July 2019 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

random errors with imaps/pop3s servers offering TLS 1.3
by lolo＠troll.free.org 10 Aug '21

10 Aug '21

Hi, I have found an issue when trying to monitor imaps and pop3s server offering TLS1.3 . My xymon server configuration: # freebsd-version -u 12.0-RELEASE-p5 # openssl version OpenSSL 1.1.1a-freebsd 20 Nov 2018 standard freebsd xymon-server pkg : # pkg info xymon-server-4.3.28 xymon-server-4.3.28 Name : xymon-server Version : 4.3.28 Installed on : Fri Feb 22 14:19:11 2019 CET Origin : net-mgmt/xymon-server Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : net-mgmt www Licenses : GPLv2 Maintainer : feld at FreeBSD.org WWW : http://xymon.sourceforge.net/ Comment : System for monitoring servers and networks Options : DEBUG : off LDAP : off NETSNMP : off Shared Libs required: libcares.so.2 libpng16.so.16 libpcre.so.1 librrd.so.8 Annotations : FreeBSD_version: 1200086 cpe : cpe:2.3:a:xymon:xymon:4.3.28:::::freebsd12:x64 repo_type : binary repository : FreeBSD Flat size : 26.5MiB ... # ldd /usr/local/www/xymon/server/bin/xymonnet /usr/local/www/xymon/server/bin/xymonnet: libcares.so.2 => /usr/local/lib/libcares.so.2 (0x80027c000) libssl.so.111 => /usr/lib/libssl.so.111 (0x800297000) libcrypto.so.111 => /lib/libcrypto.so.111 (0x80032c000) libpcre.so.1 => /usr/local/lib/libpcre.so.1 (0x800619000) libc.so.7 => /lib/libc.so.7 (0x8006bd000) libthr.so.3 => /lib/libthr.so.3 (0x800ab0000) When trying to monitor a pop3s or imaps server offering tls 1.3, I got random errors: WARNING: Flapping status Service imaps on xxx is not OK : Unexpected service response If I monitor the same services on an other server not offering tls 1.3, all is fine. Both servers where running dovecot. I wrote an extension in perl using IO::Socket::SSL (and the same local openssl) to monitor the server offerng tls 1.3 and all is fine with it. For some strange reason, I can monitor a https web servers (running nginx or apache) offering TLS 1.3 without this issue but not imaps/pop3s. It looks like the https test is different from other ssl/tls tests and does not have the TLS 1.3 issue Regards, -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

2 1

Devmon template for Cisco ISR4000
by colin.coe＠gmail.com 19 Dec '19

19 Dec '19

Hi Just wondering if anyone already has a Devmon template for the ISR4000 series that they'd be willing to share? Thanks

4 5

Xymon and apache 2.4.35 security problem
by dl1025＠att.com 09 Oct '19

09 Oct '19

I recently upgraded to apache 2.4.35 and was having some issues with password file to secure xymon-seccgi. I got not get apache to read the password file. To get it to work I had to change from Require all granted to Require all denied. Now, it works. I get prompted to enter username and password. Here is the section from my httpd.conf file for your reference if you will run into similar problems. ScriptAlias /xymon-seccgi/ "/opt/app/workload/bbapp/bb/cgi-secure/" <Directory "/opt/app/workload/bbapp/bb/cgi-secure"> AllowOverride None Options ExecCGI Includes <IfModule mod_authz_core.c> # Apache 2.4+ Require all denied </IfModule> <IfModule !mod_authz_core.c> Order deny,allow Allow from all </IfModule> # Password file where users with access to these scripts are kept. # Although expected in $XYMONHOME/etc/ by the useradm and chpasswd # scripts, files here can be read with the "config" message type, # which allows status-privileged clients to read arbitrary regular files # from the directory. # # This file should be owned and readable only by the apache server user, # and ideally merely a symlink to a location outside of $XYMONHOME/etc/ # # Create it with: # htpasswd -c /opt/app/workload/bbapp/bb/server/etc/xymonpasswd USERNAME # chown apache:apache /opt/app/workload/bbapp/bb/server/etc/xymonpasswd # chmod 640 /opt/app/workload/bbapp/bb/server/etc/xymonpasswd # Add more users / change passwords with: "htpasswd /opt/app/workload/bbapp/bb/server/etc/xymonpasswd USERNAME" # # You can also use a group file to restrict admin access to members of a # group, instead of anyone who is logged in. In that case you must setup # the "xymongroups" file, and change the "Require" settings to require # a specific group membership. See the Apache docs for more details. AuthUserFile /opt/app/workload/bbapp/bb/server/etc/xymonpasswd AuthGroupFile /opt/app/workload/bbapp/bb/server/etc/xymongroups AuthType Basic AuthName "Xymon Administration" # "valid-user" restricts access to anyone who is logged in. Require valid-user # "group admins" restricts access to users who have logged in, AND # are members of the "admins" group in xymongroups. # Require group admins </Directory> I also enabled the following modules. LoadModule authn_file_module modules/mod_authn_file.so LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authn_core_module modules/mod_authn_core.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule authz_core_module modules/mod_authz_core.so LoadModule access_compat_module modules/mod_access_compat.so LoadModule auth_basic_module modules/mod_auth_basic.so LoadModule reqtimeout_module modules/mod_reqtimeout.so LoadModule filter_module modules/mod_filter.so LoadModule mime_module modules/mod_mime.so LoadModule log_config_module modules/mod_log_config.so LoadModule env_module modules/mod_env.so LoadModule headers_module modules/mod_headers.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule version_module modules/mod_version.so LoadModule unixd_module modules/mod_unixd.so LoadModule status_module modules/mod_status.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule cgid_module modules/mod_cgid.so LoadModule dir_module modules/mod_dir.so LoadModule alias_module modules/mod_alias.so LoadModule rewrite_module modules/mod_rewrite.so

2 3

Xymon 4.3.29 Released - Important Security Update
by cleaver＠terabithia.org 13 Aug '19

13 Aug '19

Hello all, Xymon 4.3.29 has been released to Sourceforge and should be propagating to mirrors as I write this. Along with an assortment of bug fixes and compilation compatibility fixes for recent glibc systems, this version contains several fixes for security vulnerabilities within some CGI parsing. Although some of these overflows are not exploitable, others, including an XSS vulnerability are. Fixes beyond these CVEs have been made throughout the library, web, and network code to help reduce the likelihood of similar issues in other areas. As a result, all users are encouraged to upgrade. The specific CVEs in question are: ? CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, ? CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486 Henrik and I would like to extend our thanks to the University of Cambridge Computer Security Incident Response Team, which reported the issues and helped validate their resolution. Full release notes and other changes are available with the released tarball at https://sourceforge.net/projects/xymon/files/Xymon/4.3.29/ As always, thank you to everyone who has contributed patches, ideas, code, and feature requests to the project! Sincerely, Japheth "J.C." Cleaver

12 28

Frequent purple alerts
by tlwilliams4＠vcu.edu 01 Aug '19

01 Aug '19

In my xymonclient_config.xml file I specify the logs to be generated in C:\Logs <clientlogfile>c:\Logs\xymonclient.log</clientlogfile>. Yours may be in folder with script. Look at the xymonclient.log file which contains the transmission data. Look for the size of the Sent file. If your buffers are set too low on Xymon server, data file gets truncated, usually causing White, not purple. 2019-07-10 12:28:43.087 Sending to server 2019-07-10 12:28:43.087 Using "original" ASCII encoding 2019-07-10 12:28:43.087 Connecting to host 128.172.5.33 2019-07-10 12:28:43.103 Sent 54761 bytes to server 2019-07-10 12:28:43.309 Received 436 bytes from server Tim Williams On Wed, Jul 10, 2019 at 12:23 PM Jaime Kikpole via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Jaime Kikpole <jkikpole at cairodurham.org> > To: "Root, Paul T" <Paul.Root at centurylink.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 10 Jul 2019 12:21:42 -0400 > Subject: Re: Frequent purple alerts > On Wed, Jul 10, 2019 at 11:44 AM Root, Paul T <Paul.Root at centurylink.com> > wrote: > >> This could be the network is too congested. >> > > That seems unlikely. The Xymon server and clients are all on one of two > VM clusters, so there aren't a lot of "hops" and the bandwidth is very high. > > The Xymon client is one of two AD controllers, named dir1 and dir2. The > one with purple alerts is dir2. On dir1, we also have .1x authentication, > but they're otherwise pretty much the same. Their biggest difference is > RAM: 8GB for dir1 and 4GB for dir2. Do you think I should increase the > RAM? Other than leaving Task Manager open at all times and hoping to catch > it as soon as the purple alert occurs, I'm not sure how to check if it's > running out of RAM. > > > >> Or the computer is overloaded. Or even that it is sending messages that >> are too big (a frequent Windows problem in my experience – log files get so >> big). >> >> > Any way to check on the log size? > > > >> Does it go purple for 1 minute, 5 minutes, 30 minutes? >> > > I just looked at the log. The purple alert durations are roughly 40 > minutes each during the last three occasions. > > If it helps, this server is an Active Directory domain controller, but it > is one of two and the other one (a) has more stuff running on it, such as > .1x authentication for our wifi and (b) isn't having this issue. > > Thanks for the advice! > > > > > Jaime Kikpole > > Director of Technology & Innovations > Cairo-Durham Central School District > (518) 622-8543, x59500 > cairodurham.org <http://www.cairodurham.org> > > Technical Support: > help at cairodurham.org > go.cairodurham.org/techtips > > [image: Google Certified Educator, Level 1] [image: Google Certified > Educator, Level 2] > > > > This electronic message and any attachment(s) may contain confidential or > legally privileged information protected by law from further disclosure and > is intended only for the individual or entity identified above as the > addressee. If you are not the addressee (or the employee or agency > responsible to deliver it to the addressee), or if this message has been > addressed to you in error, you are hereby notified that you may not copy, > forward, disclose or use any part of this message or any attachment(s). > Please notify the sender immediately by return email or telephone and > permanently delete this message and attachment(s) from your system. > > > ---------- Forwarded message ---------- > From: Jaime Kikpole via Xymon <xymon at xymon.com> > To: "Root, Paul T" <Paul.Root at centurylink.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 10 Jul 2019 12:21:42 -0400 > Subject: Re: [Xymon] Frequent purple alerts > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

3 3

I need help troubleshooting a xymon issue
by david.hickenbottom＠Ingeniousmed.com 31 Jul '19

31 Jul '19

Hi, First of all Thank You! This is a fantastic product. I have two problems. The first is with regards to SSL monitoring. I have a group of 20 or so webservers. Half monitor the SSL certificate correctly, the others act like they do not see one. [cid:image001.png at 01D54776.1322ABD0] It looks good from every way I can look at it, but Xymon is not happy! Is there a way for me to see what is going on? This second problem, although not a big issue, some of our servers report back an extremely large client file - the active connections list is so long the complete file does not get ingested. I have tried changing the max lines parameter, but that had not made any difference. On some of them I changed to order of the report so the data that is typically after the ports section is ingested and the ports data is dropped off. Losing part of the ports data does not appear to cause a problem and I cannot tell by the current monitors I am even missing data. (it would be interesting to see how many connections - listening, established and waiting - are reported). Best regards, David Hickenbottom

3 4

rrd data capture and multiple tests with missing data
by dboldt＠usgs.gov 30 Jul '19

30 Jul '19

In a test defined to store 4 values for graphing I am unable to arrange for the storage of the available information if information for any variable is missing. In many runs of the test not all of the variables will have data. I've tried: * omitting the variables where there are no values * listing the variable without data * setting the value to NaN for missing data * setting the value to a number below the rrd "--minimum" for the variable In all of these cases no data is stored for the interval if any of the variables has no data. (Am using NCV parsing of the status.) I am able to store and graph the data for all 4 variables if I set missing values to zero, but this provides unsatisfactory looking graphs and incorrect averages. xymon version 4.3.28 on CentOS 7. -- David Boldt <dboldt at usgs.gov> "Anybody can sympathise with the sufferings of a friend, but it requires a very fine nature to sympathise with a friend's success." --Oscar Wilde (1854 - 1900)

1 0

holidays.cfg and "Black Friday"
by robert.herron＠gmail.com 26 Jul '19

26 Jul '19

We have the day after [US] Thanksgiving (aka Black Friday) off. I'm trying to add the day after to the holidays.cfg file but have a problem. Thanksgiving is always the 4th Thursday of the month. The day after varies depending on first day of the month. It's 5th Friday this year but was the 4th Friday last and next years. It's defined as "Day after Thanksgiving:type=+fri month=11 day=23" which works for this year. I haven't tried testing this for last or next years as I don't know how to. Is there a better way to do this? Also, could you please point me in the right direction to testing this. Thanks, --Robert

1 0

status of disabled alert shows Disabled by: unknown @
by Paul.Root＠CenturyLink.com 19 Jul '19

19 Jul '19

Do not EVER take a question off of the mailing list. The list is there to help. I am not, I'm just another user, sometimes I have some insight. Your issue is basic authentication in HTTP and not xymon. So you have a user in /etc/xymon/xymonpasswd and that user is in the admin group in /etc/xymon/xymongroups? Look in the http log files for the accounting when you click on the 'Apply' button. I should look something like this: 10.0.63.193 - - [19/Jul/2019:09:27:47 -0500] "GET /xymon-cgi/showgraph.sh?host=apaxymdev&service=xymond&graph_width=576&graph_height=120&disp=apaxymdev&nostale&color=yellow&graph_start=1563373667&graph_end=1563546467&graph=hourly&action=view HTTP/1.1" 200 20108 10.0.63.193 - - [19/Jul/2019:09:27:54 -0500] "GET /xymon-seccgi/enadis.sh HTTP/1.1" 401 381 10.0.63.193 - ptroot [19/Jul/2019:09:28:01 -0500] "GET /xymon-seccgi/enadis.sh HTTP/1.1" 200 69277 10.0.63.193 - - [19/Jul/2019:09:28:10 -0500] "GET /xymon-cgi/svcstatus.sh?HOST=apaxymdev&SERVICE=info HTTP/1.1" 200 37307 10.0.63.193 - ptroot [19/Jul/2019:09:28:28 -0500] "POST /xymon-seccgi/enadis.sh HTTP/1.1" 302 271 10.0.63.193 - - [19/Jul/2019:09:28:28 -0500] "GET /xymon-cgi/svcstatus.sh?HOST=apaxymdev&SERVICE=info HTTP/1.1" 200 38189 You can try commenting out the following: # AllowOverride None # Options ExecCGI Includes # <IfModule mod_authz_core.c> # # Apache 2.4+ # Require all granted # </IfModule> # <IfModule !mod_authz_core.c> # Order deny,allow # Allow from all # </IfModule> From: Chris Pretorius <chrisp at lightstoneauto.co.za> Sent: Friday, July 19, 2019 2:46 AM To: Root, Paul T <Paul.Root at CenturyLink.com> Subject: RE: status of disabled alert shows Disabled by: unknown @ Hi Paul Thank you for your response. Please find my answers to your question below. How are you disabling the alert? I click on info, scroll down to Disable alerts, select the test, add a cause and apply. Are you asked to login when you click on the disable or acknowledge pages? No, I do have to log on when I open our xymon page. How is your xymon-seccgi secured in your xymon config in apache? Should be /etc/httpd/conf.d/xymon.conf httpd-2.4.6-80.el7.centos.1.x86_64 xymon-seccgi section from apache xymon.conf (xymon-4.3.28-1.el7.x86_64 - Terabithia repo) ScriptAlias /xymon-seccgi/ "/usr/share/xymon/cgi-secure/" <Directory "/usr/share/xymon/cgi-secure"> AllowOverride None Options ExecCGI Includes <IfModule mod_authz_core.c> # Apache 2.4+ Require all granted </IfModule> <IfModule !mod_authz_core.c> Order deny,allow Allow from all </IfModule> AuthUserFile /etc/xymon/xymonpasswd AuthGroupFile /etc/xymon/xymongroups AuthType Basic AuthName "Xymon Administration" Require valid-user Require group admins </Directory> Kind regards From: Root, Paul T <Paul.Root at CenturyLink.com<mailto:Paul.Root at CenturyLink.com>> Sent: Thursday, 18 July 2019 15:36 To: Chris Pretorius <chrisp at lightstoneauto.co.za<mailto:chrisp at lightstoneauto.co.za>>; xymon at xymon.com<mailto:xymon at xymon.com> Subject: RE: status of disabled alert shows Disabled by: unknown @ How are you disabling the alert? Are you asked to login when you click on the disable or acknowledge pages? I know when I disable via the command line, I get unknown, but using the webpage, it always ask requires How is your xymon-seccgi secured in your xymon config in apache? Should be /etc/httpd/conf.d/xymon.conf From: Xymon <xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>> On Behalf Of Chris Pretorius Sent: Thursday, July 18, 2019 4:59 AM To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] status of disabled alert shows Disabled by: unknown @ Good day I am using the Terabithia repo for my Xymon instance. All is working great an so far no major issues. Only problem I am struggling with is when I disable a alert the status show - Disabled until OK Disabled by: unknown @ 172.33.255.1 Reason: investigating Where do I need to change to display the name of the authenticated user @ source ip. Authentication is handled by apache basic authentication. Kind regards This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments. This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 2