- Xymon - Xymon mailman web

change color
by c.rehberger＠oclcpica.org 12 Dec '06

12 Dec '06

Hello, sorry for my stupid question... On server side I've added a new service in bb-services which makes an smtp on a specified port of a mailserver. The entry in bb-hosts looks like: 193.31.10.90 hunter-in.Sisis.de # ntp ssh postini1 When the service "postini1" fails the color switches to yellow. Where can I configure, that the color goes to red like the ssh service? Thanx a lot Chris -- Christian Rehberger System Consultant · OCLC PICA GmbH Grünwalder Weg 28g · 82041 Oberhaching · Germany t +49-(0)89-61308 333 · f +49-(0)89-61308 399 e c.rehberger at oclcpica.org · w http://www.oclcpica.org

1 0

Big Alerting Issue
by geoff.hallford＠gmail.com 12 Dec '06

12 Dec '06

Hi, I have a problem where Hobbit is not properly sending alerts based on the PAGE criteria. When I look at the info button for TESTHOST and TESTHOST1, it *DOES* shows an alert to test at test.org. When I run the test 'bbcmd hobbitd_alert --test TESTHOST --color=red' or 'bbcmd hobbitd_alert --test TESTHOST --color=red' it *DOESN'T' show that it matched an alert: 00023954 2006-12-10 21:14:51 Matching host:service:page 'TESTHOST:--color=red:' against rule line 314 00023954 2006-12-10 21:14:51 Failed 'PAGE=$SERVER1,$SERVER2 COLOR=red' (pagename not in include list) I also did a real test of taking the host down and no page went out and nothing is listed in the /var/log/hobbit/notifications.log. THIS IS URGENT IF ANYONE CAN HELP. I recently switched my alerts to be by pagename and thought it should work based on the info page but I guess not. Thanks. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SETUP bb-hosts ------------ page servers Servers subpage wintel Wintel Servers 10.10.10.10 TESTHOST page other Other subpage othersub Other page 20.20.20.20 TESTHOST1 hobbit-alerts.cfg ----------------------- $SERVER1=servers/wintel $SERVER2=other/othersub PAGE=$SERVER1,$SERVER2 COLOR=red MAIL test at test.org RECOVERED

3 3

[hobbit] Problem viewing "Critical Systems"
by Tom_D._Bullers＠omb.eop.gov 11 Dec '06

11 Dec '06

I'm getting a segmentation fault when running the hobbit-nkview.sh script. I looked at the file that hobbit is generating when I select the "Critical Systems" file menu option. This is the content. <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>500 Internal Server Error</title> </head><body> <h1>Internal Server Error</h1> <p>The server encountered an internal error or misconfiguration and was unable to complete your request.</p> <p>Please contact the server administrator, you at example.com and inform them of This si the error in Apache: [Mon Dec 11 16:42:42 2006] [error] [client 10.11.14.60] Premature end of script headers: hobbit-nkview.sh, referer: http://localhost:10001/s-hob-cgi/bb-eventlog.sh When I try to execute the cgi script from the command line I get a segmentation fault: [s-hob1 at saomb60 cgi-bin]$ /home/s-hob1/hobbit/server/bin/hobbit-nkview.cgi Content-type: text/html Segmentation fault [s-hob1 at saomb60 cgi-bin]$ I did a standard compile under RedHat on a Compaq DL380 server. I don't know what else I can do to resolve this. Any Ideas? Thanks. -tom ~~~~~~~~~~~~~~~~~~~~~~ Tom Bullers Systems Administrator Phone: (202)395-5678 mailto:tom_bullers at omb.eop.gov > -----Original Message----- > From: Henrik Stoerner [mailto:henrik at hswn.dk] > Sent: Monday, December 11, 2006 11:36 AM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Problem viewing "Critical Systems" > > On Mon, Dec 11, 2006 at 11:20:43AM -0500, Bullers, Tom D. wrote: > > > I get the the same error, but with this browser it's a bit more > > descriptive - "The file hobbit-nkview.sh" is of type > application/x-sh, > > and Mozilla does not know how to handle this file type. > The file is > > lcoated at: http://hostname:1000 > > > > What should Mozilla do with this file?" > > > > It seems that Apache is trying to send the .sh file instead > of executing it and forwarding the output. > > What's the full URL for that link you're clicking on ? > "http://hostname:1000" doesn't look right, there must be > something more than that. > > Check your Apache setup for the ScriptAlias settings. The > results you get indicate that the directory with the > hobbit-nkview.sh is considered a normal document directory by > Apache, instead of a script (CGI) directory. > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > >

1 0

[hobbit] Help with disk monitoring
by PNIXON＠ci.somerville.ma.us 11 Dec '06

11 Dec '06

In the meantime, before you get around to all your clients, you can edit the bbsys.local file and change DF="/bin/df -k" Line to: DF="/bin/df -kP" Which will take out the extra line return. *PS - Dangit Henrik! I knew this answer and was looking for it to see where to change it! Hehehe! -----Original Message----- From: Bailey, Edward [mailto:ebailey at transunion.com] Sent: Monday, December 11, 2006 4:42 PM To: hobbit at hswn.dk Subject: RE: [hobbit] Help with disk monitoring Thanks for your quick response:) I did see that we have the big brother client installed so I need to plan on upgrading the clients first. Thanks again Ed > -----Original Message----- > From: Henrik Stoerner [mailto:henrik at hswn.dk] > Sent: Monday, December 11, 2006 4:28 PM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Help with disk monitoring > > On Mon, Dec 11, 2006 at 04:21:16PM -0500, Bailey, Edward wrote: > > Also the file systems from these problem servers show up > differently > > as well. The standard file system mounts are displayed without an > > issues but the LVM maps display the mount point but nothing else > > > > /dev/mapper/sysvg-opt > > /dev/mapper/sysvg-var > > /dev/cciss/c0d0p1 2016016 216060 1697544 12% / > > /dev/cciss/c0d0p2 3020172 950024 1916728 34% /usr > > This is a classical problem with the Big Brother client - you are > apparently using the BB client instead of the Hobbit client. What's > happening is that the "df" command used on the monitored servers > breaks long lines in the output, so your "df" output looks like > > Filesystem 1K-blocks Used Available Use% Mounted on > /dev/sda1 579598 192382 356293 36% / > /dev/mapper/vg1-lv_usr > 2568144 648964 1788724 27% /usr > /dev/mapper/vg1-lv_var > 1048540 733448 315092 70% /var > > and since the BB client does a 'grep "^/dev"' to weed out entries like > tmpfs, you only get the /dev/mapper line, not the next line with the > actual data in it. > > The solution is to change the DFCMD setting on your servers to "df > -P", making it use the POSIX format output. > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > > > ------------------------ CONFIDENTIALITY NOTICE This e-mail and any attachments contain information which may be confidential or privileged and exempt from disclosure under applicable law. If you are not the intended recipient, be aware that any disclosure, copying, distribution, or use of the contents of this information is without authorization and is prohibited. If you have received this email in error, please immediately notify us by returning it to the sender and delete this copy from your computer system. Thank you. ------------------------ To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

Help with disk monitoring
by ebailey＠transunion.com 11 Dec '06

11 Dec '06

Hello, I have recently inherited a sizable Hobbit environment so please have patience with my general ignorance of all things Hobbit. Our Hobbit works really well except for one notable exception and I can't figure out why. We have a series of boxes that run an application and for some reason these systems will not monitor the /opt file system and alert us when /opt goes over 90% even though these boxes have the same Hobbit setup like the others on the server side and the client side. The only difference I can see is that the /opt file system is mapped differently on these systems. Most systems use something like /dev/sda5 120G 82G 73% /opt But the problem systems use /dev/mapper/sysvg-opt 120G 82G 32G 73% /opt Also the file systems from these problem servers show up differently as well. The standard file system mounts are displayed without an issues but the LVM maps display the mount point but nothing else /dev/mapper/sysvg-opt /dev/mapper/sysvg-var /dev/cciss/c0d0p1 2016016 216060 1697544 12% / /dev/cciss/c0d0p2 3020172 950024 1916728 34% /usr The problem servers also have the follow error in the client side log Mon Dec 11 15:53:21 2006 bb-local.sh /opt/Big_Brother/bb/bin/bb-disk.sh: line 180: test: : integer expression expected Mon Dec 11 15:58:21 2006 bb-local.sh /opt/Big_Brother/bb/bin/bb-disk.sh: line 180: test: : integer expression expected Mon Dec 11 15:58:21 2006 bb-local.sh /opt/Big_Brother/bb/bin/bb-disk.sh: line 180: test: : integer expression expected Mon Dec 11 16:03:21 2006 bb-local.sh /opt/Big_Brother/bb/bin/bb-disk.sh: line 180: test: : integer expression expected >From bbdef.sh # # LOCAL CLIENT MONITORING CONFIGURATION FOR bb-local.sh # # WARNING AND PANIC LEVELS FOR LOCAL SYSTEM INFOMRAION # YOU CAN SET VALUES ON A SPECIFIC FILESYSTEM BY USING # THE etc/bb-dftab FILE # DFWARN=90 # (YELLOW) DISK % TO WARN DFPANIC=95 # (RED) DISK % TO PANIC export DFWARN DFPANIC The lines above and below line 180 of bb-disk.sh MARK="" if test "$DISKPCT" -ge "$DFWARNVAL" # ABOVE WARNING LEVEL then if test "$DISKPCT" -ge "$DFPANICVAL" # ABOVE PANIC, RED ALERT !!! then COLOR="red" MARK="PANIC" MARKLEVEL=$DFPANICVAL HIGHMARK="PANIC" GIFCOLOR="&red" REDLINE="${GIFCOLOR} ${DISKNAME} (${DISKPCT}%) has reached the defined disk space ${MARK} le vel (${MARKLEVEL}%) ${REDLINE}" else By default all servers are set to alert at 90% and 95% percent. Thanks in advance for everyone's help Ed Bailey ------------------------ CONFIDENTIALITY NOTICE This e-mail and any attachments contain information which may be confidential or privileged and exempt from disclosure under applicable law. If you are not the intended recipient, be aware that any disclosure, copying, distribution, or use of the contents of this information is without authorization and is prohibited. If you have received this email in error, please immediately notify us by returning it to the sender and delete this copy from your computer system. Thank you. ------------------------

2 2

Alerting on number of times a keyword appers in a logfile?
by jonescr＠cisco.com 11 Dec '06

11 Dec '06

Is this possible without an ext script? -Charles

4 5

[hobbit] Problem viewing "Critical Systems"
by Tom_D._Bullers＠omb.eop.gov 11 Dec '06

11 Dec '06

Here are the ScriptAlias settings from httpd.conf. They seem ok to me - I can't see what might be wrong with them. This directory: /home/s-hob1/hobbit/cgi-bin/ is where the nkview.sh script lives that it is complaining about. The driectory is ScriptAliased below in the 2nd stanza. I am restarting Apache after a change to httpd.conf. I am running Apache on port 10001. In my previos email I mentioned port 1000 but meant 10001. Again the error occurs when I select "Critical Systems" from the views prompt. Does the ScriptAlias directive look correct? Are there log files I can look at to get more detailed info? I'm not getting much out of the Apache logs and I can't find hobbit logs. Thanks much. -tom Alias /s-hob/ "/home/s-hob1/hobbit/server/www/" <Directory "/home/s-hob1/hobbit/server/www"> Options Indexes FollowSymLinks Includes MultiViews Order allow,deny Allow from all </Directory> ScriptAlias /s-hob-cgi/ "/home/s-hob1/hobbit/cgi-bin/" <Directory "/home/s-hob1/hobbit/cgi-bin"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all </Directory> ScriptAlias /s-hob-seccgi/ "/home/s-hob1/hobbit/cgi-secure/" <Directory "/home/s-hob1/hobbit/cgi-secure"> AllowOverride None Options ExecCGI Includes Order allow,deny Allow from all # Password file where users with access to these scripts are kept. # Create it with "htpasswd -c /home/s-hob1/hobbit/server/etc/hobbitpasswd USERNAME" # Add more users / change passwords with "htpasswd /home/s-hob1/hobbit/server/etc/hobbitpasswd USERNAME" # # You can also use a group file to restrict admin access to members of a # group, instead of anyone who is logged in. In that case you must setup # the "hobbitgroups" file, and change the "Require" settings to require # a specific group membership. See the Apache docs for more details. AuthUserFile /home/s-hob1/hobbit/server/etc/hobbitpasswd AuthGroupFile /home/s-hob1/hobbit/server/etc/hobbitgroups AuthType Basic AuthName "Hobbit Administration" # "valid-user" restricts access to anyone who is logged in. Require valid-user # "group admins" restricts access to users who have logged in, AND # are members of the "admins" group in hobbitgroups. # Require group admins </Directory> ~~~~~~~~~~~~~~~~~~~~~~ Tom Bullers Systems Administrator Phone: (202)395-5678 mailto:tom_bullers at omb.eop.gov > -----Original Message----- > From: Henrik Stoerner [mailto:henrik at hswn.dk] > Sent: Monday, December 11, 2006 11:36 AM > To: hobbit at hswn.dk > Subject: Re: [hobbit] Problem viewing "Critical Systems" > > On Mon, Dec 11, 2006 at 11:20:43AM -0500, Bullers, Tom D. wrote: > > > I get the the same error, but with this browser it's a bit > more descriptive - > > "The file hobbit-nkview.sh" is of type application/x-sh, > and Mozilla does not know how to handle this file type. The > file is lcoated at: http://hostname:1000 > > > > What should Mozilla do with this file?" > > > > It seems that Apache is trying to send the .sh file instead > of executing it and forwarding the output. > > What's the full URL for that link you're clicking on ? > "http://hostname:1000" doesn't look right, there must be > something more > than that. > > Check your Apache setup for the ScriptAlias settings. The results you > get indicate that the directory with the hobbit-nkview.sh is > considered > a normal document directory by Apache, instead of a script (CGI) > directory. > > > Regards, > Henrik > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > >

1 0

Files and Process Test
by tmelcher＠saionline.com 11 Dec '06

11 Dec '06

Would there be a way to a tie the files and a procs test together? I need to monitor a Process but only alarm if the process doesnt exist(isnt runing) and a specific file does exist. Thanks Trent Trent Melcher Unix/Linux Systems Administrator Securities America Financial Corporation (402) 399-9111 x2774 tmelcher at saionline.com Securities America, Inc., a Registered Broker/Dealer, Member NASD/SIPC. Advisory services offered through Securities America Advisors, Inc., an SEC Registered Investment Advisory The text of this communication is confidential, and use by any person who is not the intended recipient is prohibited. Any person who receives this communication in error is requested to immediately destroy the text of this communication without copying or further dissemination. Your cooperation is appreciated.

1 0

[hobbit] Problem viewing "Critical Systems"
by Tom_D._Bullers＠omb.eop.gov 11 Dec '06

11 Dec '06

Greg, I tried another test that allows me to connect directly to the display host without using a tunnel. I get the the same error, but with this browser it's a bit more descriptive - "The file hobbit-nkview.sh" is of type application/x-sh, and Mozilla does not know how to handle this file type. The file is lcoated at: http://hostname:1000 What should Mozilla do with this file?" It seems that Apache is trying to send the .sh file instead of executing it and forwarding the output. This does seem like an Apache config issue but I've made the changes suggested in the installation. Can you give me any other hints? Thanks. -tom ~~~~~~~~~~~~~~~~~~~~~~ Tom Bullers Systems Administrator Phone: (202)395-5678 mailto:tom_bullers at omb.eop.gov > -----Original Message----- > From: Bullers, Tom D. > Sent: Monday, December 11, 2006 11:04 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Problem viewing "Critical Systems" > > > Yes I am doing some tricks - I should have mentioned it. > > My test environment requires that I ssh tunnel through my > localhost to the remote machine on the defined network port. > I can see how this is foiling the cgi's. > > I thought I was having apache/cgi problems. > > I'll see what I can do about improving accessibility in my > test environment. > > Thanks much. > > > -tom > > > > > ~~~~~~~~~~~~~~~~~~~~~~ > Tom Bullers > Systems Administrator > Phone: (202)395-5678 > mailto:tom_bullers at omb.eop.gov > > > -----Original Message----- > > From: Hubbard, Greg L [mailto:greg.hubbard at eds.com] > > Sent: Monday, December 11, 2006 10:10 AM > > To: hobbit at hswn.dk > > Subject: RE: [hobbit] Problem viewing "Critical Systems" > > > > There is some required Apache setup to allow the Hobbit CGI > scripts to > > run correctly. Look in the etc directory on your Hobbit > server. But > > the problem may be related to the fact that IE is trying to run on > > "localhost" (the machine with the > > browser) instead of the display host? Are you doing some sort of > > virtual machine tricks? > > > > GLH > > > > > > ________________________________ > > > > From: Bullers, Tom D. [mailto:Tom_D._Bullers at omb.eop.gov] > > Sent: Monday, December 11, 2006 9:00 AM > > To: hobbit at hswn.dk > > Subject: [hobbit] Problem viewing "Critical Systems" > > > > > > > > Hi, > > > > New to the list here and new to Hobbit so sorry about the naïve > > nature of the request. > > > > I've just installed Hobbit 4.2 and am running insto > some errors in > > the Web interface. Most pages seem to load fine but when I select > > "views" and "critical systems" I'm presented with this > error. I get a > > similar error in Firefox. > > > > > > > > > > I've attched a screenshot, but it says "IE cannot download > > hobbit-nkview.sh from localhost" > > > > I wasn't able to find very descriptive logs. Only > apache reports a > > 500 error > > > > > > Do y'all have any suggestions? Thanks a lot. > > > > > > -tom > > > > > > > > > > ~~~~~~~~~~~~~~~~~~~~~~ > > Tom Bullers > > Systems Administrator > > Phone: (202)395-5678 > > mailto:tom_bullers at omb.eop.gov > > > > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > >

3 2

[hobbit] Problem viewing "Critical Systems"
by Tom_D._Bullers＠omb.eop.gov 11 Dec '06

11 Dec '06

Yes I am doing some tricks - I should have mentioned it. My test environment requires that I ssh tunnel through my localhost to the remote machine on the defined network port. I can see how this is foiling the cgi's. I thought I was having apache/cgi problems. I'll see what I can do about improving accessibility in my test environment. Thanks much. -tom ~~~~~~~~~~~~~~~~~~~~~~ Tom Bullers Systems Administrator Phone: (202)395-5678 mailto:tom_bullers at omb.eop.gov > -----Original Message----- > From: Hubbard, Greg L [mailto:greg.hubbard at eds.com] > Sent: Monday, December 11, 2006 10:10 AM > To: hobbit at hswn.dk > Subject: RE: [hobbit] Problem viewing "Critical Systems" > > There is some required Apache setup to allow the Hobbit CGI > scripts to run correctly. Look in the etc directory on your > Hobbit server. But the problem may be related to the fact > that IE is trying to run on "localhost" (the machine with the > browser) instead of the display host? Are you doing some > sort of virtual machine tricks? > > GLH > > > ________________________________ > > From: Bullers, Tom D. [mailto:Tom_D._Bullers at omb.eop.gov] > Sent: Monday, December 11, 2006 9:00 AM > To: hobbit at hswn.dk > Subject: [hobbit] Problem viewing "Critical Systems" > > > > Hi, > > New to the list here and new to Hobbit so sorry about > the naïve nature of the request. > > I've just installed Hobbit 4.2 and am running insto > some errors in the Web interface. Most pages seem to load > fine but when I select "views" and "critical systems" I'm > presented with this error. I get a similar error in Firefox. > > > > > I've attched a screenshot, but it says "IE cannot > download hobbit-nkview.sh from localhost" > > I wasn't able to find very descriptive logs. Only > apache reports a 500 error > > > Do y'all have any suggestions? Thanks a lot. > > > -tom > > > > > ~~~~~~~~~~~~~~~~~~~~~~ > Tom Bullers > Systems Administrator > Phone: (202)395-5678 > mailto:tom_bullers at omb.eop.gov > >

1 0