January 2018 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

Problems with Content Security Policy in Safari, Chrome, and IE
by jtrott＠dancrai.com 17 Jul '18

17 Jul '18

Xymon 4.3.28-1.el7.terabithia with Safari 11 on High Sierra and Safari on iOS 11. Problem occurs on the trends page. https://xymon.domain.com.au/xymon-cgi/svcstatus.sh?HOST=host.com.au&SERVICE… If you click on any of the time based buttons, 48hrs for example, the requested page doesn't load. Safari on macOS look like it's loading a page but doesn't get anywhere. Safari on iOS does nothing at all when you tap the button. The console in Safari reveals the following error: Refused to load https://xymon.domain.com.au/xymon-cgi/svcstatus.sh?HOST=host.com.au&SERVICE… because it does not appear in the form-action directive of the Content Security Policy. Checking the headers shows this content security policy: Content-Security-Policy: script-src 'self' 'unsafe-inline'; connect-src 'self'; form-action 'self'; sandbox allow-forms allow-scripts; I'm not that well versed in the CSP stuff, but I note that it also fails with the same error in the latest Chrome 62.0.3202.89, and in Internet Explorer 11.0.9600.18817 (no error logged), but works in the latest Firefox 56.0.2. Has anyone else run into this issue, or has any more information on how I can modify the CSP headers to test? I tried using Header set Content-Security-Policy in apache but that seems to add an improperly formatted addition to the rules rather than overwriting them. Thanks, JT

7 11

Need help with upgrade from 4.3.17 to 4.3.20
by vadud3＠gmail.com 17 Jul '18

17 Jul '18

I am not sure what I need to after the upgrade for the columns to show data instead of something like this ELF �� >� �� @��@�� Þ ��@�8� �@�%�"� �� @��@�@��@�@��ø ��ø �� 8 ��8 @��8 @�� @��@��ää��ää�� I removed FollowSymLinks from xymon-apache.conf file under /xymon-cgi/ and /xymon-seccgi/ and restarted. I am using ubuntu -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

9 29

State of the art for monitoring ESXi hosts?
by john.thurston＠alaska.gov 01 Feb '18

01 Feb '18

Can anyone offer a 'state of the art' statement regarding Xymon and VMWare ESXi hosts (versions 6.0 and 6.5)? Looking in the archives, I see a little content from several years ago. It's now 2018. What are y'all monitoring, and how are ya' doing it? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Department of Administration State of Alaska

6 5

State of the art for monitoring ESXi hosts?
by xymon＠asitshouldbe.com 31 Jan '18

31 Jan '18

I use a custom Perl script that connects to all of my ESXi servers (about 21 of them) and generates a single page that lists each host server, its version, RAM usage, disk space usage per datastore, host uptime, which virtual machines are on them, and the power state of each VM. It flags VMs that are powered off and hosts that have been up for more than 365 days. I'm not sending alerts for these at this time, but the page that is generated points these things out. Actually, the 21 hosts are broken up into three different pages depending on the location of the host. That gives me a pretty quick way to find out which host a particular VM is running on. It uses ssh to connect to each host and run a series of commands on the hosts. Then it processes the results. I'm using it on ESXi 5.0, 5.5, and 6.5. Running all these commands on the hosts is time consuming, so I don't know how scalable this is. Strict environments may have security concerns about having ssh enabled, but it works for me. The attachment is a screen capture of the output. Ron John Thurston <john.thurston at alaska.gov> wrote .. > Can anyone offer a 'state of the art' statement regarding Xymon and > VMWare ESXi hosts (versions 6.0 and 6.5)? Looking in the archives, I see > a little content from several years ago. > > It's now 2018. What are y'all monitoring, and how are ya' doing it? > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Department of Administration > State of Alaska > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

1 0

[xymon] too much data in powershell client reports
by MARIO.DECHENNO＠unicampania.it 29 Jan '18

29 Jan '18

Hi all. Even after setting pretty high values for MAXMSG_CLIENT (2560) MAXMSG_STATUS (2048) i got purples from our exchange servers, mainly caused by port test being truncated after about 37000 lines. I noticed the new slimmode options in 2.27 version, but it (AFAIK) could only cut the whole port test, preventing any network port count analysis. Since most of the connections are between the (two) exchange servers, and are reported twice in IPV4 and IPV6 notation, could there be a way to filter the "internal" connections on the client side without sending them to xymon server? I attach an example. Mario

2 3

separate "uptime" status patch
by dominique.frise＠unil.ch 16 Jan '18

16 Jan '18

Hi, We recently enabled the separate "uptime" status column like described here : http://www.it-eckert.com/blog/2015/separate-uptime-status-for-all-xymon-cli… While testing we saw two issues with the uptime displayed status together with the "toolong" limit setting. Assuming this in analysis.cfg : UP 1h 9d First issue When uptime has passed 9 days,the status turns to yellow but the text only shows "System has been up: 9 days." it should display "&yellow Machine has been up more than 9 days" AND "System has been up : 9 days." [cid:b68bacd2-781b-4280-aea3-b0d8c410b9c0] Second Issue The displayed uptime string in "System has bee up: ..." should show the hh:mm in addition to days. Example: "System has been up: 9 days 01:27" The attached patch for xymon-4.3.28 fixes both issues. Hope ths helps, Dominique Frise

1 0

sslcert
by ve2cii＠canasoft.net 09 Jan '18

09 Jan '18

Hi, This is for the sslcert service: I have xymon monitoring a web site where the certificate has been changed twice over the past 2 years. And it is currently up to date. What xymon is showing for the dates of the certificate are wrong. Is there a way to fix this so it shows the correct certificate and not an old one? start date: 2014-12-02 19:29:50 GMT expire date:2015-04-01 19:29:50 GMT Tue Jan 9 10:58:46 2018 red SSL certificate for https://www.thesweetbasket.com/en/ expired 1013 days ago Server certificate: subject:/C=CA/ST=Que/L=Montreal/O=Cronomagic/OU=Web/CN=serv1.thesweetbasket… at canasoft.net start date: 2014-12-02 19:29:50 GMT expire date:2015-04-01 19:29:50 GMT key size:1024 issuer:/C=CA/ST=Que/L=Montreal/O=Cronomagic/OU=Web/CN=serv1.thesweetbasket.… at canasoft.net signature algorithm: sha256WithRSAEncryption Cipher used: ECDHE-RSA-AES256-GCM-SHA384 (256 bits) -- sysadm cronomagic.com/gemstelecom.com e-mail ve2cii at canasoft.net POWERED BY LINUX

3 7

Need Help xymond_filestore Fatal Crash
by dl1025＠att.com 09 Jan '18

09 Jan '18

I never saw this type of message before. This morning received a message stating that xymond_filestore Fatal Signal caught. I saw a purple icon appear for the xymon server for xymond_filestore column. Could someone tell me what is going on here and how to troubleshoot it? Thanks, Daniel

1 0

SSL Error
by sjpostsr＠gmail.com 05 Jan '18

05 Jan '18

One of the websites that I am trying to monitor moved to a new site from http to https. Upon changing in Xymon, I am now getting SSL error Server Info: Ubuntu 16.04 Xymon 4.3.25-1 Openssl Version: OpenSSL 1.0.2g 1 Mar 2016 Xymonnet xymonnet version 4.3.25 SSL library : OpenSSL 1.0.2f 28 Jan 2016 LDAP library: OpenLDAP 20442 Error output: Unspecified SSL error in SSL_connect to https (47873/tcp) on host x.x.x.x: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure I have tried using different combinations in the hosts.cfg httpsc:// httpst:// --sni --no-ssl >From the Xymon server, if I run the command: openssl s_client -connect weburl:443, I get the errors: CONNECTED(00000003) 140008606660248:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 305 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1515083787 Timeout : 300 (sec) Verify return code: 0 (ok) --- trying: openssl s_client -connect weburl:443 -servername weburl CONNECTED(00000003) depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority verify return:1 depth=2 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2 verify return:1 depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2 verify return:1 depth=0 OU = Domain Control Validated, CN = weburl verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/CN=weburl i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 2 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2 i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority --- Server certificate -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- subject=/OU=Domain Control Validated/CN=weburl issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2 --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 4411 bytes and written 458 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: 31590AD5C7EC70D6738AE51265DE3B3351503E280EDC0F147616E93CEA374BE3 Session-ID-ctx: Master-Key: FE4C481FDFEDC7933F5732859AEA6E6840848A8633E04BA4AA454ED256942E401846033109F1E9AA73534EA2B3261531 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 10800 (seconds) TLS session ticket: 0000 - bc 67 70 3b a5 1f 62 23-2a 74 e8 04 33 5a e4 8b .gp;..b#*t..3Z.. 0010 - 4d d0 77 a5 6f 5a 88 06-26 9e 19 78 da 59 ce 49 M.w.oZ..&..x.Y.I 0020 - e1 29 8a ec c7 7e 46 07-8c 5a f1 a4 b1 4a 3d c7 .)...~F..Z...J=. 0030 - 83 56 f7 d1 78 b4 0f 12-e6 ca 42 cd 30 b2 63 ac .V..x.....B.0.c. 0040 - e1 a3 0d fe d3 cf 37 4d-73 05 ae 99 cc 7e f1 7d ......7Ms....~.} 0050 - 92 fb 7f 87 95 f0 8e 12-17 bf 68 11 44 a1 83 45 ..........h.D..E 0060 - 2a bb 4c 9a 3e 63 ab ab-0a 3d a8 2f 5d e6 c5 f0 *.L.>c...=./]... 0070 - e1 37 5a 9d 3d ae 15 c3-2f ab 2a 0f 07 a5 f8 ee .7Z.=.../.*..... 0080 - 2b df 77 03 6b 40 d2 4a-19 d8 01 c6 18 ab 58 f1 +.w.k at .J......X. 0090 - 26 85 ff b2 b8 20 da 8f-8b c6 83 6d 94 5d 28 d4 &.... .....m.](. 00a0 - 6f d3 f0 0f 9e f8 70 ef-df 85 39 d9 1c cc 12 60 o.....p...9....` Start Time: 1515083843 Timeout : 300 (sec) Verify return code: 0 (ok) ---

2 1