September 2018 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

[Patch] xymond_rrd crash when parsing Linux ifconfig data
by steve＠opendium.com 22 Feb '19

22 Feb '19

This patch addresses two problems: 1. For Linux clients, do_ifstat_rrd parses the ifconfig output using the regex: ([a-z0-9]+(_[0-9]+)?:*|lo:?)\s pickdata() is called like this: pickdata(bol, ifstat_linux_pcres[0], 1, &ifname) With a network interface name such as "foo1", the regex produces 2 results: 0: "foo1 " 1: "foo1" pickdata() discards result 0 and assigns result 1 ("foo1") to the ifname parameter as expected. With a network interface name such as "foo_1", the regex produces 3 results: 0: "foo_1 " 1: "foo_1" 2: "_1" pickdata() discards result 0, assigns result 1 ("foo_1") to the ifname parameter and then tries to assign result 2 ("_1") to the next parameter in the variable argument list. Since there it no such parameter, this results in a segmentation fault and xymond_rrd crashes. The attached patch adds a "num_args" parameter to pickdata() to tell it how many arguments are in the variable argument list and ensure it never rolls off the end of that list. 2. I have some clients with network interface names in the form "foo.5", "foo_bar" and "foo-bar" ("eth0.5" is especially common when eth0 is carrying an 802.1q trunk, for example). Xymon does not collect statistics on those network interfaces because they don't match the regex. This patch relaxes the regex a bit so that it matches these network interfaces. -- - Steve Hill Technical Director Opendium Online Safety / Web Filtering http://www.opendium.com Enquiries: sales at opendium.com +44-1792-824568 Support: support at opendium.com +44-1792-825748 Opendium Limited is a company registered in England and Wales. Company No. 5465437 Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.

2 1

DISPLAYGROUP fails in analysis.cfg
by doughnut＠doughnut.net 01 Feb '19

01 Feb '19

I have a xymon server running "Debian GNU/Linux 9 (stretch)" with xymon 4.3.28-2. I'm having bad luck getting DISPLAYGROUP to work in analysis.cfg. It seems to only match on the first 7 characters. I also see this problem on "Debian GNU/Linux 8 (jessie)" with xymon 4.3.17-6+deb8u1. Below, I've shown that the display group is set, and that the analysis.cfg file is being parsed correctly by xymon, yet the the svcstatus page only shows the shortest of the DISPLAYGROUP enabled lines. root at misc-ten105-test:/etc/xymon# egrep -H Testnet.Database.Servers hosts.cfg hosts.cfg:group Testnet Database Servers root at misc-ten105-test:/etc/xymon# cat analysis.d/davetest.cfg HOST=* EXCLASS=linux PROC davetest-nonlinux 1 150 yellow PROC davetest-Testnet.Database.Servers 1 150 yellow DISPLAYGROUP=%(Testnet.Database.Servers) PROC davetest-Database 1 150 yellow DISPLAYGROUP=%(Database) PROC davetest-Databas 1 150 yellow DISPLAYGROUP=%(Databas) PROC davetest-Testnet.Database 1 150 yellow DISPLAYGROUP=%(Testnet.Database) PROC davetest-Testnet.Data 1 150 yellow DISPLAYGROUP=%(Testnet.Data) PROC davetest-Testnet.D 1 150 yellow DISPLAYGROUP=%(Testnet.D) PROC davetest-Testnet. 1 150 yellow DISPLAYGROUP=%(Testnet.) PROC davetest-Testnet 1 150 yellow DISPLAYGROUP=%(Testnet) PROC davetest-Testne 1 150 yellow DISPLAYGROUP=%(Testne) root at misc-ten105-test:/etc/xymon# sudo -u xymon xymoncmd xymond_client --dump-config | grep davetest [...] PROC davetest-nonlinux 1 150 yellow HOST=* EXCLASS=linux (line: 375) PROC davetest-Testnet.Database.Servers 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Database.Servers) EXCLASS=linux (line: 377) PROC davetest-Database 1 150 yellow HOST=* DISPLAYGROUP=%(Database) EXCLASS=linux (line: 378) PROC davetest-Databas 1 150 yellow HOST=* DISPLAYGROUP=%(Databas) EXCLASS=linux (line: 379) PROC davetest-Testnet.Database 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Database) EXCLASS=linux (line: 380) PROC davetest-Testnet.Data 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.Data) EXCLASS=linux (line: 381) PROC davetest-Testnet.D 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.D) EXCLASS=linux (line: 382) PROC davetest-Testnet. 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet.) EXCLASS=linux (line: 383) PROC davetest-Testnet 1 150 yellow HOST=* DISPLAYGROUP=%(Testnet) EXCLASS=linux (line: 384) PROC davetest-Testne 1 150 yellow HOST=* DISPLAYGROUP=%(Testne) EXCLASS=linux (line: 385) root at misc-ten105-test:/etc/xymon# lynx -dump -nolist 'http://localhost/xymon-cgi/svcstatus.sh?HOST=balin2012.collegenet.testnet&S…' [...] Xymon balin2012.mydomain.testnet - procs Wed Jul 11 13:29:40 2018 _______________________________________________________________________ HISTORY Wed Jul 11 13:29:40 2018 - Processes NOT ok yellow davetest-nonlinux (found 0, req. between 1 and 150) yellow davetest-Testnet (found 0, req. between 1 and 150) yellow davetest-Testne (found 0, req. between 1 and 150) Status unchanged in 8 days, 21 hours, 22 minutes Status message received from 10.101.1.35 Client data available

2 4

Project: Xymon dashboard
by herzog＠phys.ethz.ch 08 Nov '18

08 Nov '18

Hi all, for the past 3 weeks we've been working on a new Xymon web frontend that better fits our needs of managing our somewhat extensive (~ 900 hosts) setup. It's now in a state of being ready for daily use, so we would like to announce it in case somebody else is interested: https://github.com/daduke/Xymondash Let us know if you have comments or even pull requests! cheers, -Christian -- Dr. Christian Herzog <herzog at phys.ethz.ch> support: +41 44 633 26 68 IT Services Group, HPT H 8 voice: +41 44 633 39 50 Department of Physics, ETH Zurich 8093 Zurich, Switzerland http://nic.phys.ethz.ch/

6 14

Debian 9 stretch
by trever＠tandj.org 02 Oct '18

02 Oct '18

Trying to install Xymon on Debian 9 and it is failing do to missing package librrd2-dev. This package is not available in the apt repository. The instructions that are available talk about installing on Debian 6 Squeeze. Are there update instructions anywhere?

4 6

alert e-mail scripts
by KK1051＠att.com 28 Sep '18

28 Sep '18

Xymoners, I am running 4.3.28 xymon. I am working on a newer server that I want to use a custom script for the e-mail. I have a couple of old e-mail scripts that I used in the past. They are just simple scripts to test all your variables pass and it sends a mail. I use this to test and build the new script I want. Ok so nothing is working like it should. The sript will run from command line but when I run it from the alert.cfg file, it just puts "no mail" in the log. It is like it is trying to read mail and not send it. I have not gone back and looked to see if mail scripts work differently. I even searched the archive mail for some sample scripts. Here is the line from alerts.cfg CLASS=%MP COLOR=red MAIL ltxxxx at xxx jlxxxx at xxx kkxxxx at xxx REPEAT=1d TIME=*:0730:2100 SCRIPT /usr/local/xymon/server/ext/mail_generic.ksh kkxxxx at xxx Here is my script (sample from mail archives): #!/usr/bin/ksh RECIPIENT=$1 LOGGROUP=$2 CALL_LEVEL=medium [ "$BBCOLORLEVEL" = "RED" ] && CALL_LEVEL=high echo ' Hi $RECIPIENT Please log a $CALL_LEVEL call to $LOGGROUP, with the subject \"$BBHOSTNAME - $BBSVCNAME problem - Please Investigate.\" Please include this link in the service call ticket for more information $(echo $BBALPHAMSG | grep http) Thanks Monitoring. ' | mailx $RECIPIENT >From alert.log Received reload request Received reload request No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. No mail. Received reload request Received reload request Received reload request Received reload request Kevin H. King * "You can not please everyone everyday, But everyday please everyone you can" -me

4 3

VAX/VMS Client for Xymon
by abs＠shadymint.com 25 Sep '18

25 Sep '18

Looking at the archive, I find this last cropped up in 2005 but I didnt see any extensive followup. I really dont know anything about this OS, but I have been challenged to monitor a couple of instances of it, does anyone have any tips or experience they can share with me? Thanks -- Andy

2 1

xymonnet blocking
by john.thurston＠alaska.gov 20 Sep '18

20 Sep '18

We've run xymon for years, and BB for years before that. We've recently bumped into a potential problem with xymonnet. In the middle of the night, all of our tests populated by xymonnet went purple. We think we've tracked the problem, and attribute it to an ldap query which took too long to respond. It looks like xymonnet just stopped while it waited for this query to complete. While it was waiting on this response, none of the other xymonnet tests were being performed. The man for xymonnet indicates there is a --timeout=N which determines how long to wait for a service to accept a connection. Is there some parameter which will control how long xymonnet can try to get an answer after connecting? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Department of Administration State of Alaska

3 3

NOPROPYELLOW ignored for one test
by doughnut＠doughnut.net 19 Sep '18

19 Sep '18

I'm having problems with NOPROPYELLOW but only for one test. It seems to completely ignore just that one. Factors: * NOPROPYELLOW is successfully being applied to other tests. * There is no change when this is the only NOPROPYELLOW host or one of many. * There is no change if I use NOPROPYELLOW:+mycustomtest or NOPROPYELLOW:mycustomtest. * I am not using --nopropyellow option to xymongen. * It fails when used on the .default. or the specific host line (or both). * This test is run on one host which reports on behalf of many others. * I've verified that the test name is correct using xymondboard. sudo -u xymon xymoncmd xymon localhost "xymondboard test=mycustomtest" Any suggestions for my next step in debugging? Dave

2 3

SNMP Traps - We are converting to Xymon from BB
by glh.forums＠gmail.com 18 Sep '18

18 Sep '18

Hi Jason, I think you need to provide some more information. What are you using in BB to catch, decode, and react to the traps? How is it configured? Greg Hubbard On Tue, Sep 11, 2018 at 10:37 AM Jason Hildreth - NOAA Federal via Xymon < xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Jason Hildreth - NOAA Federal <jason.hildreth at noaa.gov> > To: xymon at xymon.com > Cc: > Bcc: > Date: Tue, 11 Sep 2018 11:30:34 -0400 > Subject: SNMP Traps - We are converting to Xymon from BB > Question is more related to Big Brother in our interim before we move to > Xymon.... > > If anyone can help (since BB has been dead for a while) it would be > appreciated. > > We have SNMP traps setup to be received in our Big Brother environment but > instead of sending the trap back to itself for processing it is sending the > data to the IP of the other Big Brother (now Xymon) system. We want to > keep the SNMP traps on the Big Brother system until we put the xymon system > in place completely. Does anyone know why it is sending to a different IP > than the IP of the system the SNMP trap was received on...and where that is > set in order to make this stop... > > Thanks > > -- > > Jason Hildreth > > Middleware, Programming, Systems Administrator > > Infrastructure and Web Services Branch > > NCEP Central Operations > > > > ---------- Forwarded message ---------- > From: Jason Hildreth - NOAA Federal via Xymon <xymon at xymon.com> > To: xymon at xymon.com > Cc: > Bcc: > Date: Tue, 11 Sep 2018 11:30:34 -0400 > Subject: [Xymon] SNMP Traps - We are converting to Xymon from BB > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > -- Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.

5 6