December 2018 - Xymon - Xymon mailman web

SELinux and svcstatus.cgi
by FRamaekers＠ailife.com 12 Dec '18

12 Dec '18

Well, I have xymon mostly setup, but I'm having difficulty when drilling down into a service that is monitored: Exec failed for /home/xymon/server/bin/svcstatus.cgi: Permission denied I thought turning on the httpd_sys_script_exec_t would do the trick: -rwxr-xr-x. xymon apache unconfined_u:object_r:httpd_sys_script_exec_t:s0 svcstatus.cgi ...that didn't help....I've verified that it is a SELinux permissions by 'setenforce 0' and the script works. What am I missing? Frank M. Ramaekers Jr. | Systems Analyst I | CIS Mainframe Services Unisys | Skype: 512-387-3949 | Francis.Ramaekers at Unisys.com [unisys_logo]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.unisys.com_&d=DwMFA…> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all devices. [Grey_LI]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.linkedin.com_compan…> [Grey_TW] <https://urldefense.proofpoint.com/v2/url?u=http-3A__twitter.com_unisyscorp&…> [Grey_GP] <https://urldefense.proofpoint.com/v2/url?u=https-3A__plus.google.com_-2BUni…> [Grey_YT] <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.youtube.com_theunis…> [Grey_FB] <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.facebook.com_unisys…> [Grey_Vimeo] <https://urldefense.proofpoint.com/v2/url?u=https-3A__vimeo.com_unisys&d=DwM…> [Grey_UB] <https://urldefense.proofpoint.com/v2/url?u=http-3A__blogs.unisys.com_&d=DwM…> ---------------------------------------------------------------------- This message contains information which is privileged and confidential and is solely for the use of the intended recipient. If you are not the intended recipient, be aware that any review, disclosure, copying, distribution, or use of the contents of this message is strictly prohibited. If you have received this in error, please destroy it immediately and notify us at PrivacyAct at torchmarkcorp.com.

2 1

Any luck monitoring the size of Windows directories?
by glauber.ribeiro＠experian.com 12 Dec '18

12 Dec '18

This is something that used to work, but I haven't been able to make it work anymore. I'm running xymon server 4.3.8 (Linux). Windows Powersell client. I want to flag if the directory d:\tsiback\today becomes too small or too large. I have, in analysis.cfg: DIR "%.*tsiback.today$" red size>5000000 size<50000000 TRACK Notice I have to use a regexp, because the backslash messes things up. It's working somewhat, because I see a graph of the directory's size on the server (the "track" is working). But the current data is [dir:D:\tsiback\today] 558831 D:\tsiback\today 558831 is clearly not larger than 5000000, but the status is still green. Am I missing anything obvious? Thanks, glauber -- Glauber Ribeiro - Experian Automotive Infrastructure and Information Security glauber.ribeiro at experian.com ph +1-224-698-3108

1 0

xymon & fping
by FRamaekers＠ailife.com 12 Dec '18

12 Dec '18

[xymon at xxxxxxxx ~]$ fping yyyyyyyy fping: can't create raw socket (must run as root?) : Operation not permitted [xymon at xxxxxxxx ~]$ ls -lh /usr/local/sbin/fping -rwxr-xr-x. 1 root root 87K Jul 24 12:28 /usr/local/sbin/fping What should I do to correct this (best solution)? Found this, but not sure it applies to xymon: chown root:zzzzzzzz /usr/sbin/fping chmod 710 /usr/sbin/fping chmod ug+s /usr/sbin/fping Frank M. Ramaekers Jr. ---------------------------------------------------------------------- This message contains information which is privileged and confidential and is solely for the use of the intended recipient. If you are not the intended recipient, be aware that any review, disclosure, copying, distribution, or use of the contents of this message is strictly prohibited. If you have received this in error, please destroy it immediately and notify us at PrivacyAct at torchmarkcorp.com.

3 3

[External] RE: Xymon PS Client - v2.34
by zak.beck＠accenture.com 12 Dec '18

12 Dec '18

Yes, sorry, I meant to put that in the original email. You can download the latest version here: https://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/ You can just replace the xymonclient.ps1 script. However, I would recommend you look at the "clientversion" directive in the documentation (XymonPSClient.doc at the above url) which will tell you how to update automatically. Zak From: Ribeiro, Glauber <glauber.ribeiro at experian.com> Sent: Wednesday, 12 December 2018 15:31 To: Beck, Zak <zak.beck at accenture.com>; xymon at xymon.com Subject: [External] RE: Xymon PS Client - v2.34 Excellent, thank you! Please remind me, where can I download the client, and how would one upgrade (is it enough to replace the PowerShell scripts with the new versions?). g From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Beck, Zak Sent: Wednesday, December 12, 2018 09:05 To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Xymon PS Client - v2.34 Hi A long-overdue release with a number of minor fixes and one major overhaul of event log processing. Event log processing changes: You've always been able to exclude certain event log messages from appearing using 'ignore' - this actually had a major issue where a matching ignore filter suppressed other events. I have added the opposite: being able to include only the messages you're interested in. That means you now have two ways of handling which event log messages you see: * Exclude mode: including all events except specified - use ignore * Include mode: ignore all events except specified - use include Include mode takes priority - if there are any "include" entries, include mode will be used. All ignore entries will be disregarded. Secondly, to cover the scenario where you are using client local config merging, you can now specify a priority on eventlogswanted which will allow you to override other configs. For example, you may have an eventlogswanted statement in your [powershell] class with some sensible defaults, like this: eventlogswanted:System:1000:Warning,Critical,Error But if you have a specific server where you also want to check the Application log, you can override that statement in a [server] block with this: eventlogswanted:100:Application,System:1000:Warning,Critical,Error List of all the fixes: * added TLS fix from Kris Springer / Jonathan Trott. Only set TLS parameters if https is used for downloads (of updates and external scripts). Note that these TLS settings are not compatible with Powershell v2 (but will only impact if you use https) * optionally only show listening ports in [ports], controlled from client-local.cfg (using ports:listenonly) * allow disabling of IIS sites information, controlled from xymonclient_config.xml * added 'noservicecheck' from Tim Williams * extra logging in XymonMsgs * fixed major bug in XymonMsgs where a matching 'ignore' filter would suppress all events * fix for unnecessary attempt to encrypt serverHttpPassword * event log handling overhaul * allow different levels by event log * handling of multiple configs when using config merging (priority on eventlogswanted) * add ability to use environment variables for clientname if network settings not available Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.accent…>. ______________________________________________________________________________________ www.accenture.com<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.accentu…>

1 0

Xymon PS Client - v2.34
by zak.beck＠accenture.com 12 Dec '18

12 Dec '18

Hi A long-overdue release with a number of minor fixes and one major overhaul of event log processing. Event log processing changes: You've always been able to exclude certain event log messages from appearing using 'ignore' - this actually had a major issue where a matching ignore filter suppressed other events. I have added the opposite: being able to include only the messages you're interested in. That means you now have two ways of handling which event log messages you see: * Exclude mode: including all events except specified - use ignore * Include mode: ignore all events except specified - use include Include mode takes priority - if there are any "include" entries, include mode will be used. All ignore entries will be disregarded. Secondly, to cover the scenario where you are using client local config merging, you can now specify a priority on eventlogswanted which will allow you to override other configs. For example, you may have an eventlogswanted statement in your [powershell] class with some sensible defaults, like this: eventlogswanted:System:1000:Warning,Critical,Error But if you have a specific server where you also want to check the Application log, you can override that statement in a [server] block with this: eventlogswanted:100:Application,System:1000:Warning,Critical,Error List of all the fixes: * added TLS fix from Kris Springer / Jonathan Trott. Only set TLS parameters if https is used for downloads (of updates and external scripts). Note that these TLS settings are not compatible with Powershell v2 (but will only impact if you use https) * optionally only show listening ports in [ports], controlled from client-local.cfg (using ports:listenonly) * allow disabling of IIS sites information, controlled from xymonclient_config.xml * added 'noservicecheck' from Tim Williams * extra logging in XymonMsgs * fixed major bug in XymonMsgs where a matching 'ignore' filter would suppress all events * fix for unnecessary attempt to encrypt serverHttpPassword * event log handling overhaul * allow different levels by event log * handling of multiple configs when using config merging (priority on eventlogswanted) * add ability to use environment variables for clientname if network settings not available Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

2 1

Any luck monitoring the size of directories in Windows?
by glauber.ribeiro＠experian.com 12 Dec '18

12 Dec '18

This is something that used to work, but I haven’t been able to make it work anymore. I’m running xymon server 4.3.8 I want to flag if the directory d:\tsiback\today becomes too small or too large. I have, in analysis.cfg: DIR "%.*tsiback.today$" red size>5000000 size<50000000 TRACK Notice I have to use a regexp, because the backslash messes things up. It’s working somewhat, because I see a graph of the directory’s size on the server (the “track” is working). But the current data is [dir:D:\tsiback\today] 558831 D:\tsiback\today 558831 is clearly not larger than 5000000, but the status is still green. Am I missing anything obvious? Thanks, glauber

1 0

group analysis test to multiple hosts
by kspringer＠innovateteam.com 06 Dec '18

06 Dec '18

I've got a list of 30 hosts that all have the same name except a different number at the end. I'd like to test only those hosts for a running service, but I've tried the following entries in my analysis.cfg file with no success. It either applies the test to every host in my hosts.cfg file, or it doesn't test any of them. I can't seem to get it dialed in to only test the specific hosts that I want it to. I've tried this HOST wildcard, but it applies the test to every host, no matter what name it is. *HOST=Upper-Lab-PC*** ** SVC SoftwareName* I tried DISPLAYGROUP because the list of hosts are defined in a 'group-only' list in my hosts.cfg file, but this didn't apply the test to any hosts at all. *DISPLAYGROUP="Upper Lab Desktops"* * SVC SoftwareName* I could of course test each host individually, but that seems a bit ridiculous when the man page says I can group them. Suggestions? -- Kris Springer

2 3

alert on PROC only during certain time
by kspringer＠innovateteam.com 06 Dec '18

06 Dec '18

I need to configure my analysis.cfg file to check if a specific process on a specific host is NOT running during a specific time. That is, if the process IS running during that time I want it to flag red. I don't care if it's running any other time of the day. I've reviewed the man pages and tried a few different settings with no success. I'm hoping someone could send me a functioning sample config. Here's what I've got in analysis.cfg *HOST=CamViewer EXTIME=*:2200:2400** ** PROC CamSoftware* Kris Springer

2 2

client not sending to both servers
by rcohen55＠gmail.com 03 Dec '18

03 Dec '18

Had the same issue when using client 4.3.18 (on HPUX 11.23) to 4.3.28 (Linux) server. as advised, maybe try to run the same version of client and server. Ron On Tue, 20 Nov 2018 at 17:29, Malcolm Hunter <malcolm.r.hunter at gmail.com> wrote: > What happens if you swap the servers around in BBDISPLAYS? > > That's a pretty old client. Have you considered upgrading? > > Malc > > On Tue, 20 Nov 2018 at 17:10, Ian Diddams via Xymon <xymon at xymon.com> > wrote: > >> >> >> >> ---------- Forwarded message ---------- >> From: Ian Diddams <didds3 at yahoo.co.uk> >> To: Xymon Mailing List <xymon at xymon.com> >> Cc: >> Bcc: >> Date: Tue, 20 Nov 2018 17:00:08 +0000 (UTC) >> Subject: client not sending to both servers >> client config in ~xymon/client/etc/hobbitclient.cfg >> >> .. >> BBDISP="0.0.0.0" # IP address of the Hobbit server >> BBDISPLAYS="192.168.55.243 192.168.52.64" # IP of >> multiple Hobbit servers. BBDISP must be "0.0.0.0". >> ... >> >> the server on 192.168.55.243 received all the epxted disk, cpu etc info >> and displays it fine. >> >> But the server in 192.168.52.64 - doesn;t. >> >> Ive sniffed the 1984 port on the server (..52.64) and nothing comes in. >> Ive done the same on the client but I can see it going out... >> >> >> >> basic monitoring works (conn) fine >> >> Ive tested a quick script that "writes" a status message to a TEST alert >> on ...52.64 and that appears. >> >> I can telnet from the client to ...52.64 on port 1984 fine. >> >> ghost client report has nothing in it that could be the client. >> >> Its as if the client isn;t even sending it to the swerver anyway (tcpdump >> etc) >> >> ass I see in the logs is >> >> hobbitclient.log: >> 2018-11-20 16:38:57 Whoops ! bb failed to send message - timeout >> 2018-11-20 16:38:57 Failed to get a message, terminating >> >> >> >> repeated over and over and over. >> >> >> >> anyone any ideas? >> >> or how to increase the logging level to "see" more stuff? >> >> or... ? >> >> >> >> ---------- Forwarded message ---------- >> From: Ian Diddams via Xymon <xymon at xymon.com> >> To: Xymon Mailing List <xymon at xymon.com> >> Cc: >> Bcc: >> Date: Tue, 20 Nov 2018 17:00:08 +0000 (UTC) >> Subject: [Xymon] client not sending to both servers >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon >> > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

Christmas icons
by john.horne＠plymouth.ac.uk 01 Dec '18

01 Dec '18

On Wed, 2018-11-28 at 10:39 +0100, Dirk Kastens wrote: > Hi Walter, > > I'm using these every year :-) > > Am 28.11.2018 um 02:24 schrieb Walter Rutherford: > > Hello, > > > > I remember years ago at a different job I found a set of Christmasy > > replacement icons to use with Big Brother, (yes, that long ago). That > > computer is long gone so I searched online but I haven't been able > > to find a copy of those holiday icons anywhere. > > > > Does anybody happen to have a copy of those icons handy? > Hi, We've used Xymon/Big Brother for many years, but I admit that I hadn't seen the Christmas icons before. Many thanks for attaching them. They look very good :-) John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

1 0