June 2017 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

Need help with upgrade from 4.3.17 to 4.3.20
by cleaver＠terabithia.org 17 Jul '18

17 Jul '18

Hmm. So far, the only way I've been able to reproduce this is by replacing the ScriptAlias directives with mere Alias's in the xymon.conf apache config. Has there been any change in the path you've used for the CGI directory since the previous version, or is there any chance that another Alias line is taking precedence over the ScriptAlias? Do you see anything in the apache access/error logs that indicates an error? -jc On Tue, May 19, 2015 10:37 am, Cortes, Manny wrote: > Having the same problem after installing 4.3.20 on both Ubuntu server > 14.04 and 15.04. > > Thanks, > > > Manuel A Cortes > > Systems Programmer III > > [IBM_Cert] > > IBM Certified System Administrator AIX 7 > > Information Services > > 321-841-6534 > > Orlandohealth.com > > Facebook.com/orlandohealth > > Youtube.com/orlandohealth > > @orlandohealth on twitter > > > > 1414 Kuhl Avenue.,MP136 > > Orlando, Florida 32806 > > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Asif Iqbal > Sent: Tuesday, May 19, 2015 12:59 PM > To: J.C. Cleaver > Cc: xymon at xymon.com > Subject: Re: [Xymon] Need help with upgrade from 4.3.17 to 4.3.20 > > > > On Tue, May 19, 2015 at 12:40 PM, J.C. Cleaver > <cleaver at terabithia.org<mailto:cleaver at terabithia.org>> wrote: > Hmm. It seems like it's trying to pass along the binary rather than > actually execute it. Can you > > a) validate the permissions on the various .sh files inside the > /xymon-cgi/ directory. (Wondering if there's a case where make install > doesn't set permissions properly), and > > > /var/lib/xymon/cgi-bin$ ls -al > total 6560 > drwxr-xr-x 2 root root 4096 May 19 10:19 . > drwxr-xr-x 16 xymon xymon 4096 May 19 10:19 .. > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 acknowledgements.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 appfeed-critical.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 appfeed.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 certreport.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 columndoc.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 confreport-critical.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 confreport.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 criticalview.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 csvinfo.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 datepage.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 eventlog.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 findhost.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 ghostlist.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 historylog.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 history.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 hostgraphs.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 hostlist.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 nongreen.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 notifications.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 perfdata.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 reportlog.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 report.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 showgraph.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 snapshot.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 svcstatus.sh > -rwxr-xr-x 32 xymon xymon 255968 May 19 10:19 topchanges.sh > > > b) verify that the ScriptAlias or ExecCGI options are still present in > apache.conf. > > > grep xymon-cgi /etc/apache2/sites-enabled/xymon-apache.conf > # "/xymon" and "/xymon-cgi" URLs. > ScriptAlias /xymon-cgi/ "/var/lib/xymon/cgi-bin/" > RewriteRule ^/xymon-cgi/bb-hist.sh /xymon-cgi/history.sh [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-eventlog.sh /xymon-cgi/eventlog.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-rep.sh /xymon-cgi/report.sh [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-replog.sh /xymon-cgi/reportlog.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-snapshot.sh /xymon-cgi/snapshot.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-findhost.sh /xymon-cgi/findhost.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-csvinfo.sh /xymon-cgi/csvinfo.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbitcolumn.sh /xymon-cgi/columndoc.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-datepage.sh /xymon-cgi/datepage.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbitgraph.sh /xymon-cgi/showgraph.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-hostsvc.sh /xymon-cgi/svcstatus.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/bb-histlog.sh /xymon-cgi/historylog.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-confreport.sh /xymon-cgi/confreport.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-confreport-critical.sh > /xymon-cgi/confreport-critical.sh [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-nkview.sh /xymon-cgi/criticalview.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-certreport.sh /xymon-cgi/certreport.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-nongreen.sh /xymon-cgi/nongreen.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-hostgraphs.sh /xymon-cgi/hostgraphs.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-ghosts.sh /xymon-cgi/ghostlist.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-notifylog.sh /xymon-cgi/notifications.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-hostlist.sh /xymon-cgi/hostlist.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-perfdata.sh /xymon-cgi/perfdata.sh > [R=permanent,L] > RewriteRule ^/xymon-cgi/hobbit-topchanges.sh /xymon-cgi/topchanges.sh > [R=permanent,L] > > > HTH, > > -jc > > > On Tue, May 19, 2015 7:56 am, Asif Iqbal wrote: >> I am not sure what I need to after the upgrade for the columns to show >> data >> instead of >> something like this >> >> >> ELF ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½>ï¿½ ï¿½ï¿½ï¿½ >> @ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ Ã >> ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½8ï¿½ ï¿½@ï¿½%ï¿½"ï¿½ ï¿½ï¿½ï¿½ >> ï¿½ï¿½ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½Ã¸ >> ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ã¸ ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½ >> ï¿½ï¿½ï¿½8 ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½8 >> @ï¿½ï¿½ï¿½ï¿½ï¿½8 @ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ >> ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ ï¿½ï¿½ï¿½ >> ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½@ï¿½ï¿½ï¿½ï¿½ï¿½Ã¤Ã¤ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ã¤Ã¤ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ >> >> I removed FollowSymLinks from xymon-apache.conf file under /xymon-cgi/ >> and /xymon-seccgi/ and restarted. >> >> I am using ubuntu >> >> -- >> Asif Iqbal >> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu<http://pgp.mit.edu> >> A: Because it messes up the order in which people normally read text. >> Q: Why is top-posting such a bad thing? >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com<mailto:Xymon at xymon.com> >> http://lists.xymon.com/mailman/listinfo/xymon >> > > > > > -- > Asif Iqbal > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu<http://pgp.mit.edu> > A: Because it messes up the order in which people normally read text. > Q: Why is top-posting such a bad thing? > > ________________________________ > > This e-mail message and any attached files are confidential and are > intended solely for the use of the addressee(s) named above. If you are > not the intended recipient, any review, use, or distribution of this > e-mail message and any attached files is strictly prohibited. > > This communication may contain material protected by Federal privacy > regulations, attorney-client work product, or other privileges. If you > have received this confidential communication in error, please notify the > sender immediately by reply e-mail message and permanently delete the > original message. To reply to our email administrator directly, send an > email to: postmaster at orlandohealth.com . > > If this e-mail message concerns a contract matter, be advised that no > employee or agent is authorized to conclude any binding agreement on > behalf of Orlando Health by e-mail without express written confirmation by > an officer of the corporation. Any views or opinions presented in this > e-mail are solely those of the author and do not necessarily represent > those of Orlando Health. >

8 25

Recovery notifications not generated when test goes red->yellow->green?
by hobbit＠elyograg.org 13 Dec '17

13 Dec '17

It appears that if a test goes from the red state, to the yellow state, and then to the green state, no recovery notification is sent. If it goes directly from red to green, then we get a notification. Initial notifications are only sent on RED and PURPLE. We have recovery notifications configured for most tests. Xymon server is 4.3.21, built using makerpm.sh and installed with yum on CentOS 6. I do not know whether our previous version (4.3.14) behaved similarly. It was almost an accident that I discovered the problem at all. Is this expected behavior? If it is, can I change it? Thanks, Shawn

4 3

Alert transition yellow -> red with repeat problem
by john.r.rothlisberger＠accenture.com 27 Nov '17

27 Nov '17

This problem contributed to an outage last night - something is wrong. Last night we had a disk that was in the warning state - warning email sent. That disk then went into an alert state and an alert email was triggered (right away as the DURATION value took into account the time it was yellow) and then again 15 minutes later as designed. THEN - another disk on that server went yellow. It did NOT trigger any emails (as expected we should continue to focus on the alerts) but it somehow interfered with the REPEAT time of the alerts and those STOPPED. There is a bug somewhere. Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ From: Rothlisberger, John R. Sent: Tuesday, April 11, 2017 7:49 AM To: 'xymon >> xymon at xymon.com' <xymon at xymon.com> Subject: Alert transition yellow -> red with repeat problem This is a problem I have seen for a long long time and have actually brought it up on the list before. Xymon 4.3.21 Ubuntu 14.04LTS The problem I have (in this instance) a warning which is to be repeated daily suddenly goes red and triggers a single alert but doesn't repeat again until the repeat time of the warning has passed. >From the notification.log: Tue Mar 28 05:31:28 2017 ServerA.disk (IP) disk_warn 1490697082 100 <- warning sets a repeat time of 1 day Tue Mar 28 05:53:32 2017 ServerA.disk (IP) disk_alert 1490698405 100 <- minutes later it goes red (red repeat time is 15 minutes but no further alerts are generated) Next alert comes out 1 day after the above warning: Wed Mar 29 05:31:31 2017 ServerA.disk (IP) disk_alert 1490783486 100 <- 1 day after previous warning. This should have been repeated every 15 minutes. Wed Mar 29 05:46:40 2017 ServerA.disk (IP) disk_alert 1490784394 100 <- now, the repeat time is 15 minutes ... <- and continues every 15 minutes. This alert went a full 24 hours with only a single notification. :( I have seen this before (not always) where the repeat time in a warning overrides a follow up alert until the warning repeat time has expired. Alert rules: SCRIPT /home/xymon/server/ext/pg/exwarn_SCRIPT disk_warn DURATION>30 REPEAT=1d COLOR=yellow SERVICE=disk FORMAT=TEXT UNMATCHED SCRIPT /home/xymon/server/ext/pg/exalert_SCRIPT disk_alert DURATION>20 REPEAT=15 COLOR=red SERVICE=disk FORMAT=TEXT UNMATCHED Ideas/thoughts? Thanks, John Upcoming PTO: 4/3 _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

3 5

CLASS not working as expected
by steve＠opendium.com 07 Nov '17

07 Nov '17

Under Xymon 4.3.25, I'm trying to use the class attribute to group hosts together by what monitoring and alerting they need. So for each host I have a hosts.cfg line like: 192.0.2.1 somehost.example.com # CLASS:Foo trace ssh Then in analysis.cfg I have: CLASS=Foo PROC this PROC that And alerts.cfg has: CLASS=Foo SCRIPT=blah However, the tests in analysis.cfg are not being applied. If I replace CLASS=Foo with HOST=somehost.example.com they work as expected. Also, CLASS=linux seems to work, which implies that the CLASS: directive in the hosts.cfg is being ignored. As far as I can tell, the messages on xymon's "client" channel don't contain the class name that was specified in hosts.cfg, so xymond_client is using the class that the client sent instead. Other channels, such as "status" do include the class name that was specified in hosts.cfg. Am I misunderstanding how the class is supposed to be used, or is this a bug? -- - Steve Hill Technical Director Opendium Limited http://www.opendium.com Direct contacts: Instant messager: xmpp:steve at opendium.com Email: steve at opendium.com Phone: sip:steve at opendium.com Sales / enquiries contacts: Email: sales at opendium.com Phone: +44-1792-824568 / sip:sales at opendium.com Support contacts: Email: support at opendium.com Phone: +44-1792-825748 / sip:support at opendium.com

6 7

Windows Powershell client v2.21
by zak.beck＠accenture.com 20 Oct '17

20 Oct '17

Hi v2.21 of XymonPSClient has been committed. This has a couple of new minor features and a minor fix, as follows: * Added reporting data to the server using UTF8 encoding. This is optional and the default remains to use ASCII. Use at your own risk - there's a possibility that not all server compiles will support receiving UTF8. (thanks Luboš Pavlíček) * Added the ability to include 'local' data in the core client message. This replicates functionality found in the Linux client - basically you can have external scripts write data to a file under the local folder (location specified by setting localdatalocation) and it will get written to a section in the client message like [local:<filename>]. You can then use a command like this to retrieve it: xymon 0 "clientlog <client host> section=local:<filename>" (thanks David Boyer for the inspiration!) * Fixed the Powershell provider appearing in file, log, dirsize and other tests - you would have only seen this if you were using UNC paths, it would have appeared like this: [file:Microsoft.PowerShell.Core\FileSystem::\\server\share\filename.txt], it should now appear like this: [file:\\server\share\filename.txt] I have also updated the documentation to include the new features. I have also updated nssm.exe in the repository. If you are running the client on Windows 10 Creator's Edition, you will need to use this new updated nssm.exe. Thanks Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

2 5

DNS failures causing "runtime longer than time limit"
by jlaidman＠rebel-it.com.au 11 Sep '17

11 Sep '17

Hi I'm running Xymon v4.3.10 on Linux, and I'm quite sure it's compiled with c-ares support. I have 12 new DNS servers that were added to Xymon about one month ago. All of my server entries in hosts.cfg have "testip". The tasks.cfg runs xymonet with "--dns-timeout=3". The hosts entries look like so: 10.10.10.1 dnshost1.example.com # testip dns=NS:example.com,SOA: example.com About a week ago, connectivity to all of these servers failed, and at the same time, the xymonnet run time jumped from less than 15 seconds to about 330 seconds, so about 315 seconds extra. The xymonnet page says 295 seconds is taken up by DNS tests. If the increase in time taken is about 315 and is entirely due to the 12 servers failing, then each failed server is adding about 26 seconds to the total run time. I don't think this should be happening like this. With two DNS checks per server, the DNS checks should be taking 6 seconds each to time-out, not 26. If I run xymonnet with "--timing --no-update" and specify only one hostname, I can view the results and the timing. This shows that the ping check gets reported after about 3 seconds, and then the DNS tests are executed and take 26 seconds total. My naiive assumption was that when a server failed a ping (and didn't have "noclear" defined in hosts.cfg) then the network checks would be skipped. On re-reading the man page for hosts.cfg, it dawned on me that a failed ping simply suppresses failed test /results/, but doesn't stop the tests from being run. So the real problem is that the "--dns-timeout=3" is not being taken into consideration by xymonnet. If I run xymonnet with "--debug" it tells me: 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=2 1900 2015-06-03 12:02:20 ares_search: tlookup='example.com', class=1, type=6 1900 2015-06-03 12:02:20 Processing 0 DNS lookups with ARES 1900 2015-06-03 12:02:46 Finished ARES queue after loop 423 This is peculiar. Why would it say "processing 0 DNS lookups" when there are two lookups to test? Could this be because xymonnet hasn't actually been built with ARES support and I didn't know it? Is there a good way to tell? If I add "--no-ares" I get the same results perhaps suggesting a lack of ARES support. On the other hand, if I add "timeout:3" and "attempts:1" into resolv.conf, I also get the same results. If I run "nm /path/to/xymonnet | grep gethostby" it returns "ares_gethostbyname". Just for fun, I compiled Xymon v4.3.21 and ran the xymonnet binary from there, with no change in behaviour. I also tried removing the "--dns-timeout" option so that it defaults to 30 seconds, but still no change - 26 seconds for two DNS tests. So, I'm not really sure what the problem is, but xymonnet certainly isn't behaving as I would expect. Cheers Jeremy

2 3

Powershell external scripts
by sgb＠pics.com 30 Jun '17

30 Jun '17

Hi, What format to external scripts <externalscriptlocation> need to be? Can they be windows bat files or do they need to be powershell .ps1 scripts or something else? Thanks Steve

1 0

False SSL cert alerts
by zforray＠vcu.edu 29 Jun '17

29 Jun '17

We are constantly having issues with sslcert alerts going non-green eventhough it says the cert is fine. Related to this is there being an issue getting to the https page from the Xymon server yet I can access it just fine from my browser. The latest one is an http only check - no Xymon client. The host file shows: 128.172.23.196 https:quikfm.vcu.edu # testip https://quikfm.vcu.edu Page is fully accessible. sslcert page says: Mon Jun 26 06:06:48 2017 [image: green] SSL certificate for https://quikfm.vcu.edu/ expires in 315 days Server certificate: subject:/C=US/postalCode=23284/ST=VA/L=Richmond/street=box 843059/street=701 W Broad Street/O=Virginia Commonwealth University/OU=Business Applications support/CN=quikfm.vcu.edu start date: 2015-05-08 00:00:00 GMT expire date:2018-05-07 23:59:59 GMT key size:2048 issuer:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA To make matters even more confusing, I flushed out all history and now the sslcert info isn't there and it still says there is an SSL error. How can I figure out why I get SSL ERROR ? Any help would be appreciated in figuring this out. Xymon server is at 4.3.19. -- *Zoltan Forray* Spectrum Protect (p.k.a. TSM) Software & Hardware Administrator Xymon Monitor Administrator VMware Administrator Virginia Commonwealth University UCC/Office of Technology Services www.ucc.vcu.edu zforray at vcu.edu - 804-828-4807 <(804)%20828-4807> Don't be a phishing victim - VCU and other reputable organizations will never use email to request that you reply with your password, social security number or confidential personal information. For more details visit http://infosecurity.vcu.edu/phishing.html

5 10

xymon-powershell.ps1
by sgb＠pics.com 29 Jun '17

29 Jun '17

Hi, Thanks. I reviewed that yesterday but I didn’t see an example that would be useful. I don’t know what <GROUPCOLOUR> represents. The documentation shows GROUPCOLOUR – red, yellow or green – the colour for the group But that doesn’t tell me what it represents either. I don’t know what group it refers to. Does it just mean the status of the test? I’m not using BBWin and have never used it. I was trying to use the xymon-powershell.ps1 script but it seems limited. I’m not a windows person. I’m a Linux guy and was hoping to see an example of this file that would be useful. I was hoping to see the criteria for quoting and different lines. I’ll need to create an example to submit to get permissions to install the Powershell Client and to write files on the server. Steve From: Beck, Zak [mailto:zak.beck at accenture.com] Sent: Thursday, June 29, 2017 7:50 AM To: Steve Brown <sgb at pics.com>; David Boyer <davieb at gmail.com> Cc: xymon at xymon.com Subject: RE: [Xymon] xymon-powershell.ps1 Hi There’s a section in the doc file for XymonPSClient headed “External data” which describes the file in detail. Here’s a copy / paste of the format from that section: <GROUPCOLOUR>[+LIFETIME] <MESSAGE> GROUPCOLOUR – red, yellow or green – the colour for the group +LIFETIME – optional – how long before Xymon should turn the status purple if no further results are received, specified in minutes (but supports 'h', 'd' or 'w' suffix e.g. 5h for 5 hours) MESSAGE - the message to be displayed. This message can span multiple lines and can include “&colour” e.g. &green / &yellow / &red to display a subtest with the corresponding coloured GIF. For example, the external script fsmon supplied with the BBWin source writes external files with the following contents: green 14/01/2016 14:37:07 [SERVER1] &green checking directory extdirtest 'c:\temp' - Rules are <50 and <100 - Actually 5 file(s) Here the group colour is green and the subtest colour is also green, no lifetime has been specified so the result will turn purple after the default interval if no more test results are sent. Note that you can also do this with BBWin if that’s what you’re using, and the message can include html as per your requirement. Thanks Zak From: Steve Brown [mailto:sgb at pics.com] Sent: 29 June 2017 13:22 To: David Boyer <davieb at gmail.com<mailto:davieb at gmail.com>>; Beck, Zak <zak.beck at accenture.com<mailto:zak.beck at accenture.com>> Cc: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [External] RE: [Xymon] xymon-powershell.ps1 Thanks I’ll see if I can get permission to install the PowerShell client and create files on the client machine. Can you send me an example of the file you place in c:\..\..\tmp ? From: David Boyer [mailto:davieb at gmail.com] Sent: Wednesday, June 28, 2017 10:24 PM To: Beck, Zak <zak.beck at accenture.com<mailto:zak.beck at accenture.com>> Cc: Steve Brown <sgb at pics.com<mailto:sgb at pics.com>>; xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] xymon-powershell.ps1 Hi, Like Zak said, just write your HTML page to a file then place it in the c:\..\..\tmp and it should be picked up within 5mins. The filename will reflect the test name on the xymon web page. I have a couple of sched tasks that work this way. Dave On Wed, Jun 28, 2017 at 5:06 AM, Beck, Zak <zak.beck at accenture.com<mailto:zak.beck at accenture.com>> wrote: Hi I’m not familiar with xymon-powershell.ps1, but I don’t see why not, the server certainly supports it (we do it all the time in the Powershell client). Bear in mind for powershell, the escape character for those double-quotes is backtick (`), as in: "<table width=`"100%`">" You may want to switch to the Windows Powershell client, it allows you to schedule and run external scripts or pick up data from external text files, so whatever is calling xymon-powershell.ps1 could just write a text file in the correct format to c:\program files\xymon\tmp and it would get sent… https://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/<https://urldefense.proofpoint.com/v2/url?u=https-3A__sourceforge.net_p_xymo…> Cheers Zak From: Xymon [mailto:xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>] On Behalf Of Steve Brown Sent: 27 June 2017 17:16 To: 'xymon at xymon.com<mailto:xymon at xymon.com>' <xymon at xymon.com<mailto:xymon at xymon.com>> Subject: [External] [Xymon] xymon-powershell.ps1 Hi Is there a way to send an html table through the xymon-powershell.ps1 script? I currently use bb-central where I have a Linux script that runs on the xymon server. I’m able to send the html table with the following OBJFILE="<iframe name=\"locktbl\" src=\"/hobbit/dba/${RHOST}/${MNAME}-lock.html\" frameborder=\"no\" height=\"600\" width=\"1200\"></iframe>" LINE="status $MACHINE.$TEST $COLOR ${OBJFILE} " $BB $BBDISP "$LINE" #SEND IT TO BBDISPLAY The status line is very similar to the xymon-powershell.ps1 input powershell -file xymon-powershell.ps1 %XYMSRV% "status %COMPUTERNAME%.mytest green %DATE% %TIME%" "The status of 'mytest' is 'satisfactory' at %DATE% %TIME%" "" "here's the last line" I basically want to replace the "The status of 'mytest' is 'satisfactory' at %DATE% %TIME%" with an html table. Thank you for your help Steve ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com<http://www.accenture.com> _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman…>

2 4