July 2018 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

[Patch] xymond_rrd crash when parsing Linux ifconfig data
by steve＠opendium.com 22 Feb '19

22 Feb '19

This patch addresses two problems: 1. For Linux clients, do_ifstat_rrd parses the ifconfig output using the regex: ([a-z0-9]+(_[0-9]+)?:*|lo:?)\s pickdata() is called like this: pickdata(bol, ifstat_linux_pcres[0], 1, &ifname) With a network interface name such as "foo1", the regex produces 2 results: 0: "foo1 " 1: "foo1" pickdata() discards result 0 and assigns result 1 ("foo1") to the ifname parameter as expected. With a network interface name such as "foo_1", the regex produces 3 results: 0: "foo_1 " 1: "foo_1" 2: "_1" pickdata() discards result 0, assigns result 1 ("foo_1") to the ifname parameter and then tries to assign result 2 ("_1") to the next parameter in the variable argument list. Since there it no such parameter, this results in a segmentation fault and xymond_rrd crashes. The attached patch adds a "num_args" parameter to pickdata() to tell it how many arguments are in the variable argument list and ensure it never rolls off the end of that list. 2. I have some clients with network interface names in the form "foo.5", "foo_bar" and "foo-bar" ("eth0.5" is especially common when eth0 is carrying an 802.1q trunk, for example). Xymon does not collect statistics on those network interfaces because they don't match the regex. This patch relaxes the regex a bit so that it matches these network interfaces. -- - Steve Hill Technical Director Opendium Online Safety / Web Filtering http://www.opendium.com Enquiries: sales at opendium.com +44-1792-824568 Support: support at opendium.com +44-1792-825748 Opendium Limited is a company registered in England and Wales. Company No. 5465437 Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.

2 1

DISPLAYGROUP fails in analysis.cfg
by doughnut＠doughnut.net 01 Feb '19

01 Feb '19

I have a xymon server running "Debian GNU/Linux 9 (stretch)" with xymon 4.3.28-2. I'm having bad luck getting DISPLAYGROUP to work in analysis.cfg. It seems to only match on the first 7 characters. I also see this problem on "Debian GNU/Linux 8 (jessie)" with xymon 4.3.17-6+deb8u1. Below, I've shown that the display group is set, and that the analysis.cfg file is being parsed correctly by xymon, yet the the svcstatus page only shows the shortest of the DISPLAYGROUP enabled lines. root at misc-ten105-test:/etc/xymon# egrep -H Testnet.Database.Servers hosts.cfg hosts.cfg:group Testnet Database Servers root at misc-ten105-test:/etc/xymon# cat analysis.d/davetest.cfg HOST=* EXCLASS=linux PROC davetest-nonlinux 1 150 yellow PROC davetest-Testnet.Database.Servers 1 150 yellow DISPLAYGROUP=%(Testnet.Database.Servers) PROC davetest-Database 1 150 yellow DISPLAYGROUP=%(Database) PROC davetest-Databas 1 150 yellow DISPLAYGROUP=%(Databas) PROC davetest-Testnet.Database 1 150 yellow DISPLAYGROUP=%(Testnet.Database) PROC davetest-Testnet.Data 1 150 yellow DISPLAYGROUP=%(Testnet.Data) PROC davetest-Testnet.D 1 150 yellow DISPLAYGROUP=%(Testnet.D) PROC davetest-Testnet. 1 150 yellow DISPLAYGROUP=%(Testnet.) PROC davetest-Testnet 1 150 yellow DISPLAYGROUP=%(Testnet) PROC davetest-Testne 1 150 yellow DISPLAYGROUP=%(Testne) root at misc-ten105-test:/etc/xymon# sudo -u xymon xymoncmd xymond_client --dump-config | grep davetest [...] PROC davetest-nonlinux 1 150 yellow HOST=* EXCLASS=linux (line: 375) PROC davetest-Testnet.Database.Servers 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Database.Servers) EXCLASS=linux (line: 377) PROC davetest-Database 1 150 yellow HOST=* DISPLAYGROUP=%(Database) EXCLASS=linux (line: 378) PROC davetest-Databas 1 150 yellow HOST=* DISPLAYGROUP=%(Databas) EXCLASS=linux (line: 379) PROC davetest-Testnet.Database 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Database) EXCLASS=linux (line: 380) PROC davetest-Testnet.Data 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Data) EXCLASS=linux (line: 381) PROC davetest-Testnet.D 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.D) EXCLASS=linux (line: 382) PROC davetest-Testnet. 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.) EXCLASS=linux (line: 383) PROC davetest-Testnet 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet) EXCLASS=linux (line: 384) PROC davetest-Testne 1 150 yellow HOST=* DISPLAYGROUP=%(Testne) EXCLASS=linux (line: 385) root at misc-ten105-test:/etc/xymon# lynx -dump -nolist 'http://localhost/xymon-cgi/svcstatus.sh?HOST=balin2012.collegenet.testnet&S…' [...] Xymon balin2012.mydomain.testnet - procs Wed Jul 11 13:29:40 2018 _______________________________________________________________________ HISTORY Wed Jul 11 13:29:40 2018 - Processes NOT ok yellow davetest-nonlinux (found 0, req. between 1 and 150) yellow davetest-Testnet (found 0, req. between 1 and 150) yellow davetest-Testne (found 0, req. between 1 and 150) Status unchanged in 8 days, 21 hours, 22 minutes Status message received from 10.101.1.35 Client data available

2 4

Project: Xymon dashboard
by herzog＠phys.ethz.ch 08 Nov '18

08 Nov '18

Hi all, for the past 3 weeks we've been working on a new Xymon web frontend that better fits our needs of managing our somewhat extensive (~ 900 hosts) setup. It's now in a state of being ready for daily use, so we would like to announce it in case somebody else is interested: https://github.com/daduke/Xymondash Let us know if you have comments or even pull requests! cheers, -Christian -- Dr. Christian Herzog <herzog at phys.ethz.ch> support: +41 44 633 26 68 IT Services Group, HPT H 8 voice: +41 44 633 39 50 Department of Physics, ETH Zurich 8093 Zurich, Switzerland http://nic.phys.ethz.ch/

6 14

Setting thresholds in analysis.cfg
by chris.seip＠hpe.com 21 Aug '18

21 Aug '18

I could a hand getting the basics of analysis.cfg worked out, please. Here's mine: # egrep -v '^#' analysis.cfg HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK /disk/data 50 55 DISK * 90 95 MEMSWAP 80 90 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK /disk/data 92 96 DISK * 90 95 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 DISK /BACKUP 98 99 DISK * 90 95 DEFAULT # Ignore some usually uninteresting tmpfs mounts. DISK /dev IGNORE DISK /dev/shm IGNORE DISK /lib/init/rw IGNORE DISK /run IGNORE # These are the built-in defaults. You should only modify these # lines, not add new ones (no PROC, DISK, LOG ... lines). UP 1h LOAD 5.0 10.0 DISK * 90 95 INODE * 70 90 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 Three issues with this: 1. Swap consumption in the first host, swnfs06, has been steady at 74%, so I was trying to hush the alerts with the MEMSWAP line. This change hasn't had any effect; I am still getting a memory low yellow-warning for swap/page usage on swnfs06. 2. On the same swnfs06 host, its /disk/data partition is 56% full, so my "DISK..50 60" line was an attempt to trigger a yellow alert. I was testing my understanding of the analysis.cfg file, but the filesystems test remains green. 3. And my 96% full /BACKUP drive on hpnsvr18 is issuing a red alert for being over the panic level of 95%, where I was trying to set the panic level at 99%. After wrestling with the man page and many experiments, I'm tossing this to the group for help. Seems very basic, but it's just not working for me. What'm I missing? I tried switching to the "threshold hostname" format, like this: # egrep -v '^#' analysis.cfg | head -11 DISK /disk/data 50 55 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK * 90 95 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 MEMSWAP 80 90 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK /disk/data 92 96 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK * 90 95 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK /BACKUP 98 99 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 DISK * 90 95 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 This produced no change in behavior. I am stopping and starting the Xymon server software and waiting for new html pages to generate after every change in the analysis.cfg. In my configuration report, I can see that every server configured for local memory tests has acquired the 80%/90% threshold setting, not just swnfs06. And my "DISK /disk/data 50 55" is having no effect at all on any host: The strings "50%" or "60%" appear nowhere in my configuration report. # egrep 'swnfs0[67]' hosts.cfg 16.93.247.204 swnfs06.rose.rdlabs.hpecorp.net # rpc=mount,nlockmgr,nfs,ypbind ssh 16.93.247.205 swnfs07.rose.rdlabs.hpecorp.net # NOCOLUMNS=files rpc=mount,nlockmgr,nfs,ypbind ssh 16.93.247.204 swnfs06.rose.rdlabs.hpecorp.net # xymoncmd xymond_client --dump-config DISK /disk/data 50% 55% 0 -1 red HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 351) DISK * 90% 95% 0 -1 red HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 352) MEMSWAP 80 90 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 353) DISK /disk/data 92% 96% 0 -1 red HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 (line: 355) DISK * 90% 95% 0 -1 red HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 (line: 356) DISK /BACKUP 98% 99% 0 -1 red HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 (line: 360) DISK * 90% 95% 0 -1 red HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 (line: 361) DISK /dev IGNORE (line: 371) DISK /dev/shm IGNORE (line: 372) DISK /lib/init/rw IGNORE (line: 373) DISK /run IGNORE (line: 374) UP 3600 -1 (line: 377) LOAD 5.00 10.00 (line: 378) DISK * 90% 95% 0 -1 red (line: 379) INODE * 70% 90% 0 -1 red (line: 380) MEMREAL 100 101 (line: 381) MEMSWAP 50 80 (line: 382) MEMACT 90 97 (line: 383) Thanks for any insights you can provide. Feels like I'm making a wrong assumption about how analysis.cfg works. Best thing I can figure to do would be to switch to local configuration of my Xymon clients, but I'd rather manage custom thresholds centrally. - Chris

2 2

Intermittent HTTP Status 0 - Reason?
by mail＠jonasw.de 04 Aug '18

04 Aug '18

Hello, in our Xymon installation we are experiencing red HTTP status 0 alerts repeatedly, about a few times per week. This phenomenon started appearing when we switched the backend from Apache to nginx. The monitored service is checked over an SSL connection, making tcpdump et al. difficult to use. Additionally, this only appears on our production monitoring; a secondary installation with only this check does not show this issue. So, debug logging isn't really feasible, either (although I've tried). At this point, we are quite certain that it is a monitoring artifact and not a problem of the service, as there are no errors on the nginx side of things, and no customers have complained, either. I've looked in the code of xymonnet. I think status code 0 might mean that no HTTP/1.x response has been received, or at least that Xymon was unable to parse it. Is that correct? Does/did anybody else face this problem? Best regards, Jonas

2 1

xymon-snmpcollect
by sitrix＠camheds.net 04 Aug '18

04 Aug '18

Hello It seems that there are already exists much of the code for snmp polling and analysing in xymon. There are handle_snmpcollect_client func in xymond_client.c, that calling check_mibvals, which in turn call get_mibval_thresholds, wich in turn using data from load_client_config >From quick reading of load_client_config function definition, i do not undestand how exactly i need to define MIB rules in analysis.cfg But what absent is a testing module for xymond_client, when running with --test. So there is no easy why to test SNMP rules. Because testmode function in xymond_client.c do not provide this testing. I will gladly beta test the code that close this gap, but i'm not that C pro developer to create it from scratch. Lets be clear, DevMon is good and ancient, but why not use what we already have in a code base -- WBR Nikolay

2 1

Language Supported in Xymon
by Chethana.Poorlupadi＠colt.net 04 Aug '18

04 Aug '18

Hi Team, Could any one of you let me know what are the different languages supported by Xymon? Thanks, Chethana [Colt Disclaimer] This email is from an entity of the Colt group of companies. Colt Group S.A., K2 Building, Forte 1, 2a rue Albert Borschette, L-1246 Luxembourg, R.C.S. B115679. Corporate and contact information for our entities can be found at http://colt.net/uk/en/Colt-Group-of-Companies/index.htm. Internet communications are not secure and Colt does not accept responsibility for the accurate transmission of this message. Content of this email or its attachments is not legally or contractually binding unless expressly previously agreed in writing by Colt

2 1

IP of host in mail subject
by jgsuareza1984＠gmail.com 04 Aug '18

04 Aug '18

Hi greetings from Ecuador, Please your help, I need that the XYMON monitoring mails include the IP of the host-client How do i do it? *Gabriel Suárez*

2 1

RRD files
by jgsuareza1984＠gmail.com 26 Jul '18

26 Jul '18

Hi greetings from Ecuador, Please help me, how I can configure the .rrd files so that they are deleted in a set time and do not generate space *Gabriel Suárez*

2 1