April 2020 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 19 Jun '22

19 Jun '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 2

random errors with imaps/pop3s servers offering TLS 1.3
by lolo＠troll.free.org 10 Aug '21

10 Aug '21

Hi, I have found an issue when trying to monitor imaps and pop3s server offering TLS1.3 . My xymon server configuration: # freebsd-version -u 12.0-RELEASE-p5 # openssl version OpenSSL 1.1.1a-freebsd 20 Nov 2018 standard freebsd xymon-server pkg : # pkg info xymon-server-4.3.28 xymon-server-4.3.28 Name : xymon-server Version : 4.3.28 Installed on : Fri Feb 22 14:19:11 2019 CET Origin : net-mgmt/xymon-server Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : net-mgmt www Licenses : GPLv2 Maintainer : feld at FreeBSD.org WWW : http://xymon.sourceforge.net/ Comment : System for monitoring servers and networks Options : DEBUG : off LDAP : off NETSNMP : off Shared Libs required: libcares.so.2 libpng16.so.16 libpcre.so.1 librrd.so.8 Annotations : FreeBSD_version: 1200086 cpe : cpe:2.3:a:xymon:xymon:4.3.28:::::freebsd12:x64 repo_type : binary repository : FreeBSD Flat size : 26.5MiB ... # ldd /usr/local/www/xymon/server/bin/xymonnet /usr/local/www/xymon/server/bin/xymonnet: libcares.so.2 => /usr/local/lib/libcares.so.2 (0x80027c000) libssl.so.111 => /usr/lib/libssl.so.111 (0x800297000) libcrypto.so.111 => /lib/libcrypto.so.111 (0x80032c000) libpcre.so.1 => /usr/local/lib/libpcre.so.1 (0x800619000) libc.so.7 => /lib/libc.so.7 (0x8006bd000) libthr.so.3 => /lib/libthr.so.3 (0x800ab0000) When trying to monitor a pop3s or imaps server offering tls 1.3, I got random errors: WARNING: Flapping status Service imaps on xxx is not OK : Unexpected service response If I monitor the same services on an other server not offering tls 1.3, all is fine. Both servers where running dovecot. I wrote an extension in perl using IO::Socket::SSL (and the same local openssl) to monitor the server offerng tls 1.3 and all is fine with it. For some strange reason, I can monitor a https web servers (running nginx or apache) offering TLS 1.3 without this issue but not imaps/pop3s. It looks like the https test is different from other ssl/tls tests and does not have the TLS 1.3 issue Regards, -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

2 1

Xymon 4.3.30 Released
by cleaver＠terabithia.org 18 Aug '20

18 Aug '20

Xymon 4.3.30 has been released and is now available for download. 4.3.30 is mostly a bug-fix release, quashing issues stemming from the security fixes in 4.3.29, including improperly-tight restrictions on allowed characters in hostname for browsing along with several other parsing errors. Thanks in particular to Tom Schmidt for his assistance in tracking these down. Xymon should also now be more easily buildable on older GCC versions without the diagnostics pragma available. Xymon 4.3.30 is available from the Xymon SourceForge page at https://sourceforge.net/projects/xymon/ As always, thank you to all who have contributed code, ideas, and features to the project! Regards, Japheth "J.C." Cleaver

5 9

2 Xymon the second have some data not send to it
by diffusion＠bulot-fr.com 22 May '20

22 May '20

Hello, I have 2 xymon server 1st one (xymon01=172.16.2.108) : all clients send data do it (*toto* + *titi*) 2nd one (back01=172.16.1.198) : only few clients (only with name like *toto*) send data to it For exemple back01 https://back01/xymon-cgi/confreport.sh i see all hosts (titi02 for exemple) that only send data to xymon01 only ===> how is it possible ? client toto04 : grep "^XYMONSERVERS" /etc/default/xymon-client XYMONSERVERS="172.16.2.108 172.16.1.198" client titi02: grep "^XYMONSERVERS" /etc/default/xymon-client XYMONSERVERS="172.16.2.108" I do grep -r titi02 /etc/xymon /usr/lib/xymon /var/lib/xymon on back01, but nothing is reporting -- Greg

2 3

Limiting items in rrd graphs
by john.r.rothlisberger＠accenture.com 30 Apr '20

30 Apr '20

Does anyone know how to limit how many items are placed into a single rrd graph? Ex. Graphs for ifstat can have (what appears to be) 6 different interfaces and the lines can get obscured behind other lines if the data is similar. How could I limit how many interfaces end up in a single graph? Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

Xymon Digest, Vol 111, Issue 17
by xymon＠vollink.com 28 Apr '20

28 Apr '20

> > ---------- Forwarded message ---------- > From: Adam Goryachev <mailinglists at websitemanagers.com.au> > On 27/4/20 05:06, Gary Allen Vollink wrote: > > Hi all, > > I have a configuration which uses RAID meta-devices set up as raid1 over > empty slots for GUI configuration and notification. As such, I have md0 > and md1 showing up as fatal errors in Xymon. Again, this setup is standard > for this installation. md2 + are all normal normal, valid (and actually > hold mounted filesystems). > > I'd normally expect to be able to set up analysis.cfg to "something > something IGNORE" for this machine. Like: > > HOST=vault.home.vollink.com > RAID md0 IGNORE > RAID md1 IGNORE > > Does such a thing exist (and I missed it/have the syntax wrong?) If not, > /could/ such a thing exist? > > I'm starting to become used to just having a RED screen (and that is > dangerous). > > If the answer to the above is all, 'no,' then what is the best way to > ignore all RAID for that machine? > > Thank you much for any thoughts, > Gary > > You will need to share a your /proc/mdstat and/or a pointer to which ext > script you are using to monitor your md RAID. I suspect that your RAID > arrays are defined as a two member RAID1 with one missing member, > therefore, they would be expected to show as red, because they are failed. > > You could either define the RAID arrays as RAID1 with only one member, or > else define them as RAID0 with only one member. > > Or, you could add the spare drives as spares, or simply not define them as > RAID arrays until you actually need to use them. > > Regards, > Adam > Thank you for responding. I'm going to guess that the answer to my actual question - is there a way to ignore individual md failures - is "I don't know". To be clear: "I don't know" is acceptable, I read through source-code looking for a way, and I couldn't find one (and so-many bits are auto-loaded that it's super hard to be sure enough to say "no"). I was hoping someone on-list would actually know, but I get why that might not be the case. To the questions: ============================ /proc/mdstat =========================== Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4] md2 : active raid5 sda5[0] sdc5[2] sdb5[1] 11711382912 blocks super 1.2 level 5, 64k chunk, algorithm 2 [3/3] [UUU] md1 : active raid1 sda2[0] sdb2[1] sdc2[2] 2097088 blocks [6/3] [UUU___] md0 : active raid1 sda1[0] sdb1[1] sdc1[2] 2490176 blocks [6/3] [UUU___] unused devices: <none> ============================ /proc/mdstat =========================== I'm using the script here: http://www.it-eckert.com/blog/2015/agent-less-monitoring-with-xymon/ (xymon-rclient.sh). Specifically, the platform is Synology and yes, Synology runs two raid1 arrays over all of the slots (even though some are empty). I could fix this easily by adding hard drives into the empty slots, but I specifically bought this unit so that I could expand it later. That is, I both understand that this is properly showing broken but unmounted RAIDs and I know why those RAIDs are broken (and thus why the errors are nominal in my setup). I am still hoping that a failure state that is nominal would be something I'd be able to ignore (just as I can ignore specific libraries or individual filesystems). The other choice for me is to entirely remove the mdstat portion of Ekert's script. (Sadly, there is nothing else for Synology monitoring that I can get to work at all, and that simple script otherwise covers all of what I need). This means, I won't be notified (through Xymon) if one of my drives does fail, but it's better than getting used to ignoring a RED background. [Archive readers: It is okay to contact me directly with questions about my setup] Thank you, Gary Allen Vollink

2 1

Ignore RAID error?
by xymon＠vollink.com 27 Apr '20

27 Apr '20

Hi all, I have a configuration which uses RAID meta-devices set up as raid1 over empty slots for GUI configuration and notification. As such, I have md0 and md1 showing up as fatal errors in Xymon. Again, this setup is standard for this installation. md2 + are all normal normal, valid (and actually hold mounted filesystems). I'd normally expect to be able to set up analysis.cfg to "something something IGNORE" for this machine. Like: HOST=vault.home.vollink.com RAID md0 IGNORE RAID md1 IGNORE Does such a thing exist (and I missed it/have the syntax wrong?) If not, /could/ such a thing exist? I'm starting to become used to just having a RED screen (and that is dangerous). If the answer to the above is all, 'no,' then what is the best way to ignore all RAID for that machine? Thank you much for any thoughts, Gary

2 1

History page does not match events and hist files
by rbaker＠paciolan.com 25 Apr '20

25 Apr '20

Hello, I'm a recent migrant from BB to Xymon and things have been fairly smooth. Recently, I've noticed that the history page no longer is showing entries correctly. Or really, at all for that matter. I'd copied history from BB over to Xymon in the correct directory and adjusted permissions as needed. Xymon seems to have no issue with reading and writing to the files. As an example, This is from the recent events on the main page >Sat Apr 25 13:14:22 2020 ca01appmgr21vm svcs red >From -> To This is from the server's histlog file. > cat Sat_Apr_25_13:14:22_2020 > green Sat Apr 25 13:14:19 PDT 2020 Services OK > > &green ManageEngine Applications Manager - Running > Status unchanged in 0.00 minutes > Message received from 172.31.100.21 > Client data ID 1586327155 This is from the server's hist file. > Sat Nov 30 13:50:51 2019 red 1575150651 904 > Sat Nov 30 14:05:55 2019 green 1575151555 2484740 > Sun Dec 29 08:18:15 2019 red 1577636295 11157 > Sun Dec 29 11:24:12 2019 green 1577647452 2343124 > Sat Jan 25 14:16:16 2020 red 1579990576 2578 > Sat Jan 25 14:59:14 2020 green 1579993154 37802 > Sun Jan 26 01:29:16 2020 red 1580030956 3004 > Sun Jan 26 02:19:20 2020 green 1580033960 100201 > Mon Jan 27 06:09:21 2020 red 1580134161 301 > Mon Jan 27 06:14:22 2020 green 1580134462 2875353 > Sat Feb 29 12:56:55 2020 red 1583009815 3279 > Sat Feb 29 13:51:34 2020 green 1583013094 2209312 > Thu Mar 26 04:33:26 2020 red 1585222406 301 > Thu Mar 26 04:38:27 2020 green 1585222707 205241 > Sat Mar 28 13:39:08 2020 red 1585427948 581 > Sat Mar 28 13:48:49 2020 green 1585428529 > Sat Apr 4 09:27:22 2020 1586017642 188529 > Mon Apr 6 13:49:31 2020 green 1586206171 1638085 > Sat Apr 25 12:50:56 2020 red 1587844256 1406 The server is running on CentOS Linux release 7.7.1908 (Core) and I'm currently using Xymon 4.3.30-1.el7.terabithia, although I'm open to trying a recompile from source directly if this may be a bug with that particular RPM release. A screenshot example can be found on https://puu.sh/FCrDQ.png as I'm unsure whether the mailing list accepts attachments. I've also posted on the sourceforge discussion board as well. https://sourceforge.net/p/xymon/discussion/435278/thread/3479b2301a/?limit=… If there are any tips or permission issues that could be the underlying cause, please advise.

1 0

Http monitoring
by Jean.Hyppolite＠umm.edu 24 Apr '20

24 Apr '20

Hello, We are getting this error I inserted below. This http monitor in question is for the xymon http service itself for our xymon server. Where would xymon be picking up this configuration of http from. Everything seems to be running and functioning properly. Could you provide insight? HTTP/1.1 301 Moved Permanently Thanks Jean This e-mail and any accompanying attachments may be privileged, confidential, contain protected health information about an identified patient or be otherwise protected from disclosure. State and federal law protect the confidentiality of this information. If the reader of this message is not the intended recipient; you are prohibited from using, disclosing, reproducing or distributing this information; you should immediately notify the sender by telephone or e-mail and delete this e-mail.

2 1