- Xymon - Xymon mailman web

how can I receive alerts for every new trigger matched for 'LOG'
by jjj863＠gmail.com 19 Dec '06

19 Dec '06

hi, there, I have a LOG check for "error: #1" "error: #2" in a log file. We'd like to receive email alerts for each every trigger matched, "%error: #" since we needs to know the all the error # reported. Right now, it generates email alerts. but not for every new triggers. No alerts are generated for a newly matched trigger log entry if the STATUS is red/yellow already. In my thinking, if the LOG check itself can be RECOVERED after 5m (I believe the default is 30m), this ought work. - Does anybody know how to change the default from 30m to 5m (for a single check/test)? - Any alternative/recommendations to get the desired results? I initially thought a 'creative' combination of 'REPEAT=5 DURATION<10' would do it...

2 4

Problems with HTTPS Continue
by geoff.hallford＠gmail.com 19 Dec '06

19 Dec '06

Hi Everyone, I still have problems getting Hobbit to check URL's that are HTTP*S*. I have compiled with SSL support and the testing does work on items such as LDAPS and SSH but it will not work for HTTPS. Does anyone have any thoughts? I get the following message: --- Mon Dec 18 14:01:59 2006: https://142.224.108.83/apps/SCMClientWin32.exe - Not Found The requested URL /error/HTTP_BAD_REQUEST.html.var was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request. ------------------------------ Apache/2.0.55 (Unix) Server at localhost Port 1443 Seconds: 0.00

4 8

apache trends missing some data
by rmunsch＠solutionsforprogress.com 19 Dec '06

19 Dec '06

Hello list, I'm watching a webserver and trending Apache Utilization, Apache Workers, Apache CPU Util, and Apache Requests per Second. Only "Apache Workers" shows data and has a graph. The other three show NaN. All other tests are green. All other client data is coming in and graphing. The bb-hosts line for the host is: <ip addy> ws2 # ssh http://<URL> apache=https://<ip addy>/server-status?auto TRENDS:*,apache:apache|apache1|apache2|apache3 ssldays=30:15 which seems to be the way to do it in the docs. What i don't understand is how one apache test graphs and three show NaN; i'd assume an all-or-nothing sort of arrangement. I can't figure out what i'm doing wrong to be missing three of the four, and if it's wrong, i don't know how i'm getting the one... TIA, -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com

2 2

bbwin 0.9 available
by etienne.grignon＠gmail.com 19 Dec '06

19 Dec '06

Hello, First at all, I'm deeply sorry for the large delay between 0.8 and 0.9. I will try to do not disappoint you the next time ... For the 0.9, these are the news : + New Features * Msgs agent reports events username and you may filter event with user name * Msgs agent reports some statistics about each event log file. You can activate an option which alert you when an event log is full. See the help chm file for details. * New BBWinUpdate agent : it used for the semi centralized mode. You can configure the agent to download configurations updates from a central hobbit server. * First version of BBWin centralized mode implemented. Backend for hobbit not coded. Look at the BBWin.cfg example in the doc folder or in the documentation + Updates * system uptime sometimes returns 0 seconds on the first query. BBWin now send a green status when this happens to avoid incorrect alerts. * msgs now formats description field in status so you don't have to scroll your window to read a large event description * disk agent reported alerts on unrecognized disks (like disks part of cluster resources on the inactive node of an MSCS cluster). These disks are now automatically ignored. * cluster.exe is more verbose when it check the Windows version * procs agent now is using rules with signs '+' or '-' because XML format doesn't accept '<' sign in attributes ... However, the compatibility with '<' and '>' is preserved. * msgs summary option is removed. It is enabled by default and there is no use to disable it. + Bugs * limit option for cpu agent was wrong in the number of lines reported, it is fixed. * When an agent had no configuration in BBWin.cfg and if it was loaded, BBWin crashed, it is fixed. * msgs agent had a memory leak when an initialization was made to get event description. it is fixed. * wlbs script external had a bug to load the configuration file. it is fixed. * cpu agent were always missing one process in the ps report. it is fixed. * externals agent was crashing BBWin if its configuration was empty. it is fixed. For the centralized mode, there are no backend on the hobbit part for the moment ... so, you can enable the bbwin centralized mode it to see that it is working (You will be able to see the small link "clientdata" in each status sub page of your host) but it is not usable at this time. The others news are that I tested BBWin 0.8 and 0.9 on Windows Vista Ultimate, and it is working just fine. I'm using BBWin on over 300 productions servers. The only problems I got are resolved with the bug fixes included in BBWin 0.9. With the bbwinupdate agent, you can centralize all or some of your configuration rules even if it is not the fully hobbit centralized mode that every body is expecting for. Here the link for the download : http://sourceforge.net/projects/bbwin As always, let me know if you get troubles with this new version. Regards, Etienne

3 2

Feature Request: Incident Reporting
by geoff.hallford＠gmail.com 18 Dec '06

18 Dec '06

Hi Henrik, I saw in the history of the mailing list that an Incident Reporting feature has been requested to basically show: start time, notifications, when acked, when recovered and so forth. Do you have any estimate for this feature? I am really interested in having this feature. Thank you.

1 0

Graph Presentation
by jkwade＠futurefrontiers.com 18 Dec '06

18 Dec '06

Hello All, I've modified the old larrd bb-iostat.sh script to send iostat information to Hobbit so that I could graph busy and wait states of disks, and it works great. However, I'd like to make the graphs a little more presentable. Can someone give me some suggestions on doing the following below or if it's not possible. 1) I have several NFS & Hard Mounts that I'm checking busy and wait states for. A lot of them get NaN's because the busy and wait states are 0, zero. I can tell it to only graph something that is greater than a number, but I would prefer that it did not list the filesystem(s) that have NaN's below the graph. Can this be done? 2) Also, when graphing a lot of data, you get all the colors, but it becomes difficult to figure out which one belongs to which data. Is there a way to have rrd give you the datapoint information when you move the cursor over it? ie, I put the cursor over a line, and it says, /export/home, and gives me the numbers. Thanks..James

2 1

MYSQL support
by jbeltram＠int.inetu.net 18 Dec '06

18 Dec '06

Just wondering if there are any plans to move away from storing the logs/hist/histlogs etc from the flat filesystem to a MYSQL db format? This way there could be clusters of servers. Just wondering....looks great!! Thanks, Jason Beltrame, CCNP, CCDA Network Engineer INetU Managed Hosting Phone: (610) 266-7441 Toll-Free: 888-664-6388 Fax: (610) 266-7434 ----------------------------- INetU Managed Hosting - Expert Hosting Solutions

2 1

overzealous Hobbit client on RHL 9
by jjj863＠gmail.com 18 Dec '06

18 Dec '06

Hobbit client (4.2RC1-20060712) is overzealous on only one of the RHL9 (Redhat Linux 9 ) clients . It scans tasklist every 5s. This doesn't happen for my other RHL9 clients or CentOS 4 clients. Any idea on how to either stop scanning this frequent or stop logging such scans? /var/log/hobbit# tail clientlaunch.log 2006-12-18 09:46:35 Starting tasklist scan 2006-12-18 09:46:40 2006-12-18 09:46:40 Starting tasklist scan 2006-12-18 09:46:45 2006-12-18 09:46:45 Starting tasklist scan 2006-12-18 09:46:50 2006-12-18 09:46:50 Starting tasklist scan 2006-12-18 09:46:56 No files modified, skipping reload of /usr/lib/hobbit/client/etc/clientlaunch.cfg 2006-12-18 09:46:56 2006-12-18 09:46:56 Starting tasklist scan

1 0

Monitoring MSGS issues
by gadget＠rewse.jp 17 Dec '06

17 Dec '06

Hi all, I have two issues for MSGS. Thanks for your help. # Environment # Hobbit: Hobbit 4.2.0 OS: CentOS 4.4 (Linux 2.6.9) Hostname: oscar (Both Hobbit server and client) ---------------------------------------- 1. "ignore" clause in client-local.cfg doesn't filter out it. I set the below in client-local.cfg on oscar, but the msgs page on Hobbit shows the below. Why does not it filter out "br104fmx"? == ~hobbit/server/etc/clinet-local.cfg == [oscar] log:/var/log/messages:10240 ignore br104fmx == oscar - msgs == No entries in /var/log/messages Full log /var/log/messages Dec 17 16:50:43 uniform brl04fmx TCP connection dropped - Source:xxx.xxx.xxx.xxx,6293,WAN - Destination:xxx.xxx.xxx.xxx,53131,LAN Dec 17 16:50:43 uniform brl04fmx [2006-12-17 16:50:43] | From: [xxx.xxx.xxx.xxx] | Port:[53131] | [Blocked] Dec 17 16:51:16 uniform brl04fmx TCP connection dropped - Source:xxx.xxx.xxx.xxx,4689,WAN - Destination:xxx.xxx.xxx.xxx,445,LAN Dec 17 16:51:16 uniform brl04fmx [2006-12-17 16:51:16] | From: [xxx.xxx.xxx.xxx] | Port:[445] | [Blocked] Dec 17 16:52:22 oscar su(pam_unix)[4887]: session opened for user root by gadget(uid=500) Dec 17 16:55:43 uniform brl04fmx TCP connection dropped - Source:xxx.xxx.xxx.xxx,6293,WAN - Destination:xxx.xxx.xxx.xxx,53147,LAN (abbr) ---------------------------------------- 2. I set the below in hobbit-clients.cfg on oscar, but Hobbit doesn't alert it. Sent logfile is the below. Why does not Hobbit alert "failure"? PORT and PROC have no problems. == ~hobbit/server/etc/hobbit-clients.cfg == HOST=oscar PORT 139 "TEXT=NetBIOS: 139" PORT 445 "TEXT=SMB: 445" PORT 3303 "TEXT=MySQL: 3306" PORT 3690 "TEXT=Subversion: 3690" LOG /var/log/messages failure PROC nfsd PROC mysqld 2 PROC smbd PROC svnserve == oscar - msgs == No entries in /var/log/messages Full log /var/log/messages (abbr) Dec 17 17:28:40 uniform brl04fmx TCP connection dropped - Source:xxx.xxx.xxx.xxx,6293,WAN - Destination:xxx.xxx.xxx.xxx,53404,LAN Dec 17 17:28:40 uniform brl04fmx [2006-12-17 17:28:40] | From: [xxx.xxx.xxx.xxx] | Port:[53404] | [Blocked] Dec 17 17:30:26 oscar sshd(pam_unix)[5637]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=powermac user=gadget Dec 17 17:30:35 oscar sshd(pam_unix)[5637]: 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=powermac user=gadget Dec 17 17:33:39 uniform brl04fmx TCP connection dropped - Source:xxx.xxx.xxx.xxx,6293,WAN - Destination:xxx.xxx.xxx.xxx,53418,LAN Dec 17 17:33:39 uniform brl04fmx [2006-12-17 17:33:39] | From: [xxx.xxx.xxx.xxx] | Port:[53418] | [Blocked] (abbr) Thanks, -- Tats SHIBATA Rewse Lab.

3 2

how to report multiple temperture probe results
by jjj863＠gmail.com 16 Dec '06

16 Dec '06

hi, I noticed that hobbitgraph.cfg has a [temperature] section. How should I 1. report multiple probes from a single client in an extension script: a lump-all "status server1.temperature green" or one status call per probe? 2. collect these probes into RRD using NCV def in hobbitserver.cfg ? 3. set threshold centrally on the server? I initially set up my own extension script 'temps' and therein reports all six probes on a test server with one 'status server1.temps green' call. However, the NCV_temps def failed when a different server reports four/seven probes at once. As for alerting, I set up thresholds on the server. However, it doesn't generate any alert even if the threshold is obviously surpassed. wonder if the 'status blah GREEN' reported by the extension script kinda blocked such centralized checking? Thanks. jerry

1 1