- Xymon - Xymon mailman web

[hobbit] Bbtest Program crashed
by subhash.gada＠logicacmg.com 13 Jan '06

13 Jan '06

Hi all, Can any one please help me on this problem. bbtest is crashed. Regards, Subhash gada ________________________________ From: Gada, Subhash [mailto:subhash.gada at logicacmg.com] Sent: Friday, January 13, 2006 12:01 AM To: hobbit at hswn.dk Subject: [hobbit] Bbtest Program crashed Hi, Bbtest is crashed and getting the following error - Program crashed, Fatal signal caught!. All the connectivity test turned to purple after some time. This is what am getting when I run bbtest-net with gdb tool. Any help is appreciated. (gdb) run Starting program: /home/hobbit/server/bin/bbtest-net Program received signal SIGSEGV, Segmentation fault. 0x400943ca in strcmp () from /lib/tls/i686/cmov/libc.so.6 Regards, Subhash This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

[hobbit] logic dependencies and combined to alerts
by brandste＠hebis.de 13 Jan '06

13 Jan '06

Hi Craig, thanks for the fast answer. "route" is a tag which follows "ip name # service" out of that and the "man explanation" i could form chains starting with SPF? 1.1.1.1 SPF # 1.1.2.1 Switch1 # route:SPF 1.1.3.1 Switch2 # route:SPF 1.1.3.2 Switch2.1 # route:SPF,Switch2 1.1.3.3 Switch2.2 # route:SPF,Switch2 1.1.3.4 Switch2.2.1 # route:SPF,Switch2,Switch2.2 1.1.4.1 Switch3 # route:SPF Will this work? In the man page is qouted that the --ping option has to be used somewhere... is --ping the default or do i need do recompile? This would be a possible workaround...but not a real satisfying state, cause status is changed to yellow and not "clear" on failingchains. Best Mathias In message <40A2891842052B40BF0AD6E6A83A9FA002324AA0 at svr-gbn-exc-02.mgc.mentorg .com>, "Whilding, Craig" writes: > route:router1,router2,.... > > This is an option you can add to switches in bb-hosts to do what you > want. If a switch fails, all those below it will go yellow instead of > red so you could just alert on red tests and so only get the SPF alert > you want.=20 > (I use this here). > > Craig > > -----Original Message----- > From: brandste at hebis.de [mailto:brandste at hebis.de]=20 > Sent: 13 January 2006 12:52 > To: hobbit at hswn.dk > Cc: brandste at hebis.de > Subject: [hobbit] logic dependencies and combined to alerts > > > Hi all, > > maybe a stupid question answerd in the mailinglist many times... > (but i was not able to find it in the archive or interpret > the man) > > As a new convert from bb to hobbit, first Congrats! It's > far less resource consuming then the former. > > We mainly use the tool for network observation, so the conn is > our friend. > We have a couple of network-devices located on different > campi around our location. Each of the campi has a single > point of failure (SPF) at the entry.=20 > There is only one hobbit (former bb) working. > > What i would like to do is, setting up alerts and colorchanges > depending of the state of the SPF. > > Example: > > location-1 > SPF - Switch1 > - Switch2 - Switch 2.1 > - Switch 2.2 - Switch 2.2.1 > - Switch3 > > If SPF fails i do not need to get messages from all the > Switches behind. > This i could handle with the tag PAGE in the alerts-cfg. > > PAGE=3Dlocation_1 > MAIL "NOC" SERVICE=3Dconn REPEAT=3D1h > =09 > Using it that way, (if i understood it) the "NOC" receives=20 > one mail per hour if the state changes from location-1. > Here i have no idea (and not tested) whether this includes Mails > from all hosts or not. > > At this stage i only need a message concerning the incident involving > SPF. > If switch1 or switch3 fail, obviously a mail concerning this incident. > But no mails from connected "sub"-switches... > > For receiving a message on a single incident > Including: > HOST=3Dswitch1 > MAIL "NOC" SERVICE=3Dconn REPEAT=3D1h > in the alerts-cfg, generates a mail independent from the former > PAGE=3D.... > or other settings? > > Has anybody found a solution for message dependencies like qouted? > > > *** > > Next would be the color change. > > Concerning this i found the keyword "depends", but no > sign that it will work in combination with the conn test.... > > 1.2.3.4 foo # > depends=3D(testA:host1/test1,host2/test2),(testB:host3/test3),[...] > > 1.1.1.1 SPF #=20 > 1.1.2.1 Switch1 # depends(conn:SPF/conn) > 1.1.3.1 Switch2 # depends(conn:SPF/conn) > 1.1.3.2 Switch2.1 # depends(conn:SPF/conn,conn:Switch2/conn) > 1.1.3.3 Switch2.2 # depends(conn:SPF/conn,conn:Switch2/conn) > 1.1.3.4 Switch2.2.1 # > depends(conn:SPF/conn,conn:Switch2/conn,Switch2.2/conn) > 1.1.4.1 Switch3 # depends(conn:SPF/conn) > > would this be the correct usage? > So if SPF fails, all page behind should be "clear?". > > > Is this possible with hobbit, or a future release? > > > Thanks in advance. > > Best > Mathias > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > > > To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk > > >

1 0

hobbitd-client crashes .......
by jens-ole.frimann＠thomson.com 13 Jan '06

13 Jan '06

the hobbitd-client crashes...... hobbit 4.1.2 running on fedora core 4 [hobbit at shire tmp]$ ls -lrt totalt 2440 -rw------- 1 hobbit hobbit 1347584 8 nov 03:17 core.367 -rw------- 1 hobbit hobbit 1347584 9 nov 02:03 core.2159 -rw------- 1 hobbit hobbit 1347584 9 nov 02:19 core.26334 -rw------- 1 hobbit hobbit 1347584 9 nov 02:39 core.26570 -rw------- 1 hobbit hobbit 1347584 9 nov 21:54 core.4670 -rw------- 1 hobbit hobbit 1347584 12 nov 02:29 core.14323 -rw------- 1 hobbit hobbit 1347584 13 nov 15:04 core.3043 <---- used this core file -rw-rw-r-- 1 hobbit hobbit 129 13 nov 23:42 alert.chk.sub -rw-rw-r-- 1 hobbit hobbit 742 13 nov 23:42 alert.chk -rw-rw-r-- 1 hobbit hobbit 276250 13 nov 23:44 hobbitd.chk type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". Reading symbols from shared object read from target memory...(no debugging symbo ls found)...done. Loaded system supplied DSO at 0xfc0000 Core was generated by `hobbitd_client'. Program terminated with signal 6, Aborted. warning: svr4_current_sos: Can't read pathname for load map: Ind/ud-fejl Reading symbols from /lib/libpcre.so.0...(no debugging symbols found)...done. Loaded symbols for /lib/libpcre.so.0 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x00fc0402 in __kernel_vsyscall () (gdb) bt #0 0x00fc0402 in __kernel_vsyscall () #1 0x003cd1f8 in raise () from /lib/libc.so.6 #2 0x003ce948 in abort () from /lib/libc.so.6 #3 0x0805515a in dprintf () #4 <signal handler called> #5 0x0804ac55 in ?? () #6 0x08421ed8 in ?? () #7 0x00000004 in ?? () #8 0xbfdc38e0 in ?? () #9 0xbfdc38dc in ?? () #10 0xb7f39f95 in ?? () #11 0xbfdc38f4 in ?? () #12 0xb7f379a8 in ?? () #13 0x00000000 in ?? () (gdb) Jens-Ole Frimann

3 2

Snapshot - hobbitd_client crashes
by CHRIS.MORRIS＠RWEnpower.com 13 Jan '06

13 Jan '06

Installed latest snapshot 13th January 2006 and hobbitd_client crashes :- Core was generated by `hobbitd_client'. Program terminated with signal 6, Aborted. Reading symbols from /usr/lib/libpcre.so.0...done. Loaded symbols for /usr/lib/libpcre.so.0 Reading symbols from /lib/i686/libc.so.6...done. Loaded symbols for /lib/i686/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x4005a801 in __kill () from /lib/i686/libc.so.6 (gdb) bt #0 0x4005a801 in __kill () from /lib/i686/libc.so.6 #1 0x4005a5da in raise (sig=6) at ../sysdeps/posix/raise.c:27 #2 0x4005bd82 in abort () at ../sysdeps/generic/abort.c:88 #3 <signal handler called> #4 0x0804e2dc in addtoruletree (ruletree=0x80600c0, hostname=0x0, pagename=0x0, item=0x0) at client_config.c:133 #5 0x0804f56d in getrule (hostname=0x0, pagename=0x0, ruletype=C_DISK) at client_config.c:498 #6 0x0804f8a8 in clear_counts (hinfo=0x8061f28, ruletype=C_DISK, head=0x805c860, tail=0x805c864, walk=0x805c868) at client_config.c:646 #7 0x0804faab in clear_disk_counts (hinfo=0x8061f28) at client_config.c:738 #8 0x0804a201 in unix_disk_report (hostname=0x4015d032 "trl0002", hinfo=0x8061f28, fromline=0xbfffe2a0 "\nStatus message received from 10.2.48.247\n", timestr=0x4015d05c "Fri Jan 13 12:06:13 GMT 2006", capahdr=0x8057c84 "Capacity", mnthdr=0x8057c7c "Mounted", dfstr=0x4015d13d "Filesystem 1024-blocks Used Available Capacity Mounted on\n/dev/hda8", ' ' <repeats 15 times>, "256194 78118 164848 33% /\n/dev/hda1", ' ' <repeats 16 times>, "51206 3407 45155 8% /boot\n/"...) at hobbitd_client.c:285 #9 0x0804b24f in handle_linux_client (hostname=0x4015d032 "trl0002", os=OS_LINUX, hinfo=0x8061f28, sender=0x4015d026 "10.2.48.247", timestamp=1137153979, clientdata=0x4015d040 "client trl0002.linux\n[date") at client/linux.c:50 #10 0x0804da90 in main (argc=1, argv=0xbfffe9b4) at hobbitd_client.c:890 #11 0x40049177 in __libc_start_main (main=0x804d03c <main>, argc=1, ubp_av=0xbfffe9b4, init=0x80492d4 <_init>, fini=0x8057490 <_fini>, rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbfffe9ac) at ../sysdeps/generic/libc-start.c:129 Chris **************************************************************************** The information contained in this email is intended only for the use of the intended recipient at the email address to which it has been addressed. If the reader of this message is not an intended recipient, you are hereby notified that you have received this document in error and that any review, dissemination or copying of the message or associated attachments is strictly prohibited. If you have received this email in error, please contact the sender by return email or call 01793 877777 and ask for the sender and then delete it immediately from your system.Please note that neither RWE npower nor the sender accepts any responsibility for viruses and it is your responsibility to scan attachments (if any). *****************************************************************************

2 1

[hobbit] logic dependencies and combined to alerts
by Craig_Whilding＠mentor.com 13 Jan '06

13 Jan '06

route:router1,router2,.... This is an option you can add to switches in bb-hosts to do what you want. If a switch fails, all those below it will go yellow instead of red so you could just alert on red tests and so only get the SPF alert you want. (I use this here). Craig -----Original Message----- From: brandste at hebis.de [mailto:brandste at hebis.de] Sent: 13 January 2006 12:52 To: hobbit at hswn.dk Cc: brandste at hebis.de Subject: [hobbit] logic dependencies and combined to alerts Hi all, maybe a stupid question answerd in the mailinglist many times... (but i was not able to find it in the archive or interpret the man) As a new convert from bb to hobbit, first Congrats! It's far less resource consuming then the former. We mainly use the tool for network observation, so the conn is our friend. We have a couple of network-devices located on different campi around our location. Each of the campi has a single point of failure (SPF) at the entry. There is only one hobbit (former bb) working. What i would like to do is, setting up alerts and colorchanges depending of the state of the SPF. Example: location-1 SPF - Switch1 - Switch2 - Switch 2.1 - Switch 2.2 - Switch 2.2.1 - Switch3 If SPF fails i do not need to get messages from all the Switches behind. This i could handle with the tag PAGE in the alerts-cfg. PAGE=location_1 MAIL "NOC" SERVICE=conn REPEAT=1h Using it that way, (if i understood it) the "NOC" receives one mail per hour if the state changes from location-1. Here i have no idea (and not tested) whether this includes Mails from all hosts or not. At this stage i only need a message concerning the incident involving SPF. If switch1 or switch3 fail, obviously a mail concerning this incident. But no mails from connected "sub"-switches... For receiving a message on a single incident Including: HOST=switch1 MAIL "NOC" SERVICE=conn REPEAT=1h in the alerts-cfg, generates a mail independent from the former PAGE=.... or other settings? Has anybody found a solution for message dependencies like qouted? *** Next would be the color change. Concerning this i found the keyword "depends", but no sign that it will work in combination with the conn test.... 1.2.3.4 foo # depends=(testA:host1/test1,host2/test2),(testB:host3/test3),[...] 1.1.1.1 SPF # 1.1.2.1 Switch1 # depends(conn:SPF/conn) 1.1.3.1 Switch2 # depends(conn:SPF/conn) 1.1.3.2 Switch2.1 # depends(conn:SPF/conn,conn:Switch2/conn) 1.1.3.3 Switch2.2 # depends(conn:SPF/conn,conn:Switch2/conn) 1.1.3.4 Switch2.2.1 # depends(conn:SPF/conn,conn:Switch2/conn,Switch2.2/conn) 1.1.4.1 Switch3 # depends(conn:SPF/conn) would this be the correct usage? So if SPF fails, all page behind should be "clear?". Is this possible with hobbit, or a future release? Thanks in advance. Best Mathias To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] logic dependencies and combined to alerts
by brandste＠hebis.de 13 Jan '06

13 Jan '06

Hi all, maybe a stupid question answerd in the mailinglist many times... (but i was not able to find it in the archive or interpret the man) As a new convert from bb to hobbit, first Congrats! It's far less resource consuming then the former. We mainly use the tool for network observation, so the conn is our friend. We have a couple of network-devices located on different campi around our location. Each of the campi has a single point of failure (SPF) at the entry. There is only one hobbit (former bb) working. What i would like to do is, setting up alerts and colorchanges depending of the state of the SPF. Example: location-1 SPF - Switch1 - Switch2 - Switch 2.1 - Switch 2.2 - Switch 2.2.1 - Switch3 If SPF fails i do not need to get messages from all the Switches behind. This i could handle with the tag PAGE in the alerts-cfg. PAGE=location_1 MAIL "NOC" SERVICE=conn REPEAT=1h Using it that way, (if i understood it) the "NOC" receives one mail per hour if the state changes from location-1. Here i have no idea (and not tested) whether this includes Mails from all hosts or not. At this stage i only need a message concerning the incident involving SPF. If switch1 or switch3 fail, obviously a mail concerning this incident. But no mails from connected "sub"-switches... For receiving a message on a single incident Including: HOST=switch1 MAIL "NOC" SERVICE=conn REPEAT=1h in the alerts-cfg, generates a mail independent from the former PAGE=.... or other settings? Has anybody found a solution for message dependencies like qouted? *** Next would be the color change. Concerning this i found the keyword "depends", but no sign that it will work in combination with the conn test.... 1.2.3.4 foo # depends=(testA:host1/test1,host2/test2),(testB:host3/test3),[...] 1.1.1.1 SPF # 1.1.2.1 Switch1 # depends(conn:SPF/conn) 1.1.3.1 Switch2 # depends(conn:SPF/conn) 1.1.3.2 Switch2.1 # depends(conn:SPF/conn,conn:Switch2/conn) 1.1.3.3 Switch2.2 # depends(conn:SPF/conn,conn:Switch2/conn) 1.1.3.4 Switch2.2.1 # depends(conn:SPF/conn,conn:Switch2/conn,Switch2.2/conn) 1.1.4.1 Switch3 # depends(conn:SPF/conn) would this be the correct usage? So if SPF fails, all page behind should be "clear?". Is this possible with hobbit, or a future release? Thanks in advance. Best Mathias

1 0

[hobbit] Re: Hobbit Alert config
by v.everett＠afgonline.com.au 13 Jan '06

13 Jan '06

Hmmm, makes sense. OK, then does anybody know if there a workaround for this? I want an e-mail on any colour fail, and an e-mail on recovery. On a condition red, I want an SMS, and an SMS on recovery from a red. Regards Vernon ----- No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ________________________________ From: James B Horwath [mailto:JamesHorwath at glic.com] Sent: Friday, 13 January 2006 7:13 PM To: hobbit at hswn.dk Subject: [hobbit] Re: Hobbit Alert config Vernon, My guess would be the "COLOR=red" token in the rule. When a recovery comes in the color isn't red, therefore no match. Regards, Jim ----- Message from "Vernon Everett" <v.everett at afgonline.com.au> on Fri, 13 Jan 2006 18:55:30 +0800 ----- To: <hobbit at hswn.dk> Subject: Hobbit Alert config Hi all Can anybody tell me if there is a specific order required for the entries in hobbit-alert.cfg? For instance, this line MAIL 55512345 at messagenet.com.au <mailto:0 at messagenet.com.au> FORMAT=SMS REPEAT=180 DURATION>5 COLOR=red RECOVERED alerts me to the issue, but I don't get a recovered SMS. I know Hobbit is configured correctly, because this line MAIL v.everett at afgonline.com.au <mailto:v.everett at afgonline.com.au> RECOVERED REPEAT=480 mails me the recovered notice. Cheers Vernon Jim Horwath SANS Certified: GCUX, GCIH, GCIA, GHTQ, GREM Unix Admin JamesHorwath at glic.com (W) 610-807-8795 (C) 610-533-6972 (F) 610-807-6003 ________________________________ This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ NOTICE: This message and any attachments are confidential and may contain copyright material of Australian Finance Group Limited or a third party. It is intended solely for the purpose of the addressee and any other named recipient. If you are not the intended recipient, any use, distribution, disclosure or copying of this message is strictly prohibited. The confidentiality attached to this message is not waived or lost by reason of the mistaken transmission or delivery to any unintended party. If you have received this message in error, please notify the author immediately or contact Australian Finance Group on +61 8 9420 7888.

1 0

Hobbit Alert config
by v.everett＠afgonline.com.au 13 Jan '06

13 Jan '06

Hi all Can anybody tell me if there is a specific order required for the entries in hobbit-alert.cfg? For instance, this line MAIL 55512345 at messagenet.com.au <mailto:0 at messagenet.com.au> FORMAT=SMS REPEAT=180 DURATION>5 COLOR=red RECOVERED alerts me to the issue, but I don't get a recovered SMS. I know Hobbit is configured correctly, because this line MAIL v.everett at afgonline.com.au RECOVERED REPEAT=480 mails me the recovered notice. Cheers Vernon ----- No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ NOTICE: This message and any attachments are confidential and may contain copyright material of Australian Finance Group Limited or a third party. It is intended solely for the purpose of the addressee and any other named recipient. If you are not the intended recipient, any use, distribution, disclosure or copying of this message is strictly prohibited. The confidentiality attached to this message is not waived or lost by reason of the mistaken transmission or delivery to any unintended party. If you have received this message in error, please notify the author immediately or contact Australian Finance Group on +61 8 9420 7888.

1 0

DNS reboot causes purples
by billieperez＠gmail.com 12 Jan '06

12 Jan '06

Hi all, I'm hoping someone might be able to help me. I'm running Hobbit 4.1.2 on a Fedora Core 4, monitoring approximately 500 servers. I have been running Hobbit for a few months and a few times our DNS server has been rebooted for patching. When this happens it causes some servers to go purple and the only way I've been able to fix this is to restart the Hobbit service but it has generated a ton of alerts and not a lot of happy alert recipients. My /etc/resolv.conf file has primary and secondary DNS servers, so I would have thought if one wasn't available it would use the other, but this doesn't seem to be the case. Has anyone seen this or know what I could do to prevent these purples from occuring when the DNS server is rebooted? Thanks much in advance.

3 5

Bbtest Program crashed
by subhash.gada＠logicacmg.com 12 Jan '06

12 Jan '06

Hi, Bbtest is crashed and getting the following error - Program crashed, Fatal signal caught!. All the connectivity test turned to purple after some time. This is what am getting when I run bbtest-net with gdb tool. Any help is appreciated. (gdb) run Starting program: /home/hobbit/server/bin/bbtest-net Program received signal SIGSEGV, Segmentation fault. 0x400943ca in strcmp () from /lib/tls/i686/cmov/libc.so.6 Regards, Subhash This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0