- Xymon - Xymon mailman web

Port Check on a Server
by bb＠buglecreek.com 22 Apr '24

22 Apr '24

Hello, I have a system that is running a rsyslog server on a non standard port and is an appliance. I need to check that the several ports are up and listening, however I can not install a client on the system. The test would need to be initiated from the xymon server. I assume I need a custom script, can someone point me in the right direction for this. Heres nmap output. Preferably I'd like to check if the port 443, 517,8001, 8002,and 80003 are all open. If any of those are not open, go red. PORT STATE SERVICE 22/tcp closed ssh 443/tcp open https 517/tcp open XXXX 8001/tcp open XXXX 8002/tcp open XXXX 8003/tcp open XXXX

5 5

wiki.xymonton.org ?
by jeremy＠laidman.org 21 Apr '24

21 Apr '24

Galen Johnson (cc) is the maintainer. On Thu, 11 Apr 2024, 19:09 Damien via Xymon, <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: damien at makelofine.org > To: Becker Christian <christian.becker at rhein-zeitung.net> > Cc: "'xymon at xymon.com'" <xymon at xymon.com> > Bcc: > Date: Thu, 11 Apr 2024 11:01:06 +0200 > Subject: Re: [Xymon] wiki.xymonton.org ? > Indeed, it looks like the sqlite module is not loaded as per the error > message. > I've no idea why. > > Who admins this website? > > Le 11/04/2024 10:42, Becker Christian a ?crit : > > Hello to the list, > > > > does anybody know what happened to wiki.xymonton.org? There are errors > > on the site that prevent it to work. > > > > Regards > > > > Christian > > _______________________________________________ > > Xymon mailing list > > Xymon at xymon.com > > http://lists.xymon.com/mailman/listinfo/xymon > > > > ---------- Forwarded message ---------- > From: Damien via Xymon <xymon at xymon.com> > To: Becker Christian <christian.becker at rhein-zeitung.net> > Cc: "'xymon at xymon.com'" <xymon at xymon.com> > Bcc: > Date: Thu, 11 Apr 2024 11:01:06 +0200 > Subject: Re: [Xymon] wiki.xymonton.org ? > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

4 4

wiki.xymonton.org ?
by christian.becker＠rhein-zeitung.net 11 Apr '24

11 Apr '24

Hello to the list, does anybody know what happened to wiki.xymonton.org? There are errors on the site that prevent it to work. Regards Christian

2 1

how to ignore or hide MEMPHYS from linux clients
by kspringer＠innovateteam.com 10 Apr '24

10 Apr '24

I'd love to find out how to IGNORE or hide the MEMPHYS data coming from linux client hosts so the server doesn't graph anything for that specific memory info.? I've tried using the IGNORE flag in analysis.cfg but that seems to only work for Disk and Logs, not Memory.? Is there a way to accomplish this?? I'd also like to IGNORE the MEMACT data coming from Windows Powershell clients.? For whatever reason it seems that MEMPHYS and MEMACT are reversed between Windows and Linux, causing great confusion. -- Kris Springer

2 3

Monitoring network traffic
by R.Schrittenlocher＠ub.uni-frankfurt.de 08 Apr '24

08 Apr '24

Hi, first thanks to all contributing to xymon and the mailing list - we profit from your work for many years up to now! Our challenge at moment is how to monitor traffic quantity in/out in order to detect suspicious activities on Solaris 10. Is there are way to do this with xymon? greetings and thanks Rolf Rolf Schrittenlocher Bibliotheksmanagementsystem IT | IT-Services (ITS) Universit?tsbibliothek Johann Christian Senckenberg Goethe-Universit?t Frankfurt | Campus Bockenheim Zentralbibliothek | Freimannplatz 1 60325 Frankfurt am Main | GERMANY Telefon Sammelnummer +49 (0)69 798 28830 Telefon pers?nlich +49 (0)69 798 28908 E-Mail: lbs-it at ub.uni-frankfurt.de E-Mail (pers?nlich) r.schrittenlocher at ub.uni-frankfurt.de Website: https://www.ub.uni-frankfurt.de

6 9

Bug? procs test going red green every hour
by john.horne＠plymouth.ac.uk 26 Mar '24

26 Mar '24

Hello, We are using Xymon 4.3.30 from the Terabithia rpms on Linux servers. Sorry the message is a bit long; necessary in order to explain what is going on. We have recently noticed that the 'procs' test goes red every hour, and then 5 mins later changes to green. This happens just after the hour, and has only been seen on 4 servers. The procs test indicates a process (either 'clamscan' or 'freshclam') of the ClamAV package is not present. Looking into this I can see that the Xymon 'hostdata' output uses the 'ps' command to get the current processes. The actual 'ps' command is defined in 'xymonclient-linux.sh' as: ps -Aww f -o pid,ppid,user,start,state,pri,pcpu,time:12,pmem,rsz:10,vsz:10,cmd However, looking at the actual hostdata file for one of the servers shows: ===== 1197212 1 root Mar 10 S 19 0.0 00:00:06 0.0 3660 6072 /usr/sbin/crond -n 2822567 1197212 root 15:01:00 S 19 0.0 00:00:00 0.0 5168 12436 \_ /usr/sbin/CROND -n 2822568 2822567 root 15:01:00 S 19 0.0 00:00:00 0.0 3464 7124 \_ /usr/bin/bash /bin/run-parts /etc/cron.hourly 2822580 2822568 root 15:01:00 S 19 0.0 00:00:00 0.0 3388 7124 \_ /bin/bash /etc/cron.hourly/security.cron 2822581 2822568 root 15:01:00 S 19 0.0 00:00:00 0.0 1104 4016 \_ sed 1i\ /etc/cron.hourly/security.cron: 611279 1 clamscan Mar 14 S 19 0.0 00:03:23 8.6 1389464 1573272 /usr/sbin/ clamd -c /etc/clamd.d/scan.conf ===== ('security.cron' is just an in-house script.) As can be seen 'crond/CROND' runs 'run-parts', which in turn runs the 'cron.hourly' jobs (security.cron). However, that last line is corrupted - it is running a 'sed' command, but has the following 'ps' output command appended to it (the one with '/usr/sbin/clamd'). Hence, the 'procs' test sees the 'sed' command (we don't monitor for that), but misses the '/usr/sbin/clamd' command (which we do monitor) because it is all on one line. So the 'procs' test goes red. Five mins later, when the various jobs have ended, the clamd command is again seen within the 'ps' output because 'run-parts' is not running. So, looking at 'run-parts' (it's a shell script) shows that how it actually runs the cron jobs is by: ===== # run executable files logger -p cron.notice -t "run-parts[$$]" "($1) starting $(basename $i)" $i 2>&1 | sed '1i\ '"$i"':\ ' logger -p cron.notice -t "run-parts[$$]" "($1) finished $(basename $i)" ===== This where the 'sed' command comes from, and as can be seen it outputs newlines using the escape character. I have tested by changing the 'sed' command into just one line by replacing the newlines with "\n". This works fine, and the 'procs' test remains green. I also noticed that on CentOS 7 servers 'run-parts' uses 'awk' rather than 'sed'. So this is why the problem isn't seen on those servers - it is only seen on Rocky 8 and 9 Linux servers. I have also stopped the clamd process in order that some other process follows the run-parts one. The hostdata file again shows the new process as being appended to the sed command. If we are monitoring that new process, then again procs goes red. I need to do more testing, but am a little lost as to whether the bug (if it exists) is in the 'ps' output, the way it is recorded in the hostdata file or in the processing of the 'procs' test. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 7

xymon-client for linux over ssl
by kspringer＠innovateteam.com 19 Feb '24

19 Feb '24

Can anyone advise on the method to have the Debian xymon-client send its data to the Server using SSL instead of port 1984? Thanks so much --- Kris Springer

5 4

Xymon client with encryption + updated powershell client Windows
by stef.coene＠docum.org 18 Feb '24

18 Feb '24

Hi, I created a github repo with my drop-in replacement for the xymon binary on Unix (tested on AIX & Linux) that uses wget or curl for communication. This makes the data stream encrypted (https) and protected with username & password. I also added a copy of the Windows client with some bugfixes and enhancement. Link to the repo: https://github.com/StefCoene/xymon-stuff/ Stef

2 1

How to retrieve the global state of Xymon?
by henrik＠hswn.dk 18 Feb '24

18 Feb '24

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20240218/56172df9/attach…>

1 0

How to retrieve the global state of Xymon?
by tom＠4schmidts.com 18 Feb '24

18 Feb '24

You could simply look for the '<BODY class="green">' line in the ~xymon/server/www/nongreen.html or xymon.html file. The color shown for the "class" will match the overall state. A simple script could be written to run on your xymon server to gather this and send it to your monitor. Tom On Fri, Feb 16, 2024 at 8:16?AM Wim Nelis via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Wim Nelis <wim.nelis at ziggo.nl> > To: xymon at xymon.com > Cc: > Bcc: > Date: Fri, 16 Feb 2024 15:48:14 +0100 > Subject: How to retrieve the global state of Xymon? > > Hello, > > > my current project is (trying to) display the global state of Xymon, that > is the state (colour) shown in the main view. A sort of a traffic light is > used, which is controlled by an ESP8266 micro controller running > microPython. > > > This state must be determined from the states of all the tests, which can > be retrieved using the 'xymondboard' command. As far as I know, there is no > other way of retrieving the global state of Xymon. Is this correct? > > > The NOPROP* tags seem complicate things. One can retrieve the tag(s) per > host, using f.i. 'xymondboard fields=...,XMH_NOPROPRED', but the tag is > shown, not the result of combining it with the command line parameters of > xymongen. Is there another way of retrieving this information? > > > Kind regards, > > Wim Nelis. > > > > > > ---------- Forwarded message ---------- > From: Wim Nelis via Xymon <xymon at xymon.com> > To: xymon at xymon.com > Cc: > Bcc: > Date: Fri, 16 Feb 2024 15:48:14 +0100 > Subject: [Xymon] How to retrieve the global state of Xymon? > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

3 2