March 2021 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 19 Jun '22

19 Jun '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 2

Terabithia or compile
by ralphmitchell＠gmail.com 16 Mar '22

16 Mar '22

I downloaded the source rpm and installed it. The spec file for building the RPMs contains this: %if %{without trunk} %if 0%{?rhel} <= 7 Requires: ntp %endif %endif So, yeah, it builds into the binary RPMs the requirement to pull in ntp. I'm not sure if that can be made into a conditional, to require ntp OR chrony. Ralph Mitchell On Thu, Jun 18, 2020 at 5:05 PM Root, Paul T via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: "Root, Paul T" <Paul.Root at centurylink.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: RE: [Xymon] Terabithia or compile > That's odd. I did not do that to me. > > -----Original Message----- > From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Thurston > Sent: Thursday, June 18, 2020 2:24 PM > To: xymon at xymon.com > Subject: Re: [Xymon] Terabithia or compile > > On 6/17/2020 4:38 PM, John Horne wrote: > > I used to build from source, but for our CentOS 7 and 8 servers I have > been > > using the Terabithia RPMs with no problems. The downside is that, like > Malcolm > > Hunter mentioned, I have subsequently applied some local patches - sent > to the > > list - so that meant rebuilding the RPMs. > > I'm now looking at the Terabithia package for the first time in years. > My first reaction is, wth? > > Installing the xymon package on my server has disabled chronyd and > installed (but not started) ntpd. why?! If I hadn't read through the > list of packages it was going to grab, and understand the significance > of this one, I'd be going blindly forward with an un-synchronized system > clock. > > Now I wonder how many other of my services it has disabled or replaced. > I feel like I've just walked into a mine field :( > > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Department of Administration > State of Alaska > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > > https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f… > This communication is the property of CenturyLink and may contain > confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. > > > > ---------- Forwarded message ---------- > From: "Root, Paul T via Xymon" <xymon at xymon.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: Re: [Xymon] Terabithia or compile > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

5 5

random errors with imaps/pop3s servers offering TLS 1.3
by lolo＠troll.free.org 10 Aug '21

10 Aug '21

Hi, I have found an issue when trying to monitor imaps and pop3s server offering TLS1.3 . My xymon server configuration: # freebsd-version -u 12.0-RELEASE-p5 # openssl version OpenSSL 1.1.1a-freebsd 20 Nov 2018 standard freebsd xymon-server pkg : # pkg info xymon-server-4.3.28 xymon-server-4.3.28 Name : xymon-server Version : 4.3.28 Installed on : Fri Feb 22 14:19:11 2019 CET Origin : net-mgmt/xymon-server Architecture : FreeBSD:12:amd64 Prefix : /usr/local Categories : net-mgmt www Licenses : GPLv2 Maintainer : feld at FreeBSD.org WWW : http://xymon.sourceforge.net/ Comment : System for monitoring servers and networks Options : DEBUG : off LDAP : off NETSNMP : off Shared Libs required: libcares.so.2 libpng16.so.16 libpcre.so.1 librrd.so.8 Annotations : FreeBSD_version: 1200086 cpe : cpe:2.3:a:xymon:xymon:4.3.28:::::freebsd12:x64 repo_type : binary repository : FreeBSD Flat size : 26.5MiB ... # ldd /usr/local/www/xymon/server/bin/xymonnet /usr/local/www/xymon/server/bin/xymonnet: libcares.so.2 => /usr/local/lib/libcares.so.2 (0x80027c000) libssl.so.111 => /usr/lib/libssl.so.111 (0x800297000) libcrypto.so.111 => /lib/libcrypto.so.111 (0x80032c000) libpcre.so.1 => /usr/local/lib/libpcre.so.1 (0x800619000) libc.so.7 => /lib/libc.so.7 (0x8006bd000) libthr.so.3 => /lib/libthr.so.3 (0x800ab0000) When trying to monitor a pop3s or imaps server offering tls 1.3, I got random errors: WARNING: Flapping status Service imaps on xxx is not OK : Unexpected service response If I monitor the same services on an other server not offering tls 1.3, all is fine. Both servers where running dovecot. I wrote an extension in perl using IO::Socket::SSL (and the same local openssl) to monitor the server offerng tls 1.3 and all is fine with it. For some strange reason, I can monitor a https web servers (running nginx or apache) offering TLS 1.3 without this issue but not imaps/pop3s. It looks like the https test is different from other ssl/tls tests and does not have the TLS 1.3 issue Regards, -- Laurent Frigault | Free.org - BookMyName.com - ONLINE SAS - Registar ID 74

2 1

ran Trimhistory and it broke something
by kspringer＠innovateteam.com 05 Apr '21

05 Apr '21

Per the instructions found at https://xymon.sourceforge.io/xymon/help/manpages/man8/trimhistory.8.html I ran the following command to trim my very old log history and ever since then I'm getting the following crash alert.? Also when reviewing history via the webpage I get results but the time stamps are wonky.? I suspect it's because of the program crashing. Anyone know how to fix? Trimhistory command I used: $ ./trimhistory --drop --dropsvcs --droplogs --cutoff=`date +%s --date="1 Jan 2019"` --progress Alert I'm receiving: > xymond_history purple [549922] > red - Program crashed > > Fatal signal caught! -- Kris Springer

3 5

Compiling Xymon.client on Centos7 arm (Pi4)
by josh＠imaginenetworksllc.com 31 Mar '21

31 Mar '21

I'm having issues getting it to compile. I'm hoping someone can point me in the right direction! [root at dns1 xymon-4.3.30]# make -s Checking for socklen_t Checking for snprintf Checking for vsnprintf Checking for rpc/rpcent.h Checking for sys/select.h Checking for u_int32_t typedef Checking for PATH_MAX definition Checking for SHUT_RD/WR/RDWR definitions Checking for strtoll() Checking for uname Checking for setenv config.h created holidays.c: In function printholidays : holidays.c:601:13: warning: unknown option after #pragma GCC diagnostic kind [-Wpragmas] #pragma GCC diagnostic ignored "-Wformat-truncation" ^ stackio.c: In function addtofnlist : stackio.c:385:11: warning: unknown option after #pragma GCC diagnostic kind [-Wpragmas] #pragma GCC diagnostic ignored "-Wformat-truncation" ^ suid.c: In function drop_root : suid.c:45:3: warning: implicit declaration of function abort [-Wimplicit-function-declaration] abort(); ^ suid.c:45:3: warning: incompatible implicit declaration of built-in function abort [enabled by default] suid.c: In function get_root : suid.c:54:3: warning: incompatible implicit declaration of built-in function abort [enabled by default] abort(); ^ timefunc.c: In function histlogtime : timefunc.c:398:10: warning: unknown option after #pragma GCC diagnostic kind [-Wpragmas] #pragma GCC diagnostic ignored "-Wformat-truncation" ^ /usr/bin/ld: cannot find -ltirpc collect2: error: ld returned 1 exit status make[1]: *** [../client/xymon] Error 1 make: *** [common-client] Error 2 Josh Luthman 24/7 Help Desk: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

3 3

problem with enadis function
by ruslan133＠yandex.ru 30 Mar '21

30 Mar '21

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20210330/fdc4da1d/attach…>

1 0

"Alerting:" not populated on web page
by john.thurston＠alaska.gov 25 Mar '21

25 Mar '21

I have entries defined in my alerts.cfg I have the [alert] task ENABLED in my tasks.cfg When I use 'xymond_alert --dump-config', the result appears as I expect. When I use 'xymond_alert --test . . .', it indicates a mail message will be sent (if I supply an appropriate combination of times, duration, color, and test). But the "Alerting:" section of the host's "info" web-page remains stubbornly empty, saying only "No alerts defined". I can't figure out why. Does anyone have ideas? This installation is running Xymon 4.3.30-1.el7.terabithia on CentOS 7 I have a similar, but older, installation running Xymon 4.3.28 on Solaris 10, where it displays as I expect. -- -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Department of Administration State of Alaska

3 3

[E] Re: Weird email alerts issue
by malcolm.r.hunter＠gmail.com 24 Mar '21

24 Mar '21

That's what I meant when I asked if one of the environment variables is not set. On Wed, 24 Mar 2021 at 11:29, Neal, Jonathan W via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: "Neal, Jonathan W" <wes.neal at verizon.com> > To: Clovis Otteson <clovis at ipost.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 24 Mar 2021 07:29:18 -0400 > Subject: Re: [E] Re: [Xymon] Weird email alerts issue > It does not, but I did figure out the issue this morning. Somehow when I > re-did all the rules I didn't even create an $sms-ems-oncall alias, so that > is why it was trying to message SERVICE=conn. Pretty sure it is working as > intended now. Thanks for the reply! > > On Tue, Mar 23, 2021 at 10:02 AM Clovis Otteson <clovis at ipost.com> wrote: > >> >> > ---------- Forwarded message ---------- >> > From: "Neal, Jonathan W" <wes.neal at verizon.com> >> > To: "xymon >> xymon at xymon.com" <xymon at xymon.com> >> > Cc: >> > Bcc: >> > Date: Mon, 22 Mar 2021 10:01:15 -0400 >> > Subject: Weird email alerts issue >> > Running Xymon 4.3.28, have been since release. I rebuilt my alerts.cfg >> > file from scratch and I have a weird issue with alerts I can't figure >> out. >> > >> > This seems to be happening on most if not all entries where I have a >> > SERVICE=conn. The only thing I really changed on all my entries was a >> new >> > mail alias for them, the actual rule itself is the same as before. >> > >> > Entry looks like this: >> > >> > HOST=$rcontrol >> > MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED >> > MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d >> > MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h >> > TIME=W:1300:2200 >> > MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d >> > >> > I get an alert, it emails the proper people tied to $rcontrolmail, but >> it >> > also tries to email SERVICE=conn . >> > >> > I can see them in the email log. >> > >> > Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) >> SERVICE=conn[1022] >> > 1616420829 300 >> > >> > Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725] >> > 1616417943 100 >> > >> > Anyone got an idea how to troubleshoot this or what might be causing it? >> > >> Does the value of $rcontrol or $sms-ems-oncall end with a comma? >> _______________________________________________ >> Xymon mailing list >> Xymon at xymon.com >> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.xymon.com_mailman… >> > > > -- > > <http://www.verizon.com> > > Wes Neal > Engineer IV Spec-Ntwk Eng&Ops > EMS Support > > O 8139871162 > wes.neal at verizon.com > > > > ---------- Forwarded message ---------- > From: "Neal, Jonathan W via Xymon" <xymon at xymon.com> > To: Clovis Otteson <clovis at ipost.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 24 Mar 2021 07:29:18 -0400 > Subject: Re: [Xymon] [E] Re: Weird email alerts issue > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

Weird email alerts issue
by clovis＠ipost.com 24 Mar '21

24 Mar '21

> ---------- Forwarded message ---------- > From: "Neal, Jonathan W" <wes.neal at verizon.com> > To: "xymon >> xymon at xymon.com" <xymon at xymon.com> > Cc: > Bcc: > Date: Mon, 22 Mar 2021 10:01:15 -0400 > Subject: Weird email alerts issue > Running Xymon 4.3.28, have been since release. I rebuilt my alerts.cfg > file from scratch and I have a weird issue with alerts I can't figure out. > > This seems to be happening on most if not all entries where I have a > SERVICE=conn. The only thing I really changed on all my entries was a new > mail alias for them, the actual rule itself is the same as before. > > Entry looks like this: > > HOST=$rcontrol > MAIL $rcontrolmail REPEAT=2h DURATION>10 RECOVERED > MAIL $rcontrolmail SERVICE=conn DURATION>10 REPEAT=2d > MAIL $rcontrolpage SERVICE=conn DURATION>10 REPEAT=1h > TIME=W:1300:2200 > MAIL $sms-ems-oncall SERVICE=conn DURATION>10 REPEAT=2d > > I get an alert, it emails the proper people tied to $rcontrolmail, but it > also tries to email SERVICE=conn . > > I can see them in the email log. > > Mon Mar 22 13:47:09 2021 host02.procs (159.98.104.166) SERVICE=conn[1022] > 1616420829 300 > > Mon Mar 22 12:59:03 2021 hostlan.disk (199.200.3.170) SERVICE=conn[725] > 1616417943 100 > > Anyone got an idea how to troubleshoot this or what might be causing it? > Does the value of $rcontrol or $sms-ems-oncall end with a comma?

2 1