January 2024 - Xymon - Xymon mailman web

Possible bug in xymon svcstatus causing segfault (buffer overrun?)
by jeremy＠laidman.org 03 Jun '24

03 Jun '24

Hi all I'm not a C programmer by any stretch, so I'm seeking confirmation that my working is sound. At our site we run 4.3.30-1 from Terabithia RPM. For most hosts, the "trends" page displays just fine, but for some hosts, the webserver gives a CGI error, and when I manually run the CGI directly it crashes with a seg fault. This seems to be more likely for hosts with a lot of entries on the trends page, but some with more trends graphs are OK than others with fewer. I believe I've tracked the issue down to the last few lines of code in svcstatus-trends.c, where a URL is constructed for one graph entry, before being added to the list of trends in a buffer. My reading of the code suggests that it first pre-allocates (using malloc()) a 16k buffer for the trends data, then sequentially appends trend strings (which include a URL) into the buffer, until the length of a string would exceed the size of the buffer. In that case, an extra 4k of memory is added to the buffer (using realloc()), and then the string is added to the buffer. The problem with the code, as I see it, is that the string might be more than 4k long, in which case, adding string would cause a buffer overrun. I don't really know what's in each string, so I don't know if it's ever likely to be 4k, but we're seeing the process dumping core immediately after this bit of code, so that's the suspicion. Here's the bit of code, which is attempting to add the string "onelink" to the buffer, after seeing if it's going to exceed the buffer, and extending the buffer if required: if ((buflen + strlen(onelink)) >= allrrdlinks_buflen) { SBUF_REALLOC(allrrdlinks, allrrdlinks_buflen+4096); allrrdlinksend = allrrdlinks + buflen; } allrrdlinksend += snprintf(allrrdlinksend, (allrrdlinks_buflen - (allrrdlinksend - allrrdlinks)), "%s", onelink); Elsewhere in other code, the SBUF_REALLOC macro is used to add extra bufferspace by calculating a new buffer size of [existing buffer size plus 4k plus the length of the string being added]. So if the string to be added had 20 bytes, SBUF_REALLOC would be used to add 4k+20 bytes to the buffer size. Notably, the size of the string is included in the calculation. For example this bit of code elsewhere in the same file does a similar buffer extension: if ((strlen(rrdlink) + strlen(partlink) + 1) >= rrdlink_buflen) { SBUF_REALLOC(rrdlink, rrdlink_buflen + strlen(partlink) + 4096); } strncat(rrdlink, partlink, (rrdlink_buflen - strlen(rrdlink))); Note the extra "+ strlen(<stringvar>)" bit in the extra memory being allocated that isn't there in the first block of code above. So my thinking is that the SBUF_REALLOC() needs to take the string's size into account, like so: SBUF_REALLOC(allrrdlinks, allrrdlinks_buflen+strlen(onelink)+4096); Is anyone with C skills able to confirm that this does indeed look like a bug, and also that my proposed change is a suitable fix? After applying this change and recompiling, we haven't yet seen a seg fault from this bit of code, so I'm hoping it's all fixed, and without negative side effects. Cheers Jeremy

3 6

Update on 4.4 (Alpha1 release)
by cleaver＠terabithia.org 15 May '24

15 May '24

Hello all! Just wanted to update everyone on a few things. Going through the 4.x codebase re-familiarizing myself again with the state of everything, I recalled that I'd actually built a release artifact before development was paused, including a testing RPM that has actually been running unbeknownst on a VM for quite a while. Unfortunately, while validating that compiles from source worked I ran into what looked like showstopper bugs. These weren't showing up in the package, so I had to pore through a lot more code* than I expected to try to figure out where the package was accidentally fixing it. (*message-sending code, which changes a lot in 4.4 to support compression, TLS, HTTP, and size-prefixed messages) Fortunately, it ended up being a relatively simple issue (isn't it always?), with easy-enough validation and workaround (given below). Although more fixes could be put in (and I'm sure will be needed!), I believe there's some benefit to having a stable starting point using a build artifact from 2019. As a result, I'm pleased to announce the first alpha for Xymon 4.4! As this is an alpha release, this is absolutely NOT suitable for production use and is intended mainly for smoketesting by source users. (And I expect there will be smoke.) The release tarball is available now at: https://sourceforge.net/projects/xymon/files/Xymon/4.4-alpha/xymon-4.4-alph… Major improvements are too many to list here but are noted in the Changes and RELEASENOTES files. README documents for compression, TLS, and IPv6 are in progress. Some of the changes and improvements other than TLS support have been in the Terabithia packages (to some extent) for a while, so there will be less of a delta for those users to this alpha. For the moment, I'd like to focus on source tarball users and others running xymon from scratch to help fix underlying issues and any smoketest failures, which I expect may crop up particularly on untested non-Linux platforms. Once the lower-hanging fruit is fixed and more patches are upstreamed and cleaned up, I'll release an alpha2 release at which point packages may be released to help with testing iteration and downstream distributors. Please flag bug reports or patches as related to "alpha1" in the subject line to help keep things clear. Thank you to everyone in the community for remaining part of it -- and xymon users! -- during this interregnum. Restarting development has been a process, but I'm glad to take this important first step to our next release. Regards, -jc *** KNOWN ISSUES -- IMPORTANT *** The configure script is likely setting XYMONHOME/XYMONCLIENTHOME and XYMSRV/XYMSERVERS/XYMONSERVERS incorrectly, which will prevent xymonlaunch from correctly launching anything. Double check the xymon environment files (xymonserver/xymonclient.cfg) before starting either the server or client. The tools/xymon-client.default and tools/xymonlaunch files may be placed into /etc/{sysconfig,default}/{xymon-client,xymonlaunch} to more easily set $XYMONSERVERS Revealed by the above issue is a bug causing a crash in the client (or anywhere) when given an empty string as the destination argument (instead of 0, 127.0.0.1 or no variable set). Don't do this --> [ xymon '' "ping" ] The client and logfetch binary may be being re-compiled during 'make install' Compilation may fail if c-ares and at least one compression library is not present (lzo/lz4/zlib are all options). xxHash libraries are also highly recommended as the plan is for xxhash to replace md5 for checksumming functionality. libtirpc may be necessary on some platforms, and it's possible the build code is still expecting traditional (Sun) RPC

9 13

XymonPSClient CPU graphs missing over HTTPS
by kspringer＠innovateteam.com 31 Jan '24

31 Jan '24

I'm using the XymonPSClient 2.42 on a Windows server, and all works fine except when I choose to send the data from the client to the server over https the CPU graph doesn't display on the server side. If I change the XymonPSClient to send over http the CPU graph displays correctly.? I've tried this on different hosts and results are always the same when using https.? Server is v4.3.30, but it was happening on an older version too.? Can anyone give me a clue how to resolve this?? There's no errors happening that I can see anywhere. I looked in the rrd folder and there is no 'cpu' or 'la' rrd file being created for the hosts that use the XymonPSClient over https. Thanks, Kris Springer

3 9

Xymon no longer sending alerts
by colin.coe＠gmail.com 31 Jan '24

31 Jan '24

Hi all Our Xymon server has recently stopped sending alert emails. This server is also running Postfix and is our mail relay. >From alert.log all I see is: 2024-01-31 02:17:39.813610 Whoops ! Failed to send message (Select(2) failed) 2024-01-31 02:17:39.829027 -> Select failure while sending to Xymon daemon at 10.10.10.10:1984 2024-01-31 02:17:39.829032 -> Recipient '10.10.10.10', timeout 50 2024-01-31 02:17:39.829037 -> 1st line: 'config hosts.cfg' 2024-01-31 02:17:39.829042 Cannot load hosts.cfg from xymond: Select(2) failed 2024-01-31 02:17:39.829049 Failed to load from xymond, reverting to file-load 2024-01-31 02:22:40.932828 Whoops ! Failed to send message (Select(2) failed) 2024-01-31 02:22:40.932863 -> Select failure while sending to Xymon daemon at 10.10.10.10:1984 2024-01-31 02:22:40.932867 -> Recipient '10.10.10.10', timeout 50 2024-01-31 02:22:40.932871 -> 1st line: 'config hosts.cfg' 2024-01-31 02:22:40.932876 Cannot load hosts.cfg from xymond: Select(2) failed 2024-01-31 02:22:40.932881 Failed to load from xymond, reverting to file-load And notifications.log is zero bytes in size. I added "--debug" to the "[alert]" section of /etc/xymon/tasks.cfg and while the verbosity was increased, there was no indication of why alerts are not being sent. Any clues how I can debug this? Thanks

3 7

Fwd: Re. Is this thing on?
by bruno.manzoni＠ubi-network.ch 29 Jan '24

29 Jan '24

Hi. Seem that Ye-Fee is unable to email to the mailing list? *Can you check that if there is a problem ( I think Henrik) ?* By to way, I remember that we have to migrate to another service. *What about: https://mailman3.com/ which is free for opensource ?* (comment to do or not to do are welcome!) *Can someone take the job ? * Thing to do: - Ask malman3 if possible to have a freemailing list - The we can see how to do it! (That will need for sure to contact Henrik), but I can help also. Bruno -------- Forwarded Message -------- Subject: Re. [Xymon] Is this thing on? Date: Thu, 28 Sep 2023 16:22:00 +0000 From: Liang, Ye-Fee [PHSA] <yefee.liang at phsa.ca> To: bruno.manzoni at ubi-network.ch <bruno.manzoni at ubi-network.ch> Hi Bruno, ?? I was able to email xymon at xymon.com long time ago, and now find myself unable to email anymore.? I have used xymon at different organizations over the decades, and would love to help the tool/platform to continue for decades more.? Simply there is no other product that is more versatile, easy to manage, and light server+client requirement.? Many more people are eager to contribute, but can only just read the xymon list email, from the side line. ?? Thanks for your summary of Xymon non-technical and technical needs. Just to keep the enthusiasm going, I would suggest a section on "making the better use of Xymon as now" I am only a sys admin, not a coder, so my focus is on management and usability areas. 1. enhanced cpu utilization graph (adds wait IO; better colors); see 1a. 2. menu script (see 2a) to clean up of accumulating rrd, hostdata and histlogs, eg. due to short-term ???ad-hoc metrics like nfs file systems, container nic devices. 3. menu script (see 3a) to manage clients easier Keep up the great work! Ye-Fee 1a 2a ------------------------------------------------------ c) change Client:?????? yyy ct) change days to trim: 30 1) summary???? 1a) list pings?? 1b) list cpu clients 1bbb) list to scp file?????????? 1bb) list in one column 1c) list non-pings tests?????? ??1d) list non-green cpu tests 2)? duplicate report 3)? Info on client?????????????? 3a) formatted 4)? Search client in hosts.cfg+ 6)? find clients with too many rrd's???? 6z) list -5 RRD's 6a) list top 10?? 6af) find top 10?? 6at) trim hostdata's ?6b) list top 10?? 6bf) find top 10?? 6bt) trim histlogs's 6c) list top 10?? 6cf) find top 10?? 6ct) trim Select from top 10 to trim??? 6ta) RRD? 6tb) hostdata? 6tc) histlogs 7a) diff host_cfg files????????? 7u) update host_cfg files ------------------------------------------------------ 3a ----------------------------------------------------------- c) Change Client: vag7 c1) check ssh???????????????? c2) ps -ef | grep xym c3) copy-id?????????????????? c4) check client os version 2a) info xymonclient/logs???? 3a) log: logs/xymonclient.log 2b) info xymonclient/tmp????? 3i) log info? 3t) log tail 2c) info xymonclient dir????? 3u) log util 3s) scan xymonclient.log 5a) start xymonclient???????? 5c) status 5b) stop t1) curl nag1 (10.248.224.149) 1984 test???? t3) telnet t2) curl nag2 (142.71.43.51)?? 1984 test???? t4) telnet t8) rm known_hosts entry dc) compare config file?????? dx) cp? + extract client file d2) diff vmstat2.sh?????????? d3) cp vmstat2.sh to client d6) client file: xymonclient_v4_3_28_RH7.gz d7) config file: xymonclient.cfg d9) copy config file to client -----------------------------------------------------------

4 12

alerts.cfg rules for specific files, libs, ports and procs?
by alt36＠cam.ac.uk 29 Jan '24

29 Jan '24

On 29/01/2024 14:46, Jaap Winius via Xymon wrote: > Hi folks, > > Is it possible to write rules for alerts.cfg that are triggered not by > state changes for services, such as imap or http, but instead for > specific files, libs, ports and procs? If so, what would they look like? The rules used to trigger alerts.cfg are combinations of things like test name, colour, duration, but not the particular contents of a status message. If you just want to alert when the procs test has been red for 5 minutes, that's straightforward: SERVICE=procs COLOR=red DURATION>5 MAIL alert at example.com If you only want to alert based on the actual contents of a status message, I think you'd need to implement a custom SCRIPT as the alert recipient and have it take whatever action you like based upon the content of $BBALPHAMSG . The default alerts.cfg provided with xymon contains a pretty full description of how alerting rules work, in combination with "man alerts.cfg": https://fossies.org/linux/xymon/xymond/etcfiles/alerts.cfg.DIST https://manpages.org/alertscfg/5 Adam

1 0

alerts.cfg rules for specific files, libs, ports and procs?
by jwinius＠umrk.nl 29 Jan '24

29 Jan '24

Hi folks, Is it possible to write rules for alerts.cfg that are triggered not by state changes for services, such as imap or http, but instead for specific files, libs, ports and procs? If so, what would they look like? Thanks, Jaap

1 0

analysis.cfg regular expression
by Neil.Simmonds＠studio.co.uk 17 Jan '24

17 Jan '24

Hi folks, I'm having trouble with a regular expression in a LOG entry in analysis.cfg which is monitoring a Windows log. I've included some sample lines below (IP addresses changed for obvious reasons) and I need to alert when the 12th string (space separated) is 403 (actually 500 but for testing, 403) I've tried this, LOG "%D:\Weblogs\*\u_ex*.log" "%2.{1,75} .{1,75} .{1,75} .{1,75} .{1,75} .{1,75} .{1,75} .{1,75} .{1,75} .{1,75}- 403 .{1,75} .{1,75} .{1,75}" COLOR=yellow And LOG "%D:\Weblogs\*\u_ex*.log" "%(?:\S+\s+){11}403\b" COLOR=yellow 2024-01-16 14:41:01 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 93 2024-01-16 14:42:03 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 83 2024-01-16 14:43:04 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 78 2024-01-16 14:44:08 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 110 2024-01-16 14:45:13 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 89 2024-01-16 14:46:16 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 62 2024-01-16 14:47:20 127.0.0.1 GET / - 80 - 127.0.0.1 Xymon+xymonnet/4.3.30-1.el8.terabithia - 403 14 0 78 Neither of these work. Can anyone help? Kind Regards, Neil. ). Studio is a trading name of Studio Retail Trading Limited (Company no. 03994833), which is an introducer of credit not a lender. Studio Pay is provided by Frasers Group Financial Services Limited (Registered Company no. 00718151), which is authorised and regulated by the Financial Conduct Authority (FRN 311908) for consumer credit and general insurance and a member of the Finance and Leasing Association. Both companies are registered in England and their registered office is: Church Bridge House Henry Street Accrington BB5 4EE. NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Trading Ltd or Frasers Group Financial Services Ltd. The recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Trading Ltd or Frasers Group Financial Services Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Trading Ltd and Frasers Group Financial Services Ltd reserve the right to monitor all e-mail communications through their internal and external networks. If you have received this email in error please let us know. You can find our available contact details by going to help.studio.co.uk and clicking 'Contact Us'.

2 2

hobbit alerting on PAGE in dispinclude file
by r.oliver＠web.de 08 Jan '24

08 Jan '24

I also set up something similar to what you did; we call them 'admin pages' or 'admin views.' In them, we mostly work with 'dispinclude' as it could lead to inconsistent configurations in cases where one monitored host is mentioned multiple times in different 'hosts.cfg' files. My goal was to set up alert notifications based on 'PAGE=admiviews/user-a' in 'alerts.cfg,' but this does not work. My guess is that 'dispinclude' is indeed not designed to trigger alerts. Unfortunately, it would really come in handy in that case...

1 0

No subject
by r.oliver＠web.de 08 Jan '24

08 Jan '24

get 048220

1 0