February 2019 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

Xymon and apache 2.4.35 security problem
by dl1025＠att.com 09 Oct '19

09 Oct '19

I recently upgraded to apache 2.4.35 and was having some issues with password file to secure xymon-seccgi. I got not get apache to read the password file. To get it to work I had to change from Require all granted to Require all denied. Now, it works. I get prompted to enter username and password. Here is the section from my httpd.conf file for your reference if you will run into similar problems. ScriptAlias /xymon-seccgi/ "/opt/app/workload/bbapp/bb/cgi-secure/" <Directory "/opt/app/workload/bbapp/bb/cgi-secure"> AllowOverride None Options ExecCGI Includes <IfModule mod_authz_core.c> # Apache 2.4+ Require all denied </IfModule> <IfModule !mod_authz_core.c> Order deny,allow Allow from all </IfModule> # Password file where users with access to these scripts are kept. # Although expected in $XYMONHOME/etc/ by the useradm and chpasswd # scripts, files here can be read with the "config" message type, # which allows status-privileged clients to read arbitrary regular files # from the directory. # # This file should be owned and readable only by the apache server user, # and ideally merely a symlink to a location outside of $XYMONHOME/etc/ # # Create it with: # htpasswd -c /opt/app/workload/bbapp/bb/server/etc/xymonpasswd USERNAME # chown apache:apache /opt/app/workload/bbapp/bb/server/etc/xymonpasswd # chmod 640 /opt/app/workload/bbapp/bb/server/etc/xymonpasswd # Add more users / change passwords with: "htpasswd /opt/app/workload/bbapp/bb/server/etc/xymonpasswd USERNAME" # # You can also use a group file to restrict admin access to members of a # group, instead of anyone who is logged in. In that case you must setup # the "xymongroups" file, and change the "Require" settings to require # a specific group membership. See the Apache docs for more details. AuthUserFile /opt/app/workload/bbapp/bb/server/etc/xymonpasswd AuthGroupFile /opt/app/workload/bbapp/bb/server/etc/xymongroups AuthType Basic AuthName "Xymon Administration" # "valid-user" restricts access to anyone who is logged in. Require valid-user # "group admins" restricts access to users who have logged in, AND # are members of the "admins" group in xymongroups. # Require group admins </Directory> I also enabled the following modules. LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authn_core_module modules/mod_authn_core.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule access_compat_module modules/mod_access_compat.so LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule reqtimeout_module modules/mod_reqtimeout.so LoadModule filter_module modules/mod_filter.so LoadModule mime_module modules/mod_mime.so LoadModule log_config_module modules/mod_log_config.so LoadModule env_module modules/mod_env.so LoadModule headers_module modules/mod_headers.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule version_module modules/mod_version.so LoadModule unixd_module modules/mod_unixd.so LoadModule status_module modules/mod_status.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule cgid_module modules/mod_cgid.so LoadModule dir_module modules/mod_dir.so LoadModule alias_module modules/mod_alias.so LoadModule rewrite_module modules/mod_rewrite.so

2 3

semaphore errors
by stef.coene＠docum.org 29 Apr '19

29 Apr '19

Hi, We are getting these errors on 2 xymon servers running 4.3.21 and 4.3.28. Any steps I can do to debug and/or prevent this error? The only solution is a restart of the xymon daemons. 2018-10-24 12:06:21.110407 semop failed, Invalid argument 2018-10-24 12:06:21.110456 Dropping message due to semaphore error ipcs ------ Message Queues -------- key msqid owner perms used-bytes messages ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x00000000 0 root 644 80 2 0x00000000 32769 root 644 16384 2 0x00000000 65538 root 644 280 2 0x01013343 2818051 xymon 600 10485760 2 0x02013343 2850820 xymon 600 10485760 2 0x03013343 2883589 xymon 600 10485760 2 0x04013343 2916358 xymon 600 10485760 2 0x05013343 2949127 xymon 600 262144 1 0x06013343 2981896 xymon 600 32768 1 0x07013343 3014665 xymon 600 10485760 2 0x08013343 3047434 xymon 600 10485760 2 0x09013343 3080203 xymon 600 131072 3 0xfa0101b9 1277964 root 666 30435368 2 0xfa0101bd 1310733 root 666 30435368 1 ------ Semaphore Arrays -------- key semid owner perms nsems 0x000000a7 98304 root 600 1 0x00000000 7995393 www-data 600 1 0x00000000 8028162 www-data 600 1 0x00000000 1769475 www-data 600 1 Stef

3 5

enhancement request: memory usage in real values
by stef.coene＠docum.org 07 Mar '19

07 Mar '19

Hi, We need an historic graph of the real values of Physical, Actual and Swap memory usage. But only the percent values are stored in the rrd files. Has someone already patched the sources to create rrd files with the real values? If so, can I have the patch :) Otherwise I have to brush up my C knowledge and do it myself. Stef

2 3

XymonPS error log handling
by tlwilliams4＠vcu.edu 04 Mar '19

04 Mar '19

Zak, I know you just worked on the Windows Event log handling. I have a few issues that may need some documentation guidance, or an enhancement. Basically, I'm trying to get Windows Defender log entries. We will be migrating from a commercial anti-virus platform to using the Defender and need to have alerting. Most important to me is that it appears that only the top-level logs listed in EventLogSummary can be parsed (example at end). As a test, I included the Windows PowerShell log in the clientconfig.cfg file. eventlogswanted:Windows PowerShell,system:7500:Warning,Critical,Error It took some experimentation with/without quotes as the code calls "Get-WinEvent -FilterXML $logFilterXML" and the QueryList uses -Path which states in Help file examples to use quotes if log file name has spaces. I found that the query creates double quotes as illustrated in excerpt below. <start Help file> -------------------------- EXAMPLE 11 -------------------------- PS C:\>Get-WinEvent -Path 'c:\ps-test\Windows PowerShell.evtx' This command gets events from a copy of the Windows PowerShell event log file in a test directory. The path is enclosed in quotation marks because the log name includes a space. <end help file> 2019-02-28 11:28:56 Processing event log Windows PowerShell 2019-02-28 11:28:56 Log filter <QueryList> <Query Id="0" Path="Windows PowerShell"> <Select Path="Windows PowerShell">*[System[TimeCreated[timediff(@SystemTime) <= 3600000] and (Level=3 or Level=1 or Level=2)]]</Select> </Query> </QueryList> My 2 issues: "-Path" parameter should be the actual path to log file per Help, but the QueryList appears to be using LogName format with name of log not path, is that correct? And actually, I am trying to get the entries in the Windows Defender log file which is at "%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx" by -Path or "Microsoft-Windows-Windows Defender/Operational" by -LogName. eventlogswanted:Windows PowerShell,system,Microsoft-Windows-Windows Defender/Operational:7500:Warning,Critical,Error I don't think the QueryList can handle the /Operational slash. The entry is ignored and no QueryList appears in log. Xymon can read the log; if I manually edit the $logenries I get the Defender entries in the client file. $logentries = @(get-winevent -logname "Microsoft-Windows-Windows Defender/Operational" -MaxEvents 50) I also have a question about the Max payload value ($maxpayloadlength) and how it is handled. Is that for the total of all the log files together, or per each log? If total, then a chatty log would prevent any entries in the other logs from being reported on? I would rather have most recent from each, and the value be 'per log'. Lastly as an aside, in the client data file there are two Event Log Summary sections that appear to be redundant. Is there a purpose for one vs. the other? We do have the Summary show under msgs column data. [EventlogSummary] Max(K) Retain OverflowAction Entries Log ------ ------ -------------- ------- --- 16,384 0 OverwriteAsNeeded 10,046 Application 20,480 0 OverwriteAsNeeded 0 HardwareEvents 512 7 OverwriteOlder 0 Internet Explorer 20,480 0 OverwriteAsNeeded 0 Key Management Service 15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience 16,384 0 OverwriteAsNeeded 10,183 Security 16,384 0 OverwriteAsNeeded 45,885 System 15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell [msgs:EventlogSummary] Max(K) Retain OverflowAction Entries Log ------ ------ -------------- ------- --- 16,384 0 OverwriteAsNeeded 10,046 Application 20,480 0 OverwriteAsNeeded 0 HardwareEvents 512 7 OverwriteOlder 0 Internet Explorer 20,480 0 OverwriteAsNeeded 0 Key Management Service 15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience 16,384 0 OverwriteAsNeeded 10,183 Security 16,384 0 OverwriteAsNeeded 45,885 System 15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell Thanks for your continuing support of a valuable tool! I'll keep playing with it, and post an update if I get a version working. Tim Williams VCU Computer Center

2 3

Need Hobbit client for an HP-UX 10.2 version ( Ancient/vintage software )
by Rick.Hershman＠CenturyLink.com 02 Mar '19

02 Mar '19

Does anyone know where I can locate a depot file or the executables for hobbit for an HP-UX 10.2 server ? Yes, this is like 20 years old..... It's not my fault we have these dinosaurs they want seen in Xymon.... Rick.Hershman at Centurylink.com Cell = 1 720 988 7452 Home = 1 321 802 3619 This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 1

Xymondash issues
by john.alexander＠preachain.org 27 Feb '19

27 Feb '19

Hi all, I am having some issues with the Xymondash interface. Everything works fine - it's properly displaying fault conditions, except that it will not acknowledge or disable alerts. I only get a pop-up saying "could not acknowledge test" xymon2json works just fine. I get good json output. xymon-ack gives nothing but a blank screen. Same with xymon-disable Acknowledging from the xymon "Acknowledge Alert" works fine. Here is my config.ini - I'm on CentOS 7 so python3 was installed as an addition. --------------------------------------------------------------- # location of xymon executable in your file system XYMONCLI="/home/xymon/server/bin/xymon" # location of ackinfo.sh executable in your file system XYMONACKINFOSH="/home/xymon/cgi-secure/ackinfo.sh" # absolute URL of Xymon's svcstatus XYMONSVCSTATUSURL="http://xymon.imasneezer.com/xymon-cgi/svcstatus" <--- should this be svcstatus.sh? # location of Xymon's critical.cfg in your file system (if you have one) CRITICAL="/home/xymon/server/etc/critical.cfg" # relative URL of svcstatus.sh on your monitoring server XYMONURL="/xymon-cgi/svcstatus.sh" # relative URL of xymon-ack on your monitoring server XYMONACKURL="/xymondash/cgi/xymon-ack" # relative URL of xymon-disable on your monitoring server XYMONDISURL="/xymondash/cgi/xymon-disable" # relative URL of xymon2json on your monitoring server XYMONJSONURL="/xymondash/cgi/xymon2json" # host name of xymon server XYMONSERVER="xymon.imasneezer.com" # website title TITLE="Oak Street Medical xymon dashboard" # path to python3 interpreter PYTHON3="/usr/bin/env /opt/rh/rh-python36/root/usr/bin/python3" --------------------- Any ideas? John Alexander

2 6

Windows PS xymonclient
by Paul.Root＠CenturyLink.com 27 Feb '19

27 Feb '19

So I only have 6 windows servers that I'm concerned with in my xymon installation. Today, I decided to upgrade the service. So I downloaded the v2.34 ps1 file. And I copied the file in place and restarted via the services window. This worked just fine on 4 machines. But on 2 machines, I get the ports test gone red because I'm looking for RDP, but I'm getting no output at all. Going into who, it is also blank. Processes and SVCS are both fine. So next I started the powershell as an administrator, and did the 'Set-ExecutablePolicy RemoteSigned" and then did a .\xymonclient.ps1 install. Then a stop and start. Still stays the same blank page. Does anyone have any ideas? Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

5 20

clientlog empty if host offline
by kspringer＠innovateteam.com 22 Feb '19

22 Feb '19

Why does the 'clientlog' data go blank if a host goes offline? If the host is offline shouldn't the last collection of clientlog data still be on the server for viewing? I've needed to look at that data numerous times to see if it contains clues as to why the client went offline, but the file on the server shows blank until the client comes back online and it sends another batch of data to the server. Is there a setting I could change to keep the clientlog data viewable even if the host is offline? -- Thanks, Kris Springer

1 0

[Patch] xymond_rrd crash when parsing Linux ifconfig data
by steve＠opendium.com 22 Feb '19

22 Feb '19

This patch addresses two problems: 1. For Linux clients, do_ifstat_rrd parses the ifconfig output using the regex: ([a-z0-9]+(_[0-9]+)?:*|lo:?)\s pickdata() is called like this: pickdata(bol, ifstat_linux_pcres[0], 1, &ifname) With a network interface name such as "foo1", the regex produces 2 results: 0: "foo1 " 1: "foo1" pickdata() discards result 0 and assigns result 1 ("foo1") to the ifname parameter as expected. With a network interface name such as "foo_1", the regex produces 3 results: 0: "foo_1 " 1: "foo_1" 2: "_1" pickdata() discards result 0, assigns result 1 ("foo_1") to the ifname parameter and then tries to assign result 2 ("_1") to the next parameter in the variable argument list. Since there it no such parameter, this results in a segmentation fault and xymond_rrd crashes. The attached patch adds a "num_args" parameter to pickdata() to tell it how many arguments are in the variable argument list and ensure it never rolls off the end of that list. 2. I have some clients with network interface names in the form "foo.5", "foo_bar" and "foo-bar" ("eth0.5" is especially common when eth0 is carrying an 802.1q trunk, for example). Xymon does not collect statistics on those network interfaces because they don't match the regex. This patch relaxes the regex a bit so that it matches these network interfaces. -- - Steve Hill Technical Director Opendium Online Safety / Web Filtering http://www.opendium.com Enquiries: sales at opendium.com +44-1792-824568 Support: support at opendium.com +44-1792-825748 Opendium Limited is a company registered in England and Wales. Company No. 5465437 Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.

2 1