September 2019 - Xymon - Xymon mailman web

DOWNTIME Parameter .default. + support?
by Scot.Kreienkamp＠la-z-boy.com 20 Sep '19

20 Sep '19

Does anyone know if downtime supports the + operator like noprop does, so any entry defined on a specific line would be in addition to any entry defined in the .default. line? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * Scot.Kreienkamp at la-z-boy.com www.la-z-boy.com<http://www.la-z-boy.com> | facebook.com/lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<http://twitter.com/lazboy> | youtube.com/lazboy<http://youtube.com/lazboy> [cid:4C-lzbVertical_9ddbc47c-2ac7-4ab5-9162-d7bc17d5d136.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 2

Xymon script for linux
by tlusty＠vse.cz 20 Sep '19

20 Sep '19

Hello, I have checked the presence of "ss" on SuSE Linux Enterprise Server 11. This system was release in 2009. And there is "ss" on such old system. As far as I remember, I started to use "ip" over 15 years ago. I haven't met any system without iproute2 package installed for last 10 years. You can make your own check to confirm this. Probably there is no need to make any additional logic for backup compatibility. Probably there are "ip", "SS", "routel" commands on all systems. BR, Zdenek Dne 20. 9. 2019 v 4:53 Jeremy Laidman napsal(a): > Would it be difficult to have the server-side linux parser look for > [ports] and if not found, then look for [ss]; and similarly, > [ifconfig] has [ip-addr] as its fallback (assuming "ip addr show" > gives similar output - probably doesn't, but you get the idea)? > > Minorly tangential, I think sar is more universally?available these > days than when the client scripts were first created. So I'm wondering > if we should make better use of sar, perhaps even have a [sar] section > of the client message, that is the first place that xymond goes when > looking for statistics. > > On Fri, 20 Sep 2019 at 00:52, Japheth Cleaver <cleaver at terabithia.org > <mailto:cleaver at terabithia.org>> wrote: > > On 9/18/2019 8:05 AM, Zden?k Tlust? wrote: > > Hello, > > > > the script xymonclient-linux.sh is using commands like ifconfig, > > netstat, etc. These commands are marked as depreciated and some > of the > > Linux distributions have removed them already. For example SuSE > Linux > > Enterprise Server 15 has no support for netstat and ifconfig. > > The replacement are commands from iproute2 package like ip, ss, > > routel, etc. > > Are there any plan to replace depreciated commands with new ones? > > > Especially with SS and IP, it's something that's on the road map. > Unfortunately, doing that in a backwards-compatible way will still > keeping the 'linux' OStype/class 'linux' might prove difficult > without a > lot more text processing. (This flag is split on the receiving > side for > parsing out what client evaluations to run and how, since the > output of > SunOS, Linux, BSDs, and other *nixes can vary widely.) > > One could either move current OS's to something like "linux-old", or > have upgraded scripts under "linux-new", or do a lot of 'awk' > calls in > xymonclient-linux.sh to try to duplicate previous output more > precisely. > I'm not sure which is better there. > > Regards, > -jc > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com <mailto:Xymon at xymon.com> > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

Graphing in Xymon
by Paul.Root＠CenturyLink.com 20 Sep '19

20 Sep '19

A couple hours later, and still no graph in xymon. Ssl_error_log yields: [Tue Sep 10 11:01:36 2019] [error] [client 10.139.63.193] Premature end of script headers: showgraph.sh, referer: https://xymon.corp.intranet/xymon-cgi/svcstatus.sh?HOST=nsmdenvp185&SERVICE… The manual graph is still getting more data in, using the exact same definitions as in graphs.cfg. From: Root, Paul T Sent: Tuesday, September 10, 2019 9:09 AM To: 'Jeremy Laidman' <jeremy at laidman.org> Cc: Japheth Cleaver <cleaver at terabithia.org>; Ralph Mitchell <ralphmitchell at gmail.com>; xymon at xymon.com Subject: RE: [Xymon] Graphing in Xymon Excellent, that?s probably the key. I?ve made the change, I?m guessing I need a new input before anything can work. rrdtool tune ConfigPulls.rrd -h NetAtoD:86400 -h NetEtoN:86400 -h NetOtoZ1to9:86400 -h Other:86400 -h InfraGen:86400 -h InfraSec:86400 <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE rrd SYSTEM "http://oss.oetiker.ch/rrdtool/rrdtool.dtd"> <rrd> <version> 0003 </version> <step> 300 </step>  <lastupdate> 1568123701 </lastupdate>  <ds> <name> NetAtoD </name> <type> GAUGE </type> <minimal_heartbeat> 86400 </minimal_heartbeat> <min> NaN </min> <max> NaN </max>  <last_ds> 167 </last_ds> <value> NaN </value> <unknown_sec> 1 </unknown_sec> </ds> Impatient as I am, I manually ran the script again, and then ran the rrdtool graph, and I got data points on the graph. So I should be close now. Thanks, Paul. From: Jeremy Laidman <jeremy at laidman.org<mailto:jeremy at laidman.org>> Sent: Tuesday, September 10, 2019 8:38 AM To: Root, Paul T <Paul.Root at CenturyLink.com<mailto:Paul.Root at CenturyLink.com>> Cc: Japheth Cleaver <cleaver at terabithia.org<mailto:cleaver at terabithia.org>>; Ralph Mitchell <ralphmitchell at gmail.com<mailto:ralphmitchell at gmail.com>>; xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] Graphing in Xymon "ds[NetAtoD].minimal_heartbeat = 600" Isn't the minimal_heartbeat setting for telling RRD to discard samples that exist on their own? I think the idea is that it doesn't make sense to calculate values from DERIVE or COUNTER inputs. From the man page for rrdcreate: <The "heartbeat" defines the maximum acceptable interval between samples/updates. If the interval between samples is less than "heartbeat", then an average rate is calculated and applied for that interval. If the interval between samples is longer than "heartbeat", then that entire interval is considered "unknown".> If you're sampling once per hour, then every sample will exceed the 600 second heartbeat. So you might need to re-create (or rrdtune) your RRD file and increase the mimimal_heartbeat value. And from the man page for rrdtune: <--heartbeat|-h ds-name:heartbeat modify the heartbeat of a data source. By setting this to a high value the RRD will accept things like one value per day.> J This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 8

can I put enadis into debug mode?
by cleaver＠terabithia.org 19 Sep '19

19 Sep '19

On Wed, September 11, 2019 8:38 am, Rothlisberger, John R. wrote: > We are having issues with acknowledge.sh & enadis.sh since upgrading to > 4.3.29 and then to 4.3.30 on Ubuntu 16.04. > > For enadis.sh we do get the following error in the apache log: > 2019-09-11 16:34:23.901080 Enadis POST that is not coming from self or > svcstatus (referer=https://xymonserver/xymon-seccgi/enadis.sh). Ignoring. > > How can we enable debugging on enadis and have that dump to a file? > > Unfortunately, it's not quite as easy as it used to be when we were using shell-based wrappers about the C programs. You can pass "--debug" as an option to the CGI_ENADIS_OPTS variable in /etc/xymon/cgioptions.cfg , however. If the error appears to be happening early in the CGI process (before headers are generated), you can also set CGIDEBUG=1 For the issue in question, it seems like the XSS checking is not working properly or the referer information is somehow being stripped. Are there any unusual CSP changes in your apache configuration, or do you have mod_security enabled by any chance? -jc

4 17

Libs check - lsof non-zero exit code
by sjcarr＠gmail.com 19 Sep '19

19 Sep '19

Hi, Recently installed xymon-client on a bunch of Ubuntu 18.04.3 LTS and after fixing the sudoers permissions I'm still left with a red libs check on all of them. Error is: Wed Sep 18 17:50:18 2019 - libs NOT ok /usr/bin/lsof -n -FpcLfn0 returned with non-zero exit code: 1 xymon-client package is version: 4.3.28-3build1 Any hints where to debug why the systems can't lsof properly? Thanks Steve

1 1

alerting on log messages
by colin.coe＠gmail.com 18 Sep '19

18 Sep '19

Hi all I have this entry in client-local.cfg --- [host=test_server_41] log:/var/log/messages:1024000 ignore "%(Failed to fetch|Failed to parse|Failed to evaluate)" trigger "%(ORA-04091|Failed to log off resource|Failed to log on resource)" --- And in analysis.cfg I have: --- HOST= test_server_41 LOG /var/log/messages %(ORA-04091|Failed to log off resource|Failed to log on resource) IGNORE=OCS color=red --- Needless to say I'm getting alerts for more than just "ORA-04091", "Failed to log off resource", and "Failed to log on resource". Any ideas what I'm doing wrong? Thanks

2 4

[PATCH] Config option for updated time comment in graphs
by john.horne＠plymouth.ac.uk 13 Sep '19

13 Sep '19

Hello, We are using the Terabithia 4.3.30 RPMs. It is hard-coded that Xymon will add a comment to graphs to indicate when the graph was last updated. It is seen at the bottom of the graph legend as (for example): Updated: 13-Sep-2019 17:14:00 This is something we do not want. (The graph itself will soon show if it is not being updated, and we have other monitoring in place to indicate if any services/processes have stopped.) Attached is a patch that adds a 'xymonserver.cfg' configuration file environment variable to indicate if the above comment should be added to graphs or not. By default it is set to true. It seems better, for us at least, to use a config option rather than having the graph comment hard-coded. The patch itself is just a couple of lines in showgraph.c, and a default value set in the environ.c file. The other (3) patches are again just one or two lines each updating the documentation files for the new variable. The patch has been tested by us, and works fine. Because of the location of the new call to xgetenv within the showgraph.c file, it means that any change to the config file for this variable takes immediate effect. No service restart required. Feel free to modify the patches as you wish, or to ignore them if it is not felt to be useful at all. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

1 0

can I put enadis into debug mode?
by john.r.rothlisberger＠accenture.com 11 Sep '19

11 Sep '19

We are having issues with acknowledge.sh & enadis.sh since upgrading to 4.3.29 and then to 4.3.30 on Ubuntu 16.04. For enadis.sh we do get the following error in the apache log: 2019-09-11 16:34:23.901080 Enadis POST that is not coming from self or svcstatus (referer=https://xymonserver/xymon-seccgi/enadis.sh). Ignoring. How can we enable debugging on enadis and have that dump to a file? Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

Log from z/VM client keeps alerting
by herald.ten.dam＠icu-it.nl 11 Sep '19

11 Sep '19

Hi, I'm setting up Xymon for z/VM. I have in z/VM a log file I send to Xymon. It comes in the clientlog and then I made a entry in Analysis.cfg for some alerting. The alerting shows up in the MSGS column. But the alerting stays all day long, it doesn't disappear after 6 cycles (which does on a Linux system). Must something extra be done for z/VM logging to get it work, or is it treated otherwise as other systems? Thanks in advance Met vriendelijke groet, Herald ten Dam Database Specialist Oracle, Medior z/VM ICU IT Services BV Transistorstraat 55b I 1322 CK ALMERE M 06 ? 28 891 653 I E herald.ten.dam at icu-it.nl<mailto:herald.ten.dam at icu-it.nl> T 088 ? 5 234 123 I www.icu-it.nl<https://mail.tonec.nl/owa/redir.aspx?C=VXsWzolNszaPfEV0NyI4hHlHi_HLsvmJPdc-…> I KvK 32135776

1 0

Graphing in Xymon
by Paul.Root＠CenturyLink.com 10 Sep '19

10 Sep '19

I've got a new test that I need to graph. It is a simple count of devices in multiple "networks". This test only runs once a day. I haven't done a graph in xymon in several years, and it's always a struggle. This is the input data: Net_AtoD: 5871 Net_EtoN: 5589 Net_OtoZ_1to9: 5242 Other: 386 InfraGen: 12 InfraSec: 25 The data comes in fine. And I get a good rrd file (all 6 networks are in there and look the same as this, except obviously the last_ds and value values: <ds> <name> NetAtoD </name> <type> GAUGE </type> <minimal_heartbeat> 600 </minimal_heartbeat> <min> NaN </min> <max> NaN </max>  <last_ds> 5871 </last_ds> <value> 5.8710000000e+04 </value> <unknown_sec> 267 </unknown_sec> </ds> I have multiple xymon servers, and I share most of the config with an include line in xymonserver.cfg: /etc/xymon/xymonserver-common.cfg:TEST2RRD+=",proc-mem-cfgmgrd=ncv,ucf=ncv,ConfigPulls=ncv" /etc/xymon/xymonserver-common.cfg:GRAPHS+=",vmwarevms,hpnasnaphost,ucf,ConfigPulls" /etc/xymon/xymonserver-common.cfg:NCV_ConfigPulls="*:GAUGE" I've restarted a few times. I put the graph config in its own file /etc/xymon/graph.d/ConfigPulls.cfg [ConfigPulls] TITLE NCM Config PUlls YAXIS Number of Devices DEF:NetAtoD=ConfigPulls.rrd:AtoD:AVERAGE DEF:NetEtoN=ConfigPulls.rrd:EtoN:AVERAGE DEF:NetOtoZ=ConfigPulls.rrd:OtoZ:AVERAGE DEF:Other=ConfigPUlls.rrd:Other:AVERAGE DEF:InfraGen=ConfigPUlls.rrd:InfraGen:AVERAGE DEF:InfraSec=ConfigPUlls.rrd:InfraSec:AVERAGE LINE2:AtoD#00FF00:Net A to D LINE2:EtoN#00CCCC:Net E to N LINE2:OtoZ#FFCC00:Net O to Z & 1 to 9 LINE2:Government#FF0000:Government LINE2:InfraGen#FFFF00:Infrastructure General LINE2:InfraSec#FFFFCC:Infrastructure Secure COMMENT:\n GPRINT:AtoD:LAST:Net A to D \: %5.1lf (cur) GPRINT:AtoD:MAX: \: %5.1lf (max) GPRINT:AtoD:MIN: \: %5.1lf (min) GPRINT:EtoN:AVERAGE: \: %5.1lf (avg)\n GPRINT:EtoN:LAST:Net E to N \: %5.1lf (cur) GPRINT:EtoN:MAX: \: %5.1lf (max) GPRINT:EtoN:MIN: \: %5.1lf (min) GPRINT:EtoN:AVERAGE: \: %5.1lf (avg)\n GPRINT:OtoZ:LAST:Net 0 to Z \: %5.1lf (cur) GPRINT:OtoZ:MAX: \: %5.1lf (max) GPRINT:OtoZ:MIN: \: %5.1lf (min) GPRINT:OtoZ:AVERAGE: \: %5.1lf (avg)\n GPRINT:Government:LAST:Government \: %5.1lf (cur) GPRINT:Government:MAX: \: %5.1lf (max) GPRINT:Government:MIN: \: %5.1lf (min) GPRINT:Government:AVERAGE: \: %5.1lf (avg)\n GPRINT:InfraGen:LAST:Infrastructure General \: %5.1lf (cur) GPRINT:InfraGen:MAX: \: %5.1lf (max) GPRINT:InfraGen:MIN: \: %5.1lf (min) GPRINT:InfraGen:AVERAGE: \: %5.1lf (avg)\n GPRINT:InfraSec:LAST:Infrastructure Secure \: %5.1lf (cur) GPRINT:InfraSec:MAX: \: %5.1lf (max) GPRINT:InfraSec:MIN: \: %5.1lf (min) GPRINT:InfraSec:AVERAGE: \: %5.1lf (avg)\n The graph doesn't show up, just a broken link in both the test and trends pages. Any help? Thanks, Paul. Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

5 20