November 2020 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 23 May '22

23 May '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 1

Terabithia or compile
by ralphmitchell＠gmail.com 16 Mar '22

16 Mar '22

I downloaded the source rpm and installed it. The spec file for building the RPMs contains this: %if %{without trunk} %if 0%{?rhel} <= 7 Requires: ntp %endif %endif So, yeah, it builds into the binary RPMs the requirement to pull in ntp. I'm not sure if that can be made into a conditional, to require ntp OR chrony. Ralph Mitchell On Thu, Jun 18, 2020 at 5:05 PM Root, Paul T via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: "Root, Paul T" <Paul.Root at centurylink.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: RE: [Xymon] Terabithia or compile > That's odd. I did not do that to me. > > -----Original Message----- > From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Thurston > Sent: Thursday, June 18, 2020 2:24 PM > To: xymon at xymon.com > Subject: Re: [Xymon] Terabithia or compile > > On 6/17/2020 4:38 PM, John Horne wrote: > > I used to build from source, but for our CentOS 7 and 8 servers I have > been > > using the Terabithia RPMs with no problems. The downside is that, like > Malcolm > > Hunter mentioned, I have subsequently applied some local patches - sent > to the > > list - so that meant rebuilding the RPMs. > > I'm now looking at the Terabithia package for the first time in years. > My first reaction is, wth? > > Installing the xymon package on my server has disabled chronyd and > installed (but not started) ntpd. why?! If I hadn't read through the > list of packages it was going to grab, and understand the significance > of this one, I'd be going blindly forward with an un-synchronized system > clock. > > Now I wonder how many other of my services it has disabled or replaced. > I feel like I've just walked into a mine field :( > > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Department of Administration > State of Alaska > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > > https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f… > This communication is the property of CenturyLink and may contain > confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. > > > > ---------- Forwarded message ---------- > From: "Root, Paul T via Xymon" <xymon at xymon.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: Re: [Xymon] Terabithia or compile > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

5 5

random errors with imaps/pop3s servers offering TLS 1.3
by lolo＠troll.free.org 10 Aug '21

10 Aug '21

Hi, I have found an issue when trying to monitor imaps and pop3s server offering TLS1.3 . My xymon server configuration: # freebsd-version -u 12.0-RELEASE-p5 # openssl version OpenSSL 1.1.1a-freebsd 20 Nov 2018 standard freebsd xymon-server pkg : # pkg info xymon-server-4.3.28 xymon-server-4.3.28 Name : xymon-server Version : 4.3.28 Installed on : Fri Feb 22 14:19:11 2019 CET Origin : net-mgmt/xymon-server Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : net-mgmt www Licenses : GPLv2 Maintainer : feld at FreeBSD.org WWW : http://xymon.sourceforge.net/ Comment : System for monitoring servers and networks Options : DEBUG : off LDAP : off NETSNMP : off Shared Libs required: libcares.so.2 libpng16.so.16 libpcre.so.1 librrd.so.8 Annotations : FreeBSD_version: 1200086 cpe : cpe:2.3:a:xymon:xymon:4.3.28:::::freebsd12:x64 repo_type : binary repository : FreeBSD Flat size : 26.5MiB ... # ldd /usr/local/www/xymon/server/bin/xymonnet /usr/local/www/xymon/server/bin/xymonnet: libcares.so.2 => /usr/local/lib/libcares.so.2 (0x80027c000) libssl.so.111 => /usr/lib/libssl.so.111 (0x800297000) libcrypto.so.111 => /lib/libcrypto.so.111 (0x80032c000) libpcre.so.1 => /usr/local/lib/libpcre.so.1 (0x800619000) libc.so.7 => /lib/libc.so.7 (0x8006bd000) libthr.so.3 => /lib/libthr.so.3 (0x800ab0000) When trying to monitor a pop3s or imaps server offering tls 1.3, I got random errors: WARNING: Flapping status Service imaps on xxx is not OK : Unexpected service response If I monitor the same services on an other server not offering tls 1.3, all is fine. Both servers where running dovecot. I wrote an extension in perl using IO::Socket::SSL (and the same local openssl) to monitor the server offerng tls 1.3 and all is fine with it. For some strange reason, I can monitor a https web servers (running nginx or apache) offering TLS 1.3 without this issue but not imaps/pop3s. It looks like the https test is different from other ssl/tls tests and does not have the TLS 1.3 issue Regards, -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

2 1

Licensing
by emohammed＠FlexiVan.com 26 Feb '21

26 Feb '21

Hi, Is Xymon a licensed software or Open source ? [cid:FlexiVanLogo_45deb83e-dda0-4034-ac40-31a4568e8246.png]<https://www.flexivan.com/> Ehtesham Mohammed Cloud Architect 7320 E. Butherus Dr, Ste 201 Scottsdale, AZ 85260 (o) | (m) emohammed at FlexiVan.com<mailto:emohammed at FlexiVan.com> Confidentiality Notice: The information contained in this email and any attachments may contain confidential and/or proprietary material and is intended solely for the person or entity to which it is addressed. Any unauthorized review disclosure or distribution of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of this email and any attachments.

3 3

Clearing ACK user credentials in the user interface (UI)
by jeremy＠laidman.org 30 Nov '20

30 Nov '20

Didds Firstly, make sure that your webserver is actually requiring authentication when accessing the ack page. This could be by inspecting the headers in "Developer Tools" (Ctrl+Shift-I in Firefox, Chrome and Edge) or by reviewing the webserver log for the authenticated user field. Or you could temporarily change the password or remove the account from xymonpasswd to see if that fails to authenticate. In Edge and Chrome you can selectively review and delete cached credentials by going into Settings -> (Autofill / Profiles) -> Passwords, or entering edge://settings/passwords or chrome://settings/passwords into the location bar. In Firefox it's about:logins, or go to Options -> Privacy & Security -> Logins and Passwords. It's possible that changing the password on the webserver (in xymonpasswd) will force the browser to prompt you for the password, and also clear the cached entry. You can then change the password back again on the server. But I'm not confident - it might just continue to try the old cached entry. Just a thought: are you running a password manager such as Lastpass or Bitwarden? These utilities might be automagically entering the credentials for you. Lastpass has an "autofill" option that can be set/cleared for each username/password, and if set, this might be authenticating you automagically. Cheers Jeremy On Mon, 30 Nov 2020 at 21:28, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > Date: Mon, 30 Nov 2020 10:08:03 +0000 (UTC) > Subject: Clearing ACK user credentials in the user interface (UI) > We have several hobbit servers running in different environments (4.3.28) > > In order to ack or enable and disable alerts we have (of course) an > account created within hobbit > > i.e. htpasswd -c /etc/xymon/server/etc/xymonpasswd <user> > > Across multi > ple different web browsers (IE, Edge, FF, Chrome, opera etc) over time > I've used these credentials and theyve somehow/somewhere been cached. But > here's the wierd thing - I cant clear them! eg if I use shit+ctrl+delete > for all time and everything, or firefox.exe -p for a clean profile, in a > browser with no proxies and reopened after clwearing etc... an attempt to > ack goes straight to the ack page and doesnt prompt me for the UI account > credentials? This must be browser/OS based rather than hobbit/xymon > itself of course but its driving me nuts? > > Anyone able to put me out of my siery and advise how i can make sure I > clear this stuff so ic an test correctly etc ? > > cheers > > didds >

1 0

Bug - duplicate RRD data with same timestamp different data
by marco.avvisano＠regione.toscana.it 20 Nov '20

20 Nov '20

Hi, I have a script that creates and updates rrd files following with following command: ?$line = "[TipoDocVers,$tipo_doc.rrd]"; Among the rrd files created by the script were two similarly named? (TipoDocVers,allegato. rrd ;TipoDocVers,Allegato.rrd), but only one was updated While debugging, I realized that the error message was due to the fact that the names of the two files were treated equally, without considering upper and lower case characters These are the error messages from the rrd-data.log file 2020-11-20 11:55:10.896536 ENTE/TipoDocVers,Allegato.rrd: Bug - duplicate RRD data with same timestamp 1605869710, different data 14336 2020-11-20 11:55:10.896592 Val 0: Seq 152739: 1605869710:788682 14336 2020-11-20 11:55:10.896603 NewVal: Seq 152740: 1605869710:479451 Marco

1 0

Xymon, graph but without xymonserver (NCV) definition graph
by diffusion＠bulot-fr.com 13 Nov '20

13 Nov '20

Hello, I have to monitor lot's of haproxy backend (in multiple servers) The trouble for is that backend aren't the same name, because name is the Web domaine for each client. for exemple on serveur01 : FO_DomaineMydomainecomSessCur: 294 FO_DomaineOtherDomainecomSessCur: 249 FO_DomaineTheDomainecomSessCur: 942 on serveur02 : FO_DomaineTotocomSessCur: 924 FO_DomaineTiticomSessCur: 429 FO_DomaineTatacomSessCur: 494 on serveurXX: XX..... And the same with for each Domaine, Serveurs FO_XXXXXXXXsessRate: YYYY I read https://xymon.sourceforge.io/xymon/help/howtograph.html (More advanced: Sending a "trends" message) it need "to setup a definition for generating the graphs in the graphs.cfg " I'm not understanding howto push that * in body of $XYMON $BBDISP "statuts XXXXX ...." ? * in other word than 'status' ? * what else Xymon server side does somethings like that is enough ? (implied no need ncv definition ?) : [haproxySess] FNPATTERN haproxysess,(.*).rrd TITLE [backend stats] YAXIS value -l 0 DEF:p at RRDIDX@=@RRDFN@:lambda:AVERAGE LINE1:p at RRDIDX@#@COLOR@:@RRDPARAM@ GPRINT:p at RRDIDX@:LAST: \: %2.3lf (cur) GPRINT:p at RRDIDX@:MAX: \: %2.3lf (max) GPRINT:p at RRDIDX@:MIN: \: %2.3lf (min) GPRINT:p at RRDIDX@:AVERAGE: \: %2.3lf (avg xymon)\n -- Mail non conforme ? la netiquette (https://fr.wikipedia.org/wiki/Netiquette) Cordialement, Gr?gory Bulot Coaxis Hosting 0825 82 82 57

1 0

Devmon SNMP data not updating in Xymon after Perl Update
by slbeardall＠gmail.com 09 Nov '20

09 Nov '20

Hello, I recently noticed after an update to my Perl package on Ubuntu 18.04 (i686, Kernel 4.15.0-122-generic, Summary of my perl5 (revision 5 version 26 subversion 1) on Oct. 30th that my Xymon monitor no longer receives data from Devmon. I ran a hello test for Perl and it worked, checked Devmon to make sure it wasn't receiving any errors, and restarted the Xymon process with no luck. Tried setting up a new Ubuntu 20.04 and CentOS 8 VM and installing everything from scratch. Installed Xymon successfully using apt on Ubuntu, but could not compile Xymon 4.3.30 on CentOS or Ubuntu. Was still not receiving SNMP information from Devmon to Xymon, however Devmon tests were successful.

1 0

snapshot.sh and report.sh problem
by heiko.wuest＠gmail.com 08 Nov '20

08 Nov '20

Hi, i did a fresh instal of xymon on Centos8 with the rpm's provided (Xymon 4.3.30-1.el8.terabithia) it looks like evrything is working as expected but two reports doesn't run if i click on Snapshot or Availability Report the the browser downloads a file called snapshot.sh or report.sh which has some content in: xymonrep-3128-1604871819 Content-type: text/html <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html"> <TITLE>Xymon - Snapshot Report</TITLE> ........ any idea? Propably some stupid thing i miss? -- Heiko

1 0