- Xymon - Xymon mailman web

Xymon PSClient version 3
by stef.coene＠docum.org 20 May '24

20 May '24

Hi, Recently we had a customer where random dll files in the Temp directory are flagged as malware. It turned out that this was caused by the nssm.exe used for the Xymon client service. Has anyone else had nssm.exe flagged as ransomware? I decided to rewrite the client and integrated the code from this script so nssm.exe is not needed: https://github.com/JFLarvoire/SysToolsLib/blob/master/PowerShell/PSService.… FYI, this also creates an .exe file and random files in the temp directory but they are nog flagged as malware. It looks like the random files are a way for Windows Service Manager to cope with the an .exe file as service. I also made sure I can do a seamless upgrade to this new client. This also means patching the 2.xxx client so it can be upgraded to this new version without interaction. I have to clean up my 2.xxx code and the new script and will update my github page in the next few weeks: https://github.com/StefCoene/xymon-stuff/tree/main/WinPSClient I also have to rollout the new client in our production environments so its' possible that I encounter some unexpected bugs. Stef

2 1

4.4alpha1: MACHINE setting
by roland＠spinnaker.de 20 May '24

20 May '24

Hi! I'm just working on packaging 4.4 Alpha1 for Debian (see experimental branch of https://salsa.debian.org/debian/xymon for more information). Doing so I had some trouble (change of behavior) with the setting of MACHINE when using a FQDN as hostname in xymon. If the system hostname (from /proc/sys/kernel/hostname used via uname call) contains any dots, these are not converted to commas, since commafy() returns a string with dots replaced by commas (while uncommafy() does return void and does the replacement directly in the given parameter). The attached 102_commafy_MACHINE.patch fixes this issue. If I try to set MACHINEDOTS somewhere in xymonserver.cfg, MACHINE needs to manually be set in relation to this replacing dots by commas. This isn't very handy but error prone, so I created 103_MACHINEDOTS2MACHINE.patch, which automatically sets MACHINE when MACHINEDOTS is set with dots replaced by commas. I'm not very good in coding C, so there may be better ways to implement this, but from my point of view such an automatism should be a good idea... Greetings Roland

1 0

findhost.sh with a different cfg env
by rower.master＠gmail.com 20 May '24

20 May '24

Hello all, In old xymon/hobbit 4.3.0 version I used to generate different views using bbcmd and modifieds hobbitserver.cfg and bb-hosts files. Also for these different views I was able to create independent findhosts and enable/disable views for these specific env and bb-hosts files. For example: $cat bb-findhost-nwgroupview.sh #!/bin/sh # This is the Hobbit CGI script interface to bb-findhost.CGI . /home/xymon/server/etc/hobbitcginwgroupview.cfg exec /home/xymon/server/bin/bb-findhost.cgi $CGI_FINDHOST_OPTS How can we do this kind of modified findhost cgi calls on Xymon version 4.3.30? How can I use and call findhost.sh to use a modified/renamed cgioptions.cgi ? Thanks in advance. Best regards, Mario

2 1

how to force a procs check
by malcolm.r.hunter＠gmail.com 15 May '24

15 May '24

You have to restart the client on all hosts you want to check On 15 May 2024 10:20:29 Ian Diddams via Xymon <xymon at xymon.com> wrote: > > how to force a procs check > FromIan Diddams didds3 at yahoo.co.uk > Date15 May, 10:20 > CCxymon at xymon.com > > > > the procs check is the usual out-of-the-box every-five-minutes check done > automagically by xymon of course. > > If one was to update analysis.cfg on the xymon server is there a way to > immediately force a procs check rather than wait several minutes for the > check to be run? > > didds

1 0

how to force a procs check
by stef.coene＠docum.org 15 May '24

15 May '24

No, you can not force a pros check because this is triggered by the client that sends data. You can restart the clients to force it to resend the data as quickly as possible. Stef On 2024-05-15 11:10, Ian Diddams via Xymon wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon

1 0

Update on 4.4 (Alpha1 release)
by cleaver＠terabithia.org 15 May '24

15 May '24

Hello all! Just wanted to update everyone on a few things. Going through the 4.x codebase re-familiarizing myself again with the state of everything, I recalled that I'd actually built a release artifact before development was paused, including a testing RPM that has actually been running unbeknownst on a VM for quite a while. Unfortunately, while validating that compiles from source worked I ran into what looked like showstopper bugs. These weren't showing up in the package, so I had to pore through a lot more code* than I expected to try to figure out where the package was accidentally fixing it. (*message-sending code, which changes a lot in 4.4 to support compression, TLS, HTTP, and size-prefixed messages) Fortunately, it ended up being a relatively simple issue (isn't it always?), with easy-enough validation and workaround (given below). Although more fixes could be put in (and I'm sure will be needed!), I believe there's some benefit to having a stable starting point using a build artifact from 2019. As a result, I'm pleased to announce the first alpha for Xymon 4.4! As this is an alpha release, this is absolutely NOT suitable for production use and is intended mainly for smoketesting by source users. (And I expect there will be smoke.) The release tarball is available now at: https://sourceforge.net/projects/xymon/files/Xymon/4.4-alpha/xymon-4.4-alph… Major improvements are too many to list here but are noted in the Changes and RELEASENOTES files. README documents for compression, TLS, and IPv6 are in progress. Some of the changes and improvements other than TLS support have been in the Terabithia packages (to some extent) for a while, so there will be less of a delta for those users to this alpha. For the moment, I'd like to focus on source tarball users and others running xymon from scratch to help fix underlying issues and any smoketest failures, which I expect may crop up particularly on untested non-Linux platforms. Once the lower-hanging fruit is fixed and more patches are upstreamed and cleaned up, I'll release an alpha2 release at which point packages may be released to help with testing iteration and downstream distributors. Please flag bug reports or patches as related to "alpha1" in the subject line to help keep things clear. Thank you to everyone in the community for remaining part of it -- and xymon users! -- during this interregnum. Restarting development has been a process, but I'm glad to take this important first step to our next release. Regards, -jc *** KNOWN ISSUES -- IMPORTANT *** The configure script is likely setting XYMONHOME/XYMONCLIENTHOME and XYMSRV/XYMSERVERS/XYMONSERVERS incorrectly, which will prevent xymonlaunch from correctly launching anything. Double check the xymon environment files (xymonserver/xymonclient.cfg) before starting either the server or client. The tools/xymon-client.default and tools/xymonlaunch files may be placed into /etc/{sysconfig,default}/{xymon-client,xymonlaunch} to more easily set $XYMONSERVERS Revealed by the above issue is a bug causing a crash in the client (or anywhere) when given an empty string as the destination argument (instead of 0, 127.0.0.1 or no variable set). Don't do this --> [ xymon '' "ping" ] The client and logfetch binary may be being re-compiled during 'make install' Compilation may fail if c-ares and at least one compression library is not present (lzo/lz4/zlib are all options). xxHash libraries are also highly recommended as the plan is for xxhash to replace md5 for checksumming functionality. libtirpc may be necessary on some platforms, and it's possible the build code is still expecting traditional (Sun) RPC

9 13

noconn & purple status
by tom＠4schmidts.com 25 Apr '24

25 Apr '24

Since you are using "dialup", no tests will go purple, they will instead go clear (white) if no report is received. That is by design (see man hosts.cfg). If you want it to generate the alert for other tests while ignoring the "ping" connection test status, then perhaps you need to use the "?conn" tag. This will make it perform the ping test, but report a clear status if it does not answer. Other tests should still report their normal status. Tom On Thu, Apr 25, 2024 at 4:15?AM Damien via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: damien at makelofine.org > To: Jeremy Ruffer <jeremy.ruffer at gmail.com> > Cc: xymon at xymon.com > Bcc: > Date: Thu, 25 Apr 2024 12:14:48 +0200 > Subject: Re: [Xymon] noconn & purple status > Hi Jeremy, > > My bad, the tag I'm using is dialup, not noconn... > > Le 25/04/2024 11:58, Jeremy Ruffer a ?crit : > > Hi Damian, > > > > I could be wrong, but I think that replacing noconn with dialup might > > suit you better. > > > > HTH > > > > Jeremy > > > > ------ Original Message ------ > > From: "Damien via Xymon" <xymon at xymon.com> > > To: "xymon at xymon.com" <xymon at xymon.com> > > Sent: 25/04/2024 10:46:27 > > Subject: [Xymon] noconn & purple status > > > >> _______________________________________________ > >> Xymon mailing list > >> Xymon at xymon.com > >> http://lists.xymon.com/mailman/listinfo/xymon > > > > ---------- Forwarded message ---------- > From: Damien via Xymon <xymon at xymon.com> > To: Jeremy Ruffer <jeremy.ruffer at gmail.com> > Cc: xymon at xymon.com > Bcc: > Date: Thu, 25 Apr 2024 12:14:48 +0200 > Subject: Re: [Xymon] noconn & purple status > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

noconn & purple status
by jeremy.ruffer＠gmail.com 25 Apr '24

25 Apr '24

Hi Damian, I could be wrong, but I think that replacing noconn with dialup might suit you better. HTH Jeremy ------ Original Message ------ From: "Damien via Xymon" <xymon at xymon.com> To: "xymon at xymon.com" <xymon at xymon.com> Sent: 25/04/2024 10:46:27 Subject: [Xymon] noconn & purple status >_______________________________________________ >Xymon mailing list >Xymon at xymon.com >http://lists.xymon.com/mailman/listinfo/xymon

2 1

noconn & purple status
by damien＠makelofine.org 25 Apr '24

25 Apr '24

Hi there, While setting some hosts with noconn tag (intermitently online), I faced a behavior that seems not optimal. Some of the tests were not running correctly, but their status stayed white (hence not propagated to non-green page), keeping me ignorant of this issue. I'd like these device tests to be considered online or offline all together. E.g: when CPU test status is green|yellow|red, the other tests are expected to report a status as well. If not, they should be purple. I hope my explanations are clear. My questions: -does anyone know how to configure Xymon to behave this way? -if not, does any of your have any idea how to achieve this? -if not, may I expect a change in future (if any) Xymon release? Regards, Damien

1 0

nvme temperature check broken in Debian bookworm
by zechner＠vrvis.at 23 Apr '24

23 Apr '24

Hi, the temperature check in xymon's version of bookworm is broken in a rather strange way. The check is located in /usr/lib/xymon/client/ext/temp and fails for all NVMe disks that contain several temperature sensors: For example the first NVMe in Lynx which holds its temperature values in /sys/block/nvme0n1/device/hwmon0/: files name value min max crit temp1_* Composite 27.85 -273.15 86.85 87.85 temp2_* Sensor 1 27.85 -273.15 65261.85 n/a temp3_* Sensor 2 31.85 -273.15 65261.85 n/a The inner logic of the temperature check works as follows to calculate the values for red and yellow: 1) if there is a crit and a max value use them 2) if there is a max and a mid value use them 3) if there is a max and a min value, use them 4) if there is only a max file, use it for both 5) if there is only a crit file, use it for both. The sensor 'Composite' uses max and crit as they're both available. 'Sensor 1' and 'Sensor 2' however do only provide max and min. Therefor these values are being used but lead to 'yellow' warnings as the min value actually isn't an upper boundary as assumed but a lower boundary. The linux kernel documentation (https://docs.kernel.org/hwmon/sysfs-interface.html) also outlines that every file using 'min' in their name is a low threshold: The common scheme for files naming is: <type><number>_<item>. Usual types for sensor chips are "in" (voltage), "temp" (temperature) and "fan" (fan). Usual items are "input" (measured value), "max" (high threshold, "min" (low threshold). The proposed fix would be to either use max value for yellow and red or to at least sanity check whether min is below zero and in that specific case only use the max value for both: In /usr/lib/xymon/client/ext/temp beginning on line 182: my ($red, $yellow); if (-r $crit_file and -r $max_file) { $red = read_one_chomped_line_from_file($crit_file); $yellow = read_one_chomped_line_from_file($max_file); } elsif (-r $max_file and -r $mid_file) { $red = read_one_chomped_line_from_file($max_file); $yellow = read_one_chomped_line_from_file($mid_file); } elsif (-r $max_file and -r $min_file) { $red = read_one_chomped_line_from_file($max_file); #TODO: min_file contains the lower temperature boundary and # *not* the warning value; only solution to this would # be to set either yellow to red or to at least do that # when yellow is below 0 for example. $yellow = read_one_chomped_line_from_file($min_file); $yellow = $yellow > 0 ? $yellow : $red; # Alternative solution: do not use min at all v1: #$red = $yellow = read_one_chomped_line_from_file($max_file); # Alternative solution: do not use min at all v2: remove this 'elsif' } elsif (-r $max_file) { $red = $yellow = read_one_chomped_line_from_file($max_file); } elsif (-r $crit_file) { $red = $yellow = read_one_chomped_line_from_file($crit_file); } There are three ways to solve this: * sanitize min by checking whether the value is below 0 and in that case use the max value * use the max value in any way * completely remove the 'elsif' that reads min and max as the next 'elsif' just reads and uses max Thanks in advance! Best regards Christoph

3 2