you using valgrind etc. What do you suggest? Should I upgrade to the newest version first? Kind regards, Peter

3 4

Extra lines for non-existent data
by jlaidman＠rebel-it.com.au 27 Mar '17

27 Mar '17

Thanks Wim I updated GRAPHS and appended "::1" to my test name as you suggested. But the trends page still tries to show multiple graphs instead of one. It's weird how the exact same graph definition attempts to display one too many graphs for one server, and two too many graphs for another. It's a mystery how svcstatus.cgi determines how many graphs to show. I don't know how I could use the "linecount" hack for the trends page. I should have mentioned that this is where the problem is. This seems to be a problem that goes back a long time, and hasn't been implemented in the best way, as suggested by comments in generate_html_log(): * What we *really* should do was to scan the RRD directory and count how many * RRD database files are present matching this service - but that is way too * much overhead for something that might be called on every status logged. This makes sense. However, I wonder if the filesystem lookups required for this would be cached by a modern filesystem, minimising the performance impact and I/O penalty. Nevertheless, in absence of reliable heuristics for guessing the number of graphs required, it would be really valuable to be able to override the guess in cases where the operator knows the correct answer. If I had sufficient coding chops, I'd have a crack at adding a feature like this. Perhaps another modifier like "::=n" to set the number to "n". J On 24 March 2017 at 21:24, Nelis, Wim <Wim.Nelis at nlr.nl> wrote: > Hello Jeremy, > > > > perhaps you can use the “<!—linecount=N -->” line in the status message to > xymon, which states that there are N graphs to be shown. This can be handy > if multiple RRD’s are to be combined in a single graph. > > (I’ve patched Devmon to include this linecount-directive in front of the > RRD table. This improves the output of Xymon, but does not solve all > probems.) > > > > And again perhaps, the optional parameter in the definition of a test in > environmental variable GRAPHS might help. Definition “test::M” specifies > that at most M RRD’s may be combined into a single graph. What happens if > you set M to one? > > > > Regards, > > Wim Nelis. > > > > *From:* Xymon [mailto:xymon-bounces at xymon.com] *On Behalf Of *Jeremy > Laidman > *Sent:* 23 March 2017 15:46 > *To:* xymon at xymon.com > *Subject:* [Xymon] Extra lines for non-existent data > > > > Hi > > > > I'm sure this has been discussed previously, but I don't know if there was > a fix or a work-around. > > > > I have a few graphs that Xymon wants to show over multiple graphs. In the > example below, this is happening for two different graph definitions.The > second of each graph has no data, and so the graphs are broken. > > > > [image: Inline images 1] > > > > In the first of the two graphs (in each case) the URL for the graph image > contains "first=1&count=5". The second, broken, graph image URL contains > "first=6&count=5". Each of these graph definitions, in graphs.cfg, uses one > RRD file per DEF, where each RRD file has only one data series (named > "lambda"). > > > > I seem to recall that when xymongen is constructing the URLs for the > images, it has to make a guess about how many to include, based on how many > lines it things there might be, and that guess is not always accurate. Is > there a way to provide hints to xymongen about the number of lines in a > graph? I also seem to recall that Devmon managed to work around this > problem, but I don't know how, or if the same technique can be applied > outside of Devmon. > > > > J > > > > ------------------------------ > > > > ------------------------------ > *The NLR disclaimer is valid for NLR e-mail messages.* > > This message is only meant for providing information. Nothing in this > e-mail message amounts to a contractual or legal commitment on the part of > the sender. > > This message may contain information that is not intended for you. If you > are not the addressee or if this message was sent to you by mistake, you > are requested to inform the sender and delete the message. Sender accepts > no liability for damage of any kind resulting from the risks inherent in > the electronic transmission of messages. > ------------------------------ > >

1 2

bug with xymonnet / dns resolver
by Phil.Crooker＠orix.com.au 27 Mar '17

27 Mar '17

This is rather lame, but none the less a bug. If I use a hostname in hosts.cfg that is a CNAME record that doesn't point to a A record, xymonnet crashes. The strace of the event: recvfrom(4, "9g\205\200\0\1\0\1\0\0\0\0\vlame_name\4orix\3co"..., 4097, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("1.1.1.1")}, [16]) = 74 --- SIGSEGV (Segmentation fault) @ 0 (0) --- rt_sigaction(SIGSEGV, {SIG_DFL, [SEGV], SA_RESTORER|SA_RESTART, 0x7fae2a535910}, {0x4279f0, [], SA_RESTORER, 0x7fae2a535910}, 8) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fae2b6dd9d0) = 26817 chdir("/usr/local/xymon/server/tmp") = 0 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(26449, 26449, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT (core dumped) +++ Of course if there is no DNS entry at all, it complains and just uses the IP address included in the hosts.cfg file, but for a 'dangling' CNAME it crashes. This happens in both 4.3.27 and 4.3.28. thanks, Phil

1 0

Clientlog in UTF8
by lubos.pavlicek＠gmail.com 24 Mar '17

24 Mar '17

Hi, We use powershell client on computers with localized windows (Czech language). EventLog messages are in Czech with non ASCII characters. I modified the winpsclient to send clientlog in UTF8. Messages are displayed on xymon web correctly, I was able filter messages, e.g. LOG eventlog_System "%Zpracování zásad skupiny selhalo" COLOR=red Exists some pitfalls, why not send clientlog in UTF8, but convert into US- ASCII? Luboš Pavlíček

3 5