May 2022 - Xymon - Xymon mailman web

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

4.3.30 RPMs released
by cleaver＠terabithia.org 23 May '22

23 May '22

Hello all, After a weekend in /testing/, the xymon 4.3.30-1 Terabithia RPMs have been moved to the production repositories at https://repo.terabithia.org/rpms/xymon/ Regards, -jc

2 1

HTTPS access to Xymon web pages
by josh＠imaginenetworksllc.com 16 May '22

16 May '22

Use Apache to redirect to HTTPS. Done. This is what we do. On Mon, May 16, 2022 at 7:09 AM Damien Martins via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Damien Martins <damien at makelofine.org> > To: Neil Simmonds <Neil.Simmonds at studio.co.uk>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Mon, 16 May 2022 13:09:20 +0200 > Subject: Re: [Xymon] HTTPS access to Xymon web pages > > Hi Neil, > > I think you can view it from different points of view: > > -blocking network traffic that is not HTTPS (using AWS SG & Net ACL) > > -configure your webserver to allow only HTTPS > > -configure your webserver to redirect/rewrite requests from HTTP to HTTPS > > I'm not familiar with Terabithia RPM, but documentation seems to focus on > Apache HTTP server. If this is the webserver you are planning to use, this > can be done easily using a permanent redirect on virtualhost's root > directory: > > Redirect permanent / https://my_xymon_host.net/ #Replace with the right > FQDN > > As you can see, Xymon is not involved at any time, because (AFAIK) this is > just an engine working in background and presenting the results via HTML > content, through a third party HTTP/HTTPS server. > > Hope this help, > Damien > Le 16/05/2022 ? 12:52, Neil Simmonds a ?crit : > > Hi all, > > > > I?m currently preparing to create a new Xymon server on AWS using the > Terabithia RPM?s and I want to only allow access to the Xymon pages over > HTTPS. Has anyone done this and can give me some advice? > > > > I?m good with setting up the AWS security groups etc and the local > firewall I?m just not sure how I Would setup Xymon to only show pages as > HTTPS? > > > > Kind Regards, > > > > Neil*.* > > > > *Neil Simmonds* > > Senior Platform & Middleware Engineer (Unix). > > > > > > > Studio is a trading name of Studio Retail Ltd which is authorised and > regulated by the Financial Conduct Authority for consumer credit and > general insurance. Studio Retail Ltd are members of the Finance and Leasing > Association (FLA). Registered in England. No: 718151. Registered Office: > Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and > any information contained within or attached in a separate file is > confidential and intended solely for the Individual to whom it is > addressed. The information or data included is solely for the purpose > indicated or previously agreed. Any information or data included with this > e-mail remains the property of Studio Retail Ltd and the recipient will > refrain from utilising the information for any purpose other than that > indicated and upon request will destroy the information and remove it from > their records. Any views or opinions presented are solely those of the > author and do not necessarily represent those of Studio Retail Ltd. If you > are not the intended recipient, be advised that you have received this > email in error and that any use, dissemination, forwarding, printing, or > copying of this email is strictly prohibited. No warranties or assurances > are made in relation to the safety and content of this e-mail and any > attachments. No liability is accepted for any consequences arising from it. > Studio Retail Ltd reserves the right to monitor all e-mail communications > through its internal and external networks. If you have received this email > in error, please notify our careline on +44(0) 371 200 0378. > > _______________________________________________ > Xymon mailing listXymon at xymon.comhttp://lists.xymon.com/mailman/listinfo/xymon > > > > > ---------- Forwarded message ---------- > From: Damien Martins via Xymon <xymon at xymon.com> > To: Neil Simmonds <Neil.Simmonds at studio.co.uk>, "xymon at xymon.com" < > xymon at xymon.com> > Cc: > Bcc: > Date: Mon, 16 May 2022 13:09:20 +0200 > Subject: Re: [Xymon] HTTPS access to Xymon web pages > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

HTTPS access to Xymon web pages
by Neil.Simmonds＠studio.co.uk 16 May '22

16 May '22

Hi all, I'm currently preparing to create a new Xymon server on AWS using the Terabithia RPM's and I want to only allow access to the Xymon pages over HTTPS. Has anyone done this and can give me some advice? I'm good with setting up the AWS security groups etc and the local firewall I'm just not sure how I Would setup Xymon to only show pages as HTTPS? Kind Regards, Neil. Neil Simmonds Senior Platform & Middleware Engineer (Unix). Studio is a trading name of Studio Retail Ltd which is authorised and regulated by the Financial Conduct Authority for consumer credit and general insurance. Studio Retail Ltd are members of the Finance and Leasing Association (FLA). Registered in England. No: 718151. Registered Office: Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Ltd and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Ltd reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error, please notify our careline on +44(0) 371 200 0378.

2 1

How do I get windows events to turn red?
by me＠tdiehl.org 11 May '22

11 May '22

Hi, I am using the win_ps_client to monitor a bunch of windows servers. In looking at the documentation it appears that I should be able to get Xymon to alert on different events. I have added eventlogswanted:information,Application,System:2048:Warning,Critical,error to client-local.cfg and eventlog:System in the analysis.cfg file. When I do this I see various messages when I click on msgs dot. However, I cannot figure out how to get it to turn red when it sees the events I want to monitor. In the docs I see mention of include and exclude parameters but I do not understand exactly how I need to configure things. I would like to be able to alert on certain windows event IDs Is this possible? If yes, how do I actually configure xymon to do this? Regards, -- Tom me at tdiehl.org

2 2

Trouble With Alert Format
by jstk888＠outlook.com 06 May '22

06 May '22

Hello fellow xymoners, I have recently setup monitoring of the existence of files in a particular directory, and this seems to be working well. When I setup an alert for a "red" condition, I receive an email message with what appears to be some html tags within it, eg: &red <a href="/xymon-cgi/svcstatus.sh?CLIENT=myserver.com&SECTION=file:/path/to/myfile">/path/to/myfile</a> File is a - should be file I have tried setting the alert "FORMAT" to TEXT, PLAIN and SMS, but this doesn't seem to have any effect. I have also tried sending the alert through the html_mail.pl extension scripts, and this doesn't seem to have any effect either. All I really want is a plain text message, which is easy to read. Does anyone know how I could clean this up? Example Alert Config: HOST=myserver.com MAIL alerts at someone.who.cares.com REPEAT=240m COLOR=red FORMAT=TEXT Regards, Jonathan

4 7