March 2020 - Xymon - Xymon mailman web

msgs add-on from wiki.xymonton.org - multiple dynamic logfile monitoring
by christian.becker＠rhein-zeitung.net 18 Mar '20

18 Mar '20

Hello together, first of all I hope my english is good enough to explain..... -And- of course- I hope you are OK in these times! I took msgs.sh (https://wiki.xymonton.org/doku.php/monitors:msgs) from wiki.xymonton.org. This works for me as described. For one new server, for our purposes we need to have more than one logfile configured. The thing is, that all of these additional logfiles have a dynamic name which contains date-stamps in their name, for example /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD1_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD2_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD3_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD4_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD5_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD6_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD7_20200318_050109.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD8_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD9_20200318_050109.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORDA_20200318_050110.log /adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORDB_20200318_050109.log But that's not my problem, all of the wanted logfiles appear in the normal msgs column, after I configured them in client-local.cfg. [cid:image001.png at 01D5FD41.D7AC1BE0] Now for msgs.sh, I added a tag to the corresponding host in hosts.cfg like MSGS:/adsuite/AdSuite/runtime/log/AdSuite.OrderServer_ORD:msgsalfa The result is, that in column msgsalfa only the first logfile is being displayed in a normal readable way, the other logfiles contain html-code around them: [cid:image002.png at 01D5FD41.D7AC1BE0] At this point I'm not sure if I made a mistake at any step or if the msgs.sh needs some adjustment? Can somebody body point me to any solution here? Best regards from my home office in Germany - and stay healthy! Christian

1 0

How to use CLASS in alerts.cfg
by glauber.ribeiro＠experian.com 11 Mar '20

11 Mar '20

Hello, Xymon f(r)iends! It's been too long. I'm trying to configure a new setup of xymon server 4.3.30, and I planned to use "CLASS" to group alerts. So I have stuff like this in hosts.cfg (notice I'm using both CLASS and NAME) (IP addresses and host names changed to protect the guilty): ------------------- 1.2.3.4 server1.domain.com # noconn NAME:USAEA1PWBUAS036 CLASS:apache ssh https://urldefense.com/v3/__http://1.2.3.4/healthcheck.txt__;!!MfzFaTml5A!x…<https://urldefense.com/v3/__http:/1.2.3.4/healthcheck.txt__;!!MfzFaTml5A!xO…> 1.2.3.5 server2.domain.com # noconn NAME:USAEA1PAPUAS035 CLASS:resin ssh https://urldefense.com/v3/__http://1.2.3.5:8888__;!!MfzFaTml5A!xO0EWP8P5epy…<https://urldefense.com/v3/__http:/1.2.3.5:8888__;!!MfzFaTml5A!xO0EWP8P5epy-…> ------------------- The class shows up correctly on the info page (at the bottom, under "Other tags"). It also works correctly for filtering in the "enable/disable" (enadis) page. But I haven't figured out how to use it in alerts.cfg. I tried: CLASS=apache MAIL yadayada HOST=%.* CLASS=apache MAIL yadayada HOST=%.* MAIL yadayada CLASS=apache Nothing seems to work. Is there something I need to do to enable class in alerts? Or am I getting the syntax wrong? Is this a bug? When I say it doesn't seem to work, I mean that I don't see the alert in the "info" page for that host if I try to select by class. Another detail: I am using include files in hosts.cfg. For example: group Apache include /opt/xymon/server/etc/hosts.d/apache.cfg Any ideas are welcome. Thanks, g

1 0

How to use CLASS in alerts.cfg
by glauber.ribeiro＠experian.com 11 Mar '20

11 Mar '20

Hello, Xymon f(r)iends! It?s been too long. I'm trying to configure a new setup of xymon server 4.3.30, and I planned to use "CLASS" to group alerts. So I have stuff like this in hosts.cfg (notice I'm using both CLASS and NAME) (IP addresses and host names changed to protect the guilty): ------------------- 1.2.3.4 server1.domain.com # noconn NAME:USAEA1PWBUAS036 CLASS:apache ssh http://1.2.3.4/healthcheck.txt 1.2.3.5 server2.domain.com # noconn NAME:USAEA1PAPUAS035 CLASS:resin ssh http://1.2.3.5:8888 ------------------- The class shows up correctly on the info page (at the bottom, under "Other tags"). It also works correctly for filtering in the "enable/disable" (enadis) page. But I haven't figured out how to use it in alerts.cfg. I tried: CLASS=apache MAIL yadayada HOST=%.* CLASS=apache MAIL yadayada HOST=%.* MAIL yadayada CLASS=apache Nothing seems to work. Is there something I need to do to enable class in alerts? Or am I getting the syntax wrong? Is this a bug? When I say it doesn't seem to work, I mean that I don't see the alert in the "info" page for that host if I try to select by class. Another detail: I am using include files in hosts.cfg. For example: group Apache include /opt/xymon/server/etc/hosts.d/apache.cfg Any ideas are welcome. Thanks, g

1 0

PSClient install script
by support＠ionetworkadmin.com 09 Mar '20

09 Mar '20

Hi, has someone created a single script or executable that end users can easily run that will install the client without me having to manually sit at each workstation and download and run all the commands by hand.? Probably easiest would be a zip file that contains an 'install.bat' that performs the following functions. 1. Create new xymon folder in C:\Program Files\ 2. Extract preconfigured Xymon PSClient xml, ps1, and nssm files from zip and save them in the new C:\Program Files\xymon\ folder while making sure that Windows hasn't blocked them. 3. Install the client by running the following PS commands with Admin privileges.? I've attempted a single script for this but can't get it to work. ??? Set-ExecutionPolicy RemoteSigned ??? cd 'C:\Program Files\xymon\' ??? .\xymonclient.ps1 install ??? .\xymonclient.ps1 start -- Thank You, Kris Springer

3 2

scvstatus gives error on version 30, but not on version 28
by herald.ten.dam＠icu-it.nl 05 Mar '20

05 Mar '20

Hi, I recently upgraded from version 28 to version 30. Everything works except some Trends pages. These trend pages include a lot of grapics coming from rrd directories with more than 750 rrd's in it. Directories with around 200 work and give no error. I made a strace with version 30 and gives this for the error: stat("./guests,VMSERVP.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./fcp_read,SLD544A_5C50.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./vnicin,SLD531A_VSR1BHH.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./vnicout,SLD516A_VSR1ADAT.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./disk,SFS,VMSYS,XCHANGE.rrd", {st_mode=S_IFREG|0755, st_size=38624, ...}) = 0 stat("./fcp_read,SLD550A_5C51.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./fcp_write,SLD538A_5C50.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./guests,WAVEWRKS.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 getdents(3, /* 0 entries */, 32768) = 0 close(3) = 0 brk(0x1ea3d000) = 0x1ea3d000 brk(0x1ea3b000) = 0x1ea3b000 open("/dev/tty", O_RDWR|O_NOCTTY|O_NONBLOCK) = 3 writev(3, [{iov_base="*** Error in `", iov_len=14}, {iov_base="/home/xymon/server/bin/svcstatus"..., iov_len=36}, {iov_base="': ", iov_len=3}, {iov_base="corrupted size vs. prev_size", iov_len=28}, {iov_base=": 0x", iov_len=4}, {iov_base="000000001ea10fe0", iov_len=16}, {iov_base=" ***\n", iov_len=5}], 7*** Error in `/home/xymon/server/bin/svcstatus.cgi': corrupted size vs. prev_size: 0x000000001ea10fe0 *** ) = 106 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x3ff8bdf5000 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0 getpid() = 37079 gettid() = 37079 tgkill(37079, 37079, SIGABRT) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=37079, si_uid=1000} --- +++ killed by SIGABRT (core dumped) +++ Aborted (core dumped) version 28 gives the next part (not completely): stat("./fcp_read,SLD544A_5C50.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./vnicin,SLD531A_VSR1BHH.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./vnicout,SLD516A_VSR1ADAT.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./disk,SFS,VMSYS,XCHANGE.rrd", {st_mode=S_IFREG|0755, st_size=38624, ...}) = 0 stat("./fcp_read,SLD550A_5C51.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./fcp_write,SLD538A_5C50.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 stat("./guests,WAVEWRKS.rrd", {st_mode=S_IFREG|0755, st_size=19640, ...}) = 0 getdents(3, /* 0 entries */, 32768) = 0 close(3) = 0 brk(0x1b843000) = 0x1b843000 fstat(1, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0 openat(AT_FDCWD, "/home/xymon/server/web/trends_header", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0755, st_size=1079, ...}) = 0 read(3, "<!DOCTYPE HTML>\n<HTML>\n<HEAD>\n<T"..., 1079) = 1079 close(3) = 0 openat(AT_FDCWD, "/home/xymon/server/etc/xymonmenu.cfg", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0755, st_size=4251, ...}) = 0 read(3, "<div id=\"menue\">\n <div class="..., 4096) = 4096 read(3, " <a class=\"inner\" href=\"$XY"..., 4096) = 155 read(3, "", 4096) = 0 close(3) I'm no c programmer, so can someone look into this error? Regards, Herald ten Dam Database Specialist Oracle, Medior z/VM ICU IT Services BV Transistorstraat 55b I 1322 CK ALMERE M 06 ? 28 891 653 I E herald.ten.dam at icu-it.nl<mailto:herald.ten.dam at icu-it.nl> T 088 ? 5 234 123 I www.icu-it.nl<https://mail.tonec.nl/owa/redir.aspx?C=VXsWzolNszaPfEV0NyI4hHlHi_HLsvmJPdc-…> I KvK 32135776

1 0

[External] xymond.chk fields
by john.r.rothlisberger＠accenture.com 04 Mar '20

04 Mar '20

I looked through the code and found what I was looking for. ? Thanks, John -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Rothlisberger, John R. via Xymon Sent: Tuesday, March 3, 2020 10:29 AM To: 'xymon >> xymon at xymon.com' <xymon at xymon.com> Subject: Re: [Xymon] [External] xymond.chk fields _______________________________________________ Xymon mailing list Xymon at xymon.com https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman… ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

monitoring websites behind cloudflare?
by mgoebel＠emich.edu 03 Mar '20

03 Mar '20

Hello, We are running xymon 4.3.29 on sles 12 and trying to monitor a website that is behind cloudflare but I cannot find a find a combo of https flags in hosts.cfg that will connect to cloudflare. Has anyone else had this issue and come up with a solution? I have literally tried every reasonable combo... "Unspecified SSL error in SSL_con"..., 153Unspecified SSL error in SSL_connect to https (47873/tcp) on host 104.18.5.68: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure Thanks, Matt -- Matthew Goebel : goebel at emunix.emich.edu : Unix Jockey @ EMU : Hail Eris Neo-Student, Net Lurker, Donut consumer, and procrastinating medher... "Always with the negative waves, Moriarty" - Oddball "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer

2 2

timediff/clock settings
by rstyson＠vcu.edu 03 Mar '20

03 Mar '20

We want to receive alerts from the timediff and clock tests, but are running into problems getting them to do so. Right now, we've only experimented with timediff. We've searched for information, but could only find a few sparse references. According to what we've found, we should be able to enter the following in the analysis.cfg file and receive alerts: HOST=Server (or PAGE=page name, if doing a whole page) TIMEDIFF 15 red (for windows) or CLOCK 15 red (for linux) For the windows server we were testing on, we tried: HOST=Server TIMEDIFF 15 red HOST=Server timediff 15 red HOST=Server Timediff 15 red HOST=Server TIMEDIFF 15 COLOR=red HOST=Server TIMEDIFF CLOCK 15 red All with no results. We haven't tried CLOCK on a Linux system yet. Could someone make a recommendation, or point us to some documentation for this?

1 0

[External] [Xymon] xymond.chk fields
by john.r.rothlisberger＠accenture.com 03 Mar '20

03 Mar '20

Does anyone know what each field is within the xymond.chk file? Some are obvious, some not so obvious. Thanks, John -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Rothlisberger, John R. via Xymon Sent: Friday, February 28, 2020 9:14 AM To: 'xymon >> xymon at xymon.com' <xymon at xymon.com> Subject: [External] [Xymon] xymond.chk fields This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments. _______________________________________________ Xymon mailing list Xymon at xymon.com https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman… ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

imaps status show "unexpected service response"
by lolo＠troll.free.org 02 Mar '20

02 Mar '20

On Sat, Feb 29, 2020 at 05:54:55PM +0100, Uffe R. B. Andersen via Xymon wrote: > Date: Sat, 29 Feb 2020 17:54:55 +0100 > From: "Uffe R. B. Andersen" <urb at twe.net> > To: xymon at xymon.com > Subject: imaps status show "unexpected service response" > Reply-To: urb at twe.net > Organization: Andersen|nu > User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 > Thunderbird/68.5.0 > > Hi list > > I recently upgraded my mail server to FreeBSD 12.1 to support TLSv1.3. > Since then I have had issues with the smtps and imaps monitoring in > Xymon. I have found a thread describing exactly the same issue on the > "debian-bugs-dist" list: > > https://www.mail-archive.com/debian-bugs-dist at lists.debian.org/msg1684022.html > > No ones seems to have found a fix, though. > > Anyone here knows how to to fix or work around this issue? Read this thread for a work around : https://lists.xymon.com/pipermail/xymon/2019-November/046893.html > The staus for imaps is flapping between OK and "Unexpected service > response", while the status for smtps is failing persistently. -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

1 0