November 2019 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 23 May '22

23 May '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 1

random errors with imaps/pop3s servers offering TLS 1.3
by lolo＠troll.free.org 10 Aug '21

10 Aug '21

Hi, I have found an issue when trying to monitor imaps and pop3s server offering TLS1.3 . My xymon server configuration: # freebsd-version -u 12.0-RELEASE-p5 # openssl version OpenSSL 1.1.1a-freebsd 20 Nov 2018 standard freebsd xymon-server pkg : # pkg info xymon-server-4.3.28 xymon-server-4.3.28 Name : xymon-server Version : 4.3.28 Installed on : Fri Feb 22 14:19:11 2019 CET Origin : net-mgmt/xymon-server Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : net-mgmt www Licenses : GPLv2 Maintainer : feld at FreeBSD.org WWW : http://xymon.sourceforge.net/ Comment : System for monitoring servers and networks Options : DEBUG : off LDAP : off NETSNMP : off Shared Libs required: libcares.so.2 libpng16.so.16 libpcre.so.1 librrd.so.8 Annotations : FreeBSD_version: 1200086 cpe : cpe:2.3:a:xymon:xymon:4.3.28:::::freebsd12:x64 repo_type : binary repository : FreeBSD Flat size : 26.5MiB ... # ldd /usr/local/www/xymon/server/bin/xymonnet /usr/local/www/xymon/server/bin/xymonnet: libcares.so.2 => /usr/local/lib/libcares.so.2 (0x80027c000) libssl.so.111 => /usr/lib/libssl.so.111 (0x800297000) libcrypto.so.111 => /lib/libcrypto.so.111 (0x80032c000) libpcre.so.1 => /usr/local/lib/libpcre.so.1 (0x800619000) libc.so.7 => /lib/libc.so.7 (0x8006bd000) libthr.so.3 => /lib/libthr.so.3 (0x800ab0000) When trying to monitor a pop3s or imaps server offering tls 1.3, I got random errors: WARNING: Flapping status Service imaps on xxx is not OK : Unexpected service response If I monitor the same services on an other server not offering tls 1.3, all is fine. Both servers where running dovecot. I wrote an extension in perl using IO::Socket::SSL (and the same local openssl) to monitor the server offerng tls 1.3 and all is fine with it. For some strange reason, I can monitor a https web servers (running nginx or apache) offering TLS 1.3 without this issue but not imaps/pop3s. It looks like the https test is different from other ssl/tls tests and does not have the TLS 1.3 issue Regards, -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

2 1

Xymon 4.3.30 Released
by cleaver＠terabithia.org 31 Jul '20

31 Jul '20

Xymon 4.3.30 has been released and is now available for download. 4.3.30 is mostly a bug-fix release, quashing issues stemming from the security fixes in 4.3.29, including improperly-tight restrictions on allowed characters in hostname for browsing along with several other parsing errors. Thanks in particular to Tom Schmidt for his assistance in tracking these down. Xymon should also now be more easily buildable on older GCC versions without the diagnostics pragma available. Xymon 4.3.30 is available from the Xymon SourceForge page at https://sourceforge.net/projects/xymon/ As always, thank you to all who have contributed code, ideas, and features to the project! Regards, Japheth "J.C." Cleaver

2 3

Devmon template for Cisco ISR4000
by marco.avvisano＠regione.toscana.it 19 Dec '19

19 Dec '19

Hi Bruno, i'm tryng your template but, i don't know why, it works only for these test. Querying myrouter? for tests mem_dm,fans,if_col,if_err (devmon.log) any ideas Best Regards Marco Il 27/05/2019 8.53, Bruno Manzoni ha scritto: > > Hi Colin > > I have one? called "cisco-isr" on my github repo: > <https://github.com/bonomani/devmon> > > > bonomani/devmon <https://github.com/bonomani/devmon> > > <https://github.com/bonomani/devmon> > > Regards > > Bruno > > Le 24.05.2019 ? 13:22, Colin Coe a ?crit?: >> Many thanks, I'll give it a?try >> >> On Fri, May 24, 2019 at 3:06 PM Becker Christian >> <christian.becker at rhein-zeitung.net >> <mailto:christian.becker at rhein-zeitung.net>> wrote: >> >> Colin, >> >> i?ve adopted a template based on cisco-3900. I?ve called it >> cisco-4400 because we have an ISR 4431. >> >> I only needed to change the specs for model identification and >> the CPU oid?s. >> >> Until now it?s working for us. If it doesn?t work for you, you >> probably need to adjust the cisco-4400/specs from this: >> >> vendor : cisco >> >> model?? : 4400 >> >> snmpver : 2 >> >> sysdesc : ISR >> >> to your needs, especially the line containing the model. >> >> Do you want to have a look? (be aware ? it?s not really new >> developed, it?s ?only? a copy and an adaptation from cisco-3900?.). >> >> Happy testing! >> >> Regards >> >> Christian >> >> *Von:* Xymon <xymon-bounces at xymon.com >> <mailto:xymon-bounces at xymon.com>> *Im Auftrag von *Colin Coe >> *Gesendet:* Freitag, 24. Mai 2019 08:33 >> *An:* xymon at xymon.com <mailto:xymon at xymon.com> >> *Betreff:* [Xymon] Devmon template for Cisco ISR4000 >> >> Hi >> >> Just wondering if anyone already has a Devmon template for the >> ISR4000 series that they'd be willing to share? >> >> Thanks >> >> >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> http://lists.xymon.com/mailman/listinfo/xymon > > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

2 1

log lines not displaying after 20 min
by kspringer＠innovateteam.com 26 Nov '19

26 Nov '19

Hi, I'm monitoring a hosts' text file for a specific key word using the analysis.cfg LOG options in Xymon.? It's working fine except that if the status stays unchanged for 20 minutes or more the log output no longer displays on the Server's webpage.? The log file is only ever a single line of output which includes a date/time that changes every minute, so the file is changing, but it only displays on the Server's webpage if the red/green status changes.? How can I force it to display the contents of the log file all the time so I can see it on the Server's webpage even if the status is unchanged for long periods of time? -- Kris Springer

1 0

IMAPS & POP3S tests
by damien＠makelofine.org 25 Nov '19

25 Nov '19

Laurent, Thank you for your answer. May you share this perl script ? should be useful for many ppl I guess Le 25/11/2019 ? 14:03, Laurent Frigault a ?crit?: > On Fri, Nov 22, 2019 at 10:53:51AM +0100, Damien Martins wrote: > Hi, > >> Since I upgraded a system to Debian 10 running Xymon client 4.3.28, my >> Xymon server (running version 4.3.28 on Debian 10) reports errors for >> IMAPS & POP3S tests. >> >> This is weird, because I have another server, running Xymon 4.3.28 too, >> that is not reporting any issue. >> >> My IMAPS & POPS3S daemon is dovecot 2.3.4.1-5+deb10u1 >> >> It is quiet complicated to find the logs for this test, so I don't know >> what is going wrong. >> >> Sometimes, the test goes green for few minutes. > > I'm not a debian specialist, but check the TLS protocol offerer by > dovecot on this server. I had the same issue on freebsd when monitoring > a dovecot offering TLS 1.3 even if xymon was build on a server running > the same openssl version offering TLS 1.3. > > I replaced the imaps/pop3s test by a perl scripts extension using > IO::Socket::SSL build with the same openssl and it fixed the issue. > > I reported this issue on this list but never got any answer. > > https://lists.xymon.com/pipermail/xymon/2019-July/046585.html > > Regards,

2 1

IMAPS & POP3S tests
by damien＠makelofine.org 25 Nov '19

25 Nov '19

Hi, Since I upgraded a system to Debian 10 running Xymon client 4.3.28, my Xymon server (running version 4.3.28 on Debian 10) reports errors for IMAPS & POP3S tests. This is weird, because I have another server, running Xymon 4.3.28 too, that is not reporting any issue. My IMAPS & POPS3S daemon is dovecot 2.3.4.1-5+deb10u1 It is quiet complicated to find the logs for this test, so I don't know what is going wrong. Sometimes, the test goes green for few minutes. I tried configuring fail2ban to whitelist my Xymon server IP, and set dovecot to allow a large amount of connections, but this did not change anything. Any help to investigate or locate IMAPS test logs would be appreciated.

4 3

SSL problems with xymon
by lso＠ufm.dk 22 Nov '19

22 Nov '19

Recently I got an error with a perfectly valid certificate in xymon. Xymon reports red Fri Nov 22 09:50:20 2019: SSL error red https://www.su.dk/ - SSL error Seconds: 0.261158000 Trying to access the site using firefox from Xymon server doesn?t report any error: [cid:image001.png at 01D5A11B.2B073820] Testing the certificate using openssl doesn't look right: echo| openssl s_client -connect www.su.dk:443<http://www.su.dk:443> CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 289 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574412455 Timeout : 300 (sec) Verify return code: 0 (ok) Testing other sites using the same method works fine for other sites. What can I do to solve this problem? How do I proceed? If I'm missing some information - pease let med know. Med venlig hilsen/Kind Regards Leif Sommerdal

2 2

Windows Powershell client v.2.42
by zak.beck＠accenture.com 21 Nov '19

21 Nov '19

Hi [powershell] section should work. Thanks Zak From: Leif Sommerdal <lso at ufm.dk> Sent: Thursday, 21 November 2019 07:30 To: xymon at xymon.com Subject: [External] Windows Powershell client v.2.42 This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments. ________________________________ Hi Zak I'm having problems with the powershell client leaking memory on Win2012R2. Thus I have installed version 2.42 to utilize the maxloop option. I was under the impression that I could add the maxloop under [win32] section to control it centrally - but it doesn't seem to work. When making entries for each host it wotks like a dream. Is this a flaw in the design or is it working as designed? Med venlig hilsen/Kind Regards Leif Sommerdal IT Konsulent Uddanelses- og Forskningsministeriet/Ministry for Higher Educationn Styrelsen for Institutioner og Uddannelsesst?tte Bredgade 43 DK-1260 K?benhavn K Telefon: +45 7231 7800 E-mail: siu at ufm.dk<mailto:siu at ufm.dk> www.ufm.dk<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ufm.dk&d=DwMFAw&c=e…> ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

2 1