January 2020 - Xymon - Xymon mailman web

Defining CLIENTOS on RPM and Debian distributions
by Andy.Farrior＠victoriacollege.edu 09 Jan '20

09 Jan '20

Greetings, I'm looking through the Debian and RPM Xymon-client distributions and I can't seem to find the best place to define CONFIGCLASS to match up with "[class=<expression>]" in client-local.cfg on the Xymon server. Or is it preferred to define CLASS:Classname in the hosts.cfg file? Both distributions set: CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles However with both distributions, clients show up as "fubar.linux linux" in clientlog on Xymon. I'm trying to figure out the best way to manage the client-local.cfg file for those distributions since the default log files are different: Debian/Ubuntu: $ egrep -v "^#|^$" /etc/rsyslog.d/50-default.conf auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog kern.* -/var/log/kern.log mail.* -/var/log/mail.log mail.err /var/log/mail.err *.emerg :omusrmsg:* RPM/RedHat: $ egrep -v "^#|^$" /etc/rsyslog.conf *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log local0,local1.* /var/log/localmessages local2,local3.* /var/log/localmessages local4,local5.* /var/log/localmessages local6,local7.* /var/log/localmessages I'm guessing it should go in: Debian: /etc/sysconfig/xymon-client RPM:/etc/sysconfig/xymon-client Here's where I've looked: Debian/Ubuntu: /etc/init.d/xymon-client:# Include xymon-client defaults if available /etc/init.d/xymon-client:if [ -f /etc/default/xymon-client ] ; then /etc/init.d/xymon-client: . /etc/default/xymon-client /etc/init.d/xymon-client:export XYMONSERVERS XYMONCLIENTHOME CLIENTHOSTNAME MACHINE MACHINEDOTS CLIENTOS ##### /etc/sysconfig/xymon-client does not have a reference to $SERVEROSTYPE. Only XYMONSERVERS,CLIENTHOSTNAME,CLIENTOS ##### /etc/xymon/xymonclient.cfg:include /etc/default/xymon-client /etc/xymon/xymonclient.cfg:include /var/run/xymon/bbdisp-runtime.cfg /etc/xymon/xymonclient.cfg:CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles /usr/lib/xymon/client/bin/xymonclient.sh:echo "client $MACHINE.$SERVEROSTYPE $CONFIGCLASS" >> $MSGTMPFILE RPM/RedHat: /usr/lib/systemd/system/xymonlaunch.service:EnvironmentFile=-/etc/default/xymonlaunch /usr/lib/systemd/system/xymonlaunch.service:EnvironmentFile=-/etc/sysconfig/xymonlaunch /usr/lib/systemd/system/xymonlaunch.service:ExecStart=/usr/bin/xymoncmd /usr/sbin/xymonlaunch --no-daemon $XYMONLAUNCHOPTS ##### /etc/sysconfig/xymon-client does not have a reference to $SERVEROSTYPE. Only XYMONSERVERS,CLIENTHOSTNAME,CLIENTOS ##### /etc/xymon-client/xymonclient.cfg:include /etc/sysconfig/xymon-client /etc/xymon-client/xymonclient.cfg:CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles Thx, Andy Andy Farrior Director of Technology Services Victoria College 2200 E Red River St Victoria, TX 77901-4494 e-mail: andy.farrior at victoriacollege.edu o) 361-582-2547

1 0

Monitoring if a remote IP is connected to particular local port
by jeremy＠laidman.org 09 Jan '20

09 Jan '20

Paul On Thu, 9 Jan 2020 at 08:04, Root, Paul T via Xymon <xymon at xymon.com> wrote: > > Hi, > > I?ve got an application that has a specific port open > 11001, that multiple connections, most looped back on itself. > > > > However, we have another server (that is another groups > machine, and isn?t monitored by Xymon), that connects to this port. > An interesting use case. > Reading the analysis.cfg man page, it looks like criteria > is either local or remote, not both. > I'm not sure I read it the same way. The format is "PORT criteria [MIN=mincount] ...etc" and what you're wanting to do is specify "criteria". The example in the man page for usage of "TEXT=" shows: PORT LOCAL=%[.:]22$ STATE=LISTEN "TEXT=SSH listener" So this is giving two criteria: LOCAL and STATE. This implies that the format is really "PORT criteria [...criteria] [MIN=mincount] ...etc" and thus you can chain multiple criteria. In your use case I would expect you to be able to use something like: PORT LOCAL=%[.:]10001 REMOTE=172.28.104.66:* STATE=ESTABLISHED Not sure if the wildcard is valid for REMOTE port number; perhaps use a regex here as well: PORT LOCAL=%[.:]10001 REMOTE=%172\.28\.104\.66:.* STATE=ESTABLISHED The analysis.cfg file distributed with the source code specifies this format: PORT [LOCAL=addr] [EXLOCAL=addr] [REMOTE=addr] [EXREMOTE=addr] [STATE=state] [EXSTATE=state] [MIN=mincount] [MAX=maxcount] [COLOR=color] [TRACK=id] [TEXT=displaytext] So I can see no problem specifying a local port *and *a remote IP address as you seem to require. > > > > Is there a way to monitor this situation? > > > > # netstat -ant |grep 11001 > > tcp 0 0 0.0.0.0:11001 0.0.0.0:* > LISTEN > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37852 ESTABLISHED > > > tcp 0 0 192.168.30.15:37852 192.168.30.15:11001 ESTABLISHED > > > tcp 0 0 192.168.30.15:37864 192.168.30.15:11001 ESTABLISHED > > > tcp 0 0 192.168.30.15:37856 192.168.30.15:11001 ESTABLISHED > > > *tcp 0 0 192.168.30.15:11001 > <http://192.168.30.15:11001> 172.28.104.66:39904 > <http://172.28.104.66:39904> ESTABLISHED* > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37862 ESTABLISHED > > > tcp 81 0 192.168.30.15:11001 204.155.140.230:53680 ESTABLISHED > > > *tcp 486 0 192.168.30.15:11001 > <http://192.168.30.15:11001> 172.28.104.66:39910 > <http://172.28.104.66:39910> ESTABLISHED* > > tcp 0 0 192.168.30.15:11001 204.155.140.230:53682 ESTABLISHED > > > tcp 0 0 192.168.30.15:11001 204.155.140.230:53679 ESTABLISHED > > > tcp 0 0 192.168.30.15:37862 192.168.30.15:11001 ESTABLISHED > > > tcp 34 0 192.168.30.15:11001 192.168.30.15:37864 ESTABLISHED > > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37856 > ESTABLISHED > > > > > > Paul Root > > Lead Operations Engineer - IT Managed Services > > 390 Commerce Dr > > Woodbury, Mn 55125 > > 651-312-5207 paul.root at centurylink.com > > > This communication is the property of CenturyLink and may contain > confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. > > >

2 1

Monitoring if a remote IP is connected to particular local port
by Paul.Root＠CenturyLink.com 08 Jan '20

08 Jan '20

Hi, I've got an application that has a specific port open 11001, that multiple connections, most looped back on itself. However, we have another server (that is another groups machine, and isn't monitored by Xymon), that connects to this port. Reading the analysis.cfg man page, it looks like criteria is either local or remote, not both. Is there a way to monitor this situation? # netstat -ant |grep 11001 tcp 0 0 0.0.0.0:11001 0.0.0.0:* LISTEN tcp 0 0 192.168.30.15:11001 192.168.30.15:37852 ESTABLISHED tcp 0 0 192.168.30.15:37852 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:37864 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:37856 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:11001 172.28.104.66:39904 ESTABLISHED tcp 0 0 192.168.30.15:11001 192.168.30.15:37862 ESTABLISHED tcp 81 0 192.168.30.15:11001 204.155.140.230:53680 ESTABLISHED tcp 486 0 192.168.30.15:11001 172.28.104.66:39910 ESTABLISHED tcp 0 0 192.168.30.15:11001 204.155.140.230:53682 ESTABLISHED tcp 0 0 192.168.30.15:11001 204.155.140.230:53679 ESTABLISHED tcp 0 0 192.168.30.15:37862 192.168.30.15:11001 ESTABLISHED tcp 34 0 192.168.30.15:11001 192.168.30.15:37864 ESTABLISHED tcp 0 0 192.168.30.15:11001 192.168.30.15:37856 ESTABLISHED Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

how to get ifstat graphs as a column button
by kspringer＠innovateteam.com 03 Jan '20

03 Jan '20

I'd like to get the 'ifstat' graphs to be a column button that I can click to go right to those graphs.? I tried adding 'ifstat' into my group column list in my hosts.cfg file but no column appeared.? I realize that it's not a default column, but if I could get it working it would save me a lot of clicks and scrolling. -- Kris Springer

2 1