- Xymon - Xymon mailman web

Security Monitoring
by Jim_Horwath＠glic.com 26 Jan '07

26 Jan '07

> ----- Message from "James Wade" <jkwade at futurefrontiers.com> on Thu, > 25 Jan 2007 14:07:05 -0600 ----- > > To: > > <hobbit at hswn.dk> > > Subject: > > Security Monitoring > > Is anyone doing any security monitoring > with Hobbit? > > So, for example, monitoring to see if multiple login > attempts are being made using different accounts, > but all from the same IP address. > > Thanks?.James > > > > ----- Message from henrik at hswn.dk (Henrik Stoerner) on Thu, 25 Jan > 2007 22:16:06 +0100 ----- > > To: > > hobbit at hswn.dk > > Subject: > > Re: [hobbit] Security Monitoring > > On Thu, Jan 25, 2007 at 02:07:05PM -0600, James Wade wrote: > > Is anyone doing any security monitoring with Hobbit? > > > > So, for example, monitoring to see if multiple login > > attempts are being made using different accounts, > > but all from the same IP address. > > It's not part of Hobbit. I guess it would be fairly easy to do with the > client data, since it includes the "who" output. Writing a server-side > script which is fed all of the client data, and analyses the login data > would probably be fairly easy for someone with a bit of Perl experience. > > (You'd run a command like > hobbitd_channel --channel=client myscript.pl > from hobbitlaunch.cfg. The "myscript.pl" program then gets all of the > client data, with each client message starting with "@@client#"). > > I use the "ports" status to check for unauthorized network services > running. Some of my co-admins weren't quite up to speed on what Hobbit > could do, so they got a bit of a scare when I phoned them and started > asking questions less than 5 minutes after they accidentally started an > SNMP daemon on one of my servers. > > > Regards, > Henrik > James: Here is something I am in the process of doing. There is a security scoring program available from CIS (The Center for Internet Security) http://www.cisecurity.org. They have free tools available for many popular flavors of Unix. It would be fairly easy to run the tool filter the output and send said data to Hobbit. I plan on doing this at some point in the future. Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

non-green view
by jkwade＠futurefrontiers.com 26 Jan '07

26 Jan '07

Is there anyway to have the non-green view also show systems disabled? ie.blue items. Thanks.James

4 3

Instalingl allinone patch for hobbit 4.2.0
by fdupeyroux＠ftv-publicite.fr 26 Jan '07

26 Jan '07

Hello, I have this problem for installing allinone patch : [root at ftp-monitor hobbit]# cd /usr/lib/hobbit/ [root at ftp-monitor hobbit]# patch -p0 <allinone.patch can't find file to patch at input line 4 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |diff -urN /home/henrik/hobbit/release/hobbit-4.2.0/bbdisplay/bbgen.h ./bbdisplay/bbgen.h |--- /home/henrik/hobbit/release/hobbit-4.2.0/bbdisplay/bbgen.h 2006-08-09 22:09:54.000000000 +0200 |+++ ./bbdisplay/bbgen.h 2006-10-03 13:52:28.720493437 +0200 -------------------------- File to patch: Thank you for your assistance. Bests regards, Frédéric Dupeyroux.

4 3

Feature request. Breadcrumbs for bbgen
by grsamy＠yahoo.com 26 Jan '07

26 Jan '07

First, Thanks for providing us this GREAT tool. Is it possible to provide breadcrumbs (links back to each previous page that the user navigated through in order to get to the current page) in bbgen. Not a must but nice to have. Thanks Ram --------------------------------- Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. Check it out.

1 0

rrdtool detection
by stef.coene＠docum.org 25 Jan '07

25 Jan '07

Hi, After upgrading to hobbit-4.2, graphs are not working anymore. I have rrdtool installed on AIX: rpm -aq | grep rrd rrdtool-1.2.10-2 Output from the configure script; Checking for RRDtool ... Found RRDtool include files in /opt/freeware/include/ Found RRDtool libraries in /opt/freeware/lib/ Linking RRD with PNG library: -L/usr/lib -lpng But I have rrdtool 1.2 installed and I think the configure script is not detecting this. This is the error I get: Content-type: text/html <html><head><title>Invalid request</title></head> <body>Garbage ': 18-Jan-2007 14:36:57' after command: COMMENT:Updated: 18-Jan-2007 14:36:57</body></html> And I traced it back to an "if" statement that depends on the rrdtool version. Stef

3 3

Security Monitoring
by jkwade＠futurefrontiers.com 25 Jan '07

25 Jan '07

Is anyone doing any security monitoring with Hobbit? So, for example, monitoring to see if multiple login attempts are being made using different accounts, but all from the same IP address. Thanks..James

2 1

Procs test clear?
by stefan.freisler＠aspect-online.de 25 Jan '07

25 Jan '07

Hi, i installed an server and now my procs test is clear, while i have configured my server correct i think: All other Tests work fine. What can i do? HOST=xxxxxxxxxxxx.de PROC crond 1 -1 red LOG /var/log/messages error,fail,panic,NOTICE COLOR=red %uthentication.failure LOG /var/log/messages warn,WARN COLOR=yellow %uthentication.failure LOG /var/log/boot.log error,fail,panic,NOTICE COLOR=red LOG /var/log/boot.log warn,WARN COLOR=yellow LOG /var/log/maillog error,fail,panic,NOTICE COLOR=red %format.error LOG /var/log/maillog warn,WARN COLOR=yellow %format.error LOG /var/log/cron error,fail,panic,NOTICE COLOR=red LOG /var/log/cron warn,WARN COLOR=yellow DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 on all other systems it works with this or nearly the same config. thx Stefan

2 3

[hobbit] network test scheduling
by emarganne＠be.tiauto.com 25 Jan '07

25 Jan '07

This looks interesting indeed, great idea. But is there a way to go further on that and filter which protocols you will be testing let's say every minute like in the example? i.e.: I want to test every minute some stuff with SMTP and every 5 minutes all the other protocols. I think, but I am not sure that this could mean creating two different "bb-services" files, one for each frequencies ... Regards, Etienne Marganne, TI Automotive. _____ From: Aiello, Steve (GE, Corporate, consultant) [mailto:steve.aiello at ge.com] Sent: jeudi 25 janvier 2007 15:58 To: hobbit at hswn.dk Subject: RE: [hobbit] network test scheduling I think this past mailing list archive explains how you can setup multiple bbtest-nets to run. One running with a 1m interval & the other with a 5m. Then you just need to use the NET: tag in the bb-hosts file to specify which host should have it's network checks run at which interval: http://www.hswn.dk/hobbiton/2005/02/msg00272.html <http://www.hswn.dk/hobbiton/2005/02/msg00272.html> -----Original Message----- From: Marganne, Etienne [mailto:emarganne at be.tiauto.com] Sent: Thursday, January 25, 2007 4:03 AM To: hobbit at hswn.dk Subject: [hobbit] network test scheduling Hi all, I have a question about the operations of bbtest-net. It said in the man pages that it reads first the bb-services file which describes a list of TCP based protocols and how to test them. What I would like to do is to schedule differently all those tests. Since I have noticed that the bbtest module launch frequency is configured in the hobbitlaunch.cfg without any parameters about bb-services. I would like to know if it was possible to schedule launches of the bbtest module at different frequencies with different "bb-services" files with of course different contents. Thank you, Regars, Etienne Marganne, TI Automotive. The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message. The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

1 0

[hobbit] client side test frequency tuning
by emarganne＠be.tiauto.com 25 Jan '07

25 Jan '07

First the CPU test was chosen as an example it sure does not make much sense to accelerate the frequency of the data collection for that ;-). About the main topic, I think I have been confusing people a lot with term misuses. What I would like to do is to accelerate or slow down the frequency of data collection, not the tests that are held, as you said, on the server side. The idea is to try to tune the data collection frequencies the most accurately possible. You said that I can change the frequency of the execution of the full Hobbit client... That is what I do not want to do. But you also said that it would break up the log file ... only because rising the data collection flow would be really flood like (thing that I strongly believe possible) or is there another reason? Regards, Etienne Marganne, TI Automotive. -----Original Message----- From: henrik at hswn.dk [mailto:henrik at hswn.dk] Sent: jeudi 25 janvier 2007 16:04 To: hobbit at hswn.dk Subject: Re: [hobbit] client side test frequency tuning On Thu, Jan 25, 2007 at 03:03:20PM +0100, Marganne, Etienne wrote: > > The CPU, disks, procs kind of tests are held on the client side right? No. That's Big Brother thinking, and you're running Hobbit. There is no one-to-one correspondance between the client-side script and the cpu/disk/memory etc. tests that shows up on the Hobbit display, since the latter is generated on the Hobbit server from several of the data items that the client-side script collects. > What I want to do is to change the frequency of the CPU survey without > changing anything for the other tests. You can modify the clientlaunch.cfg to run the full Hobbit client script every minute, but that would probably break your log-monitoring (log events would expire in 6 minutes instead of 30), and the vmstat data would probably be affected as well. Besides which, it doesn't really make much sense. The CPU load reported is the 5-minute average from your OS anyway. And do you really want a sudden spike to trigger full alerts? Just because someone happened to run "find" in the wrong directory? Regards, Henrik To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk The information contained in this transmission may contain privileged and confidential information. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

1 0

number of cpu on the client
by gn1＠sanger.ac.uk 25 Jan '07

25 Jan '07

Hi, Would it be possible to have the hobbit client reporting the number and type of CPU (creating a new [cpu] section)? A "cat /proc/cpuinfo" on a linux machine will do the trick, but I don't know if this would be easy for the other OSes. Cheers, Gildas

4 4