- Xymon - Xymon mailman web

[hobbit] log file monitoring issues
by gmbfly98＠gmail.com 02 Nov '06

02 Nov '06

Maybe I'm just missing something in the documentation, but I can't seem to get the log file monitoring to work properly. In the example below, I'm trying to look at the "messages" and "maillog" files on Linux. Particularly, I'm trying to EXCLUDE the following "messages" lines: Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 21:19:45 www upsd[7860]: Client on 127.0.0.1 logged out Aug 9 21:19:45 www upsd[7860]: Connection from 127.0.0.1 Aug 9 16:44:01 www crond(pam_unix)[5382]: session opened for user root by (uid=0) Aug 9 16:44:14 www crond(pam_unix)[5382]: session closed for user root Aug 9 16:45:01 www crond(pam_unix)[5484]: session opened for user mailman by (uid=0) Aug 9 16:45:01 www crond(pam_unix)[5484]: session closed for user mailman And EXCLUDE the following "maillog" lines: Aug 6 11:55:02 www sendmail[15076]: k76Ft1pU015076: from=<mailman at HOSTNAME>, size=576, class=0, nrcpts=1, msgid=<200608061555.k76Ft1A2015075 at HOSTNAME>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1] Below is the respective lines from the "client-local.cfg" file: log:/var/log/messages:10240 ignore upsd* Client|Connection 127.0.0.1 ignore session opened|closed for user mailman|root log:/var/log/maillog:10240 ignore relay=localhost.localdomain trigger denied And below the specific log entries I'm looking for from "hobbit-clients.cfg": LOG /var/log/maillog "relaying denied" color="yellow" Now, the problem I'm having... The "ignore" line for the /var/log/maillog file appears to be working correctly, as it does indeed ignore such entries as shown above. Also working is the "ignore session opened..." line for the /var/log/messages file. What is NOT working is the "ignore" line for the "upsd*" lines in /var/log/messages. For the life of me, I just can't figure out how to get that to work properly. That is, two of the three "ignore" lines are not working, as those lines still show up in the "full log" output. If anyone has any ideas, let me know. I'm also having problems with some logs not showing up on the messages page. Do you need both a "LOG" entries in the hobbit-clients.cfg AND client-local.cfg, or will an entry in only client-local.cfg be sufficient to have it show up on the messages page?

5 17

No recovered mail if red goes yellow?
by stefan.freisler＠aspect-online.de 02 Nov '06

02 Nov '06

Hi, what is to do if i will get recovered when status changed from red to yellow? I send SMS via Scripts where i made a test if the recovered Flag is set. My Problem is that we would get an recovered massage if it is going yellow. Is there an solution? thx wdsl

1 0

Ports data from other platforms
by rsmrcina＠wi.rr.com 01 Nov '06

01 Nov '06

I want to be able to provide ports data to Hobbit from the mainframe operating systems. They do not have and 'standard' Hobbit client nor do they present the equivalent of 'netstat' in the way that Linux does. I can reformat the 'netstat' into the Linux way, that's not a problem. What I would like to know is how to present this data to Hobbit so that it shows up properly in the ports column (with server based configuration and optional tracking capabilities). Is it as simple as sending the data as a 'ports' test or do I need to create a 'client' package and send it. If so, is the format the same as the 'client data' link with just that text data in the message? Thanks. -- Rich Smrcina VM Assist, Inc. Phone: 414-491-6001 Ans Service: 360-715-2467 rich.smrcina at vmassist.com Catch the WAVV! http://www.wavv.org WAVV 2007 - Green Bay, WI - May 18-22, 2007

2 2

bbtest-net.c
by Bradley_Wallace＠glic.com 01 Nov '06

01 Nov '06

Hobbit Server - version 4.1.2p1 When a server that's monitored by Hobbit does not respond to ping (it's down), Hobbit generates the following message: nro6000c:conn red [201160] red  Wed Nov 1 13:22:18 2006 conn NOT ok Service conn on nro6000c is not OK : Host does not respond to ping System unreachable for 1 poll periods (0 seconds) &red 10.102.0.197 is unreachable See http://Hobbit/hobbit-cgi/bb-hostsvc.sh?HOSTSVC=nro6000c.conn The "!" in the second line of the message causes problems in Linux when handling the error message with ksh shell scripts. I believe that this message is generated by bbnet/bbtest-net.c, line 1582. If I take out the exclamation, is there a way I can just recompile bbtest-net.c and insert it into Hobbit, without re-making the whole installation? Or am I better off re-making the whole thing? <hr size=1> This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

hobbit-alerts.cfg with TIME option
by shane.presley＠gmail.com 01 Nov '06

01 Nov '06

Hello, For most of our servers, we have a MAIL statement that sends e-mails out 24x7 for failures. But then we have another MAIL statement in the same rule that e-mails another group, and that should only happen 7AM to 5PM. My question is, if the failure happens at 3AM, e-mail #1 goes out. If it is still down at 7AM, shouldn't e-mail #2 go out? It appears right now that only failures that start during 7-5 will send e-mail. Anything that happens overnight, even if it is still failed at 7AM, it will not e-mail. Could this be because I've increased my ALERTREPEAT="1440" in hobbitserver.cfg? PAGE=vpn MAIL me at domain.com MAIL another at domain.com DURATION>5m TIME=*:0700:1700 SCRIPT qpage.sh qp-me FORMAT=SMS DURATION>30 TIME=*:0700:1700 Thanks, Shane

2 2

Critical Systems / NK
by rmunsch＠solutionsforprogress.com 01 Nov '06

01 Nov '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I'm not making any use of this feature in 4.2; i upgraded my server from 4.1.pwhatever, but don't see any new documentation about the critical systems config etc. I don't see anything on the wiki either. TIA, Rob Oh, Henrik: have you gotten to look at that howto? And is it any good :D - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFRmt/BvBcJFK6xYURArfrAJ0dG5ZfksCcjZE5zhhud0GStYy9BACfQSca qYo+nyYq7rNwRKENw4Xc6kQ= =EMCS -----END PGP SIGNATURE-----

3 4

[hobbit] Hobbit-perl-notes
by fduranti＠q8.it 01 Nov '06

01 Nov '06

> This is great! The only problem I'm having is > if I define a > Link, the link URL is ignored and instead the > link that is > created is a link to the notes page. A sample > link definition > that I am using is: > "Reports URL|Internal > Link|http://internal.reports.mydomain.com/" > > When I view the notes for the host, the > "Internal Link" takes > me to > > https://hobbitserver/hobbit-cgi/hobbitperl-notes.sh?HOST=myhostname# > > > > > The link is right, it should launch a javascript that > will open a new > page with the link. > Can you check the source of the html page? > > > Strange...I havn't changed anything, but now when I click the > link, Firefox prompts me to download a binary file. I > downloaded the file and it contains a small amount of binary > data along with ".com". > It's strange... Can you check the source code and find the find where the link is? It should be something like: <a onclick="javascript:window.open('http://www.dell.it')" href="#">Homepage</a> I've tested it and work with Explorer and Firefox 2 and it works good (opening a new page). It's possible that you have to check for firefox to let that site open popup windows (it will open a new window or new page it depend from the settings of firefox).

1 0

hobbit-alerts.cfg REPEAT option
by shane.presley＠gmail.com 01 Nov '06

01 Nov '06

Is there a global way to change the REPEAT value? I don't want my alerts to repeat, so I set them manually on each alert line with REPEAT=9999. Thanks Shane

4 5

Recovery pages after using DISABLE - bug or feature?
by jonescr＠cisco.com 31 Oct '06

31 Oct '06

When I disable a red alert, first a "recovery" notice is sent, indicating that the host "recovered". Then the disable notice is sent, informing that the host was disabled. The first message is a bit confusing since for example it will say the host recovered but the df output in the email/page clearly shows the disk is still 99% full. I would think that recovery messages should not be sent if a host/service is DISABLED, but perhaps it is a feature to notify folks who do not have the NOTIFY tag on their alert definition? -Charles

2 1

[hobbit] looking for sample code or a template in java to send status info to hobbit
by KauffmanT＠nibco.com 31 Oct '06

31 Oct '06

Which requires he already be familiar with TCP/IP programming in java, and work out how to parse bb-hosts to find the server name(s) . . . and the reason he's looking for a template or other sample code. Tom -----Original Message----- From: Rich Smrcina [mailto:rsmrcina at wi.rr.com] Sent: Monday, October 30, 2006 3:10 PM To: hobbit at hswn.dk Subject: Re: [hobbit] looking for sample code or a template in java to send status info to hobbit Open a connection on port 1984 and send a status message. There should be message examples in the doc. Kauffman, Tom wrote: > As it says -- one of our staff is up to his neck in java applications on > wintel and would appreciate some examples for schlepping status to > hobbit from within his process. > > Anything on deadcat or the shire I could point him at? > > TIA > > Tom Kauffman > NIBCO, Inc > CONFIDENTIALITY NOTICE: This email and any attachments are for the > exclusive and confidential use of the intended recipient. If you are not > the intended recipient, please do not read, distribute or take action in > reliance upon this message. If you have received this in error, please > notify us immediately by return email and promptly delete this message > and its attachments from your computer system. We do not waive > attorney-client or work product privilege by the transmission of this > message. > > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > -- Rich Smrcina VM Assist, Inc. Phone: 414-491-6001 Ans Service: 360-715-2467 rich.smrcina at vmassist.com Catch the WAVV! http://www.wavv.org WAVV 2007 - Green Bay, WI - May 18-22, 2007 To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk CONFIDENTIALITY NOTICE: This email and any attachments are for the exclusive and confidential use of the intended recipient. If you are not the intended recipient, please do not read, distribute or take action in reliance upon this message. If you have received this in error, please notify us immediately by return email and promptly delete this message and its attachments from your computer system. We do not waive attorney-client or work product privilege by the transmission of this message.

1 0