March 2022 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 23 May '22

23 May '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 1

Terebithia RPM's vs Build.
by Neil.Simmonds＠studio.co.uk 30 Mar '22

30 Mar '22

Hi all, Can anyone tell me what the difference is for Xymon Server between compiling from source and installing the Terabithia RPM's? Also, I noticed there seems to be at least rrd-devel packages that are outside of the main Repos for RHEL 8, are there any other considerations of that nature for RHEL 8.5? I'm looking at building a new Xymon server as our current one is CentOS 5.6 and Xymon 4.3.4 so a bit ancient and very overdue a rebuild to more modern versions. I'd like to build with RHEL 8.5 and Xymon 4.3.30 and I'd like to build using the Terebithia RPM's but I know I'm going to get questions from our Cyber team regarding the differences and any nonstandard Repo's I need so I'd like to be prepared with some answers. Also, I'd just like to check that Xymon is still being developed? I notice 4.3.30 seems to be 2.5 years old and while I remember some talk about Version 5, I haven't seen any news on that yet. Kind Regards, Neil. Neil Simmonds Senior Platform & Middleware Engineer (Unix). Studio is a trading name of Studio Retail Ltd which is authorised and regulated by the Financial Conduct Authority for consumer credit and general insurance. Studio Retail Ltd are members of the Finance and Leasing Association (FLA). Registered in England. No: 718151. Registered Office: Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Ltd and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Ltd reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error, please notify our careline on +44(0) 371 200 0378.

2 1

Feature request
by stef.coene＠docum.org 23 Mar '22

23 Mar '22

Hi, It should be very handy if there is an hosts-options.cfg file that can be used to specify device specific options that normally goes in the hosts.cfg file. Has anyone started on a patch to separate the page layout and the possible options per device? Is this something that other people can use as well? Some examples: - Monitor the ssh daemon on all Linux devices: CLASS=Linux sshd - Monitor the https website on the load balancers (name start with lb): HOST=%^lb https://<BBHOSTNAME> -> <BBHOSTNAME> will be replaced per device by the device name Stef

2 2

xymond crashing
by jeremy＠laidman.org 22 Mar '22

22 Mar '22

Assigning a value to a variable seems quite benign. Perhaps the memory for seltmo hasn't been allocated? Have you taken a look at the xymond.log file around the time of the coredumps? The xymond process has quite a bit of debugging info available, if run with the "--debug" option. But, yes, an upgrade might be your simplest solution. The code in the xymond.c file appears to have been greatly re-written since then. In v4.3.5, the "redback" library called using rbreadlist() was completely replaced by Henrik's own tree management code. The Changelog file for 4.3.5 shows some info about xymond crashing in 4.3.4: * Fix crashes in xymond caused by faulty new library for storing cookies and host-information. * Fix memory corruption/crash in xymond caused by logging of multi-source statuses. (I think the "cookies" mentioned here are "ack" cookies used to tie an ack to an event) The "storing ... host-information" possibly supports the correlation with the use of include files for hosts.cfg. So even an upgrade to 4.3.5 might fix your problem. Cheers Jeremy On Tue, 22 Mar 2022 at 20:00, Neil Simmonds <neilsimmonds1808 at gmail.com> wrote: > Hi Jeremy, > > We're using Xymon 4.3.4 (Yes, I know, there are plans to build a new one ) > and we built it from source. > > It's been running fine for years but we've been getting these CoreDumps > now for a few months. > > I've looked at the code and this is the section with line 5024 (i've made > line 5024 itself bold) > > /* > * Do the select() with a static 2 second timeout. > * This is long enough that we will suspend activity for > * some time if there's nothing to do, but short enough for > * us to attend to the housekeeping stuff without undue delay. > */ > *seltmo.tv_sec = 2; seltmo.tv_usec = 0;* > n = select(maxfd+1, &fdread, &fdwrite, NULL, &seltmo); > if (n <= 0) { > if ((errno == EINTR) || (n == 0)) { > /* Interrupted or a timeout happened */ > continue; > } > else { > errprintf("Fatal error in select: %s\n", strerror(errno)); > break; > } > } > > IThe only thing I can think that might be an influence is that around the > time that the coredumps started, we started using include files with the > hosts.cfg file. > > Kind regards, > Neil. > > On Mon, Mar 21, 2022 at 10:15 PM Jeremy Laidman <jeremy at laidman.org> > wrote: > >> Hi Neil >> >> I don't know if I can help you much to diagnose. Can you share the >> version of Xymon that you're using, and whether you're building from source >> or installing a package? I suppose the place to start would be to see >> what's happening in xymond.c at line 5024. >> >> J >> >> On Sat, 19 Mar 2022 at 00:36, Neil Simmonds <neilsimmonds1808 at gmail.com> >> wrote: >> >>> Hi all, We're getting a weird issue where the xymond process is crashing >>> every couple of days. If you're actually viewing Xymon at the time is only >>> seems to affect the critical page and within 10 minutes it restarts and all >>> is back to normal but we get a core dump. Has anyone ever seen an issue >>> like this? I've gone through our critical.cfg file and given it a visual >>> once over but it's a bit difficult checking a file with 7638 lines. >>> >>> The dump file doesn't give us much help as far as I can see >>> >>> Core was generated by `xymond --pidfile=/var/log/xymon/xymond.pid >>> --restart=/xymon/server/tmp/xymond.c'. >>> >>> Program terminated with signal 6, Aborted. >>> >>> #0 0x0000003c0ce30265 in raise () from /lib64/libc.so.6 >>> >>> #0 0x0000003c0ce30265 in raise () from /lib64/libc.so.6 >>> >>> #1 0x0000003c0ce31d10 in abort () from /lib64/libc.so.6 >>> >>> #2 0x0000000000419353 in sigsegv_handler (signum=<value optimized out>) >>> at sig.c:57 >>> >>> #3 <signal handler called> >>> >>> #4 0x000000000041efd2 in rb_successor () >>> >>> #5 0x000000000041f5f2 in rb_readlist () >>> >>> #6 0x000000000041e7c7 in rbreadlist () >>> >>> #7 0x000000000040ece2 in main (argc=1647522333, argv=<value optimized >>> out>) at xymond.c:5024 >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >>

1 0

xymond crashing
by neilsimmonds1808＠gmail.com 21 Mar '22

21 Mar '22

Hi all, We're getting a weird issue where the xymond process is crashing every couple of days. If you're actually viewing Xymon at the time is only seems to affect the critical page and within 10 minutes it restarts and all is back to normal but we get a core dump. Has anyone ever seen an issue like this? I've gone through our critical.cfg file and given it a visual once over but it's a bit difficult checking a file with 7638 lines. The dump file doesn't give us much help as far as I can see Core was generated by `xymond --pidfile=/var/log/xymon/xymond.pid --restart=/xymon/server/tmp/xymond.c'. Program terminated with signal 6, Aborted. #0 0x0000003c0ce30265 in raise () from /lib64/libc.so.6 #0 0x0000003c0ce30265 in raise () from /lib64/libc.so.6 #1 0x0000003c0ce31d10 in abort () from /lib64/libc.so.6 #2 0x0000000000419353 in sigsegv_handler (signum=<value optimized out>) at sig.c:57 #3 <signal handler called> #4 0x000000000041efd2 in rb_successor () #5 0x000000000041f5f2 in rb_readlist () #6 0x000000000041e7c7 in rbreadlist () #7 0x000000000040ece2 in main (argc=1647522333, argv=<value optimized out>) at xymond.c:5024

2 1

Mailing list
by neilsimmonds1808＠gmail.com 18 Mar '22

18 Mar '22

I am currently signed up to the mailing lists with a gmail address which my company have now blocked. I?m trying to sign up with my work address but when I click ?subscribe? on https://lists.xymon.com/mailman/listinfo/xymon it goes to https://lists.xymon.com/mailman/subscribe/xymon which gives a 404 error. I also can't change my Email through the online form as that also fails and if I email the mailman at xymon.com email address listed I get an undeliverable. Does anyone know how I can change my registered email address?

2 1

setting up a acknowledgement account
by jeremy.ruffer＠gmail.com 16 Mar '22

16 Mar '22

Hi Ian, When I was using an earlier version of Apache I was able to use auth_ntlm but that was not available on Apache 2.4. I now use mod_authnz_pam and Require valid-user and I'm sorted. HTH Jeremy ------ Original Message ------ From: "Ian Diddams via Xymon" <xymon at xymon.com> To: "xymon" <xymon at xymon.com> Sent: 16/03/2022 15:28:26 Subject: [Xymon] setting up a acknowledgement account >_______________________________________________ >Xymon mailing list >Xymon at xymon.com >http://lists.xymon.com/mailman/listinfo/xymon -- This email has been checked for viruses by AVG. https://www.avg.com

1 0

setting up a acknowledgement account
by didds3＠yahoo.co.uk 16 Mar '22

16 Mar '22

There must be a huge FAQ somewhere I can never find so apologies for asking daft questions agaihn, bgut I have googled. We've a new xymon server created?Xymon 4.3.30-1.el7.terabithia when I acknowledge an alert im not prompted for credentials to do so. what do I need to implement to do this ?? Its on other xymon servers we run from years back etc but nobody remembers what they did (zzzz) ian

1 0

Terabithia or compile
by ralphmitchell＠gmail.com 16 Mar '22

16 Mar '22

I downloaded the source rpm and installed it. The spec file for building the RPMs contains this: %if %{without trunk} %if 0%{?rhel} <= 7 Requires: ntp %endif %endif So, yeah, it builds into the binary RPMs the requirement to pull in ntp. I'm not sure if that can be made into a conditional, to require ntp OR chrony. Ralph Mitchell On Thu, Jun 18, 2020 at 5:05 PM Root, Paul T via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: "Root, Paul T" <Paul.Root at centurylink.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: RE: [Xymon] Terabithia or compile > That's odd. I did not do that to me. > > -----Original Message----- > From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Thurston > Sent: Thursday, June 18, 2020 2:24 PM > To: xymon at xymon.com > Subject: Re: [Xymon] Terabithia or compile > > On 6/17/2020 4:38 PM, John Horne wrote: > > I used to build from source, but for our CentOS 7 and 8 servers I have > been > > using the Terabithia RPMs with no problems. The downside is that, like > Malcolm > > Hunter mentioned, I have subsequently applied some local patches - sent > to the > > list - so that meant rebuilding the RPMs. > > I'm now looking at the Terabithia package for the first time in years. > My first reaction is, wth? > > Installing the xymon package on my server has disabled chronyd and > installed (but not started) ntpd. why?! If I hadn't read through the > list of packages it was going to grab, and understand the significance > of this one, I'd be going blindly forward with an un-synchronized system > clock. > > Now I wonder how many other of my services it has disabled or replaced. > I feel like I've just walked into a mine field :( > > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Department of Administration > State of Alaska > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > > https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f… > This communication is the property of CenturyLink and may contain > confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. > > > > ---------- Forwarded message ---------- > From: "Root, Paul T via Xymon" <xymon at xymon.com> > To: "'John Thurston'" <john.thurston at alaska.gov>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Thu, 18 Jun 2020 21:04:50 +0000 > Subject: Re: [Xymon] Terabithia or compile > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

5 5