- Xymon - Xymon mailman web

[hobbit] Unexpected service response
by mlowery＠alliedtechgroup.com 23 Jun '05

23 Jun '05

Seems to be working with sendmail so far. I'll let you know if that changes. Thanks! Michael -----Original Message----- From: Henrik Stoerner [mailto:henrik at hswn.dk] Sent: Thursday, June 23, 2005 6:29 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Unexpected service response On Mon, Jun 13, 2005 at 02:59:35PM -0700, Bob Gordon wrote: > On 6/10/05, Henrik Storner <henrik at hswn.dk> wrote: > > > [smtp] > > send "rset\r\nquit\r\n" > > expect "220" > > options banner > > port 25 > > Unfortunately sendmail fills the syslog with messages like that below > when only the rset is used.... > > Jun 13 21:55:43 external.mrgordon.net sendmail[4100]: [ID 801593 > mail.info] j5DLthju004100: monitor.mrgordon.net [192.168.2.240] did > not issue MAIL/EXPN/VRFY/ETRN during connection to MTA (Going through the mailbox in preparation for the next release ...) How about this one: [smtp] send "vrfy postmaster\r\nquit\r\n" expect "220" options banner port 25 Works with qmail here ... hopefully it will work with Sendmail also. To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

[hobbit] Hobbitd_history crashing
by dstuffle＠deltafaucet.com 23 Jun '05

23 Jun '05

Stuffle, David wrote: > henrik at hswn.dk wrote: >> On Tue, Jun 14, 2005 at 10:59:31AM -0500, Stuffle, David >> wrote: >>> Hobbit 4.0.4 >>> Fedora Core 3 >>> >>> My hobbitd_history has crashed several times in the past >>> few weeks. It goes red with "Fatal signal caught" then >>> it goes purple. I have core files in the server/tmp >>> directory. Here is the debug output you have requested >>> in a previous post. Thanks! >>> >>> #3 0x0804d5de in sigsegv_handler (signum=11) at >>> sig.c:57 #4 <signal handler called> #5 0x0804a242 in >>> main (argc=1, argv=0xfef4a724) at hobbitd_history.c:194 >> >> I guess this can happen if a "disable" message does not >> provide any cause, i.e. "disable foo.test 180" >> >> Does this patch fix it for you ? >> >> >> Regards, >> Henrik > > Henrik, > > After applying the patch, I am still getting the crashes. > Here is the core file output. Thanks > > -bash-3.00$ gdb bin/hobbitd_history tmp/core.27019 > GNU gdb Red Hat Linux (6.1post-1.20040607.41rh) > Copyright 2004 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public > License, and you are welcome to change it and/or > distribute copies of it under certain conditions. Type > "show copying" to see the conditions. There is absolutely > no warranty for GDB. Type "show warranty" for details. > This GDB was configured as > "i386-redhat-linux-gnu"...Using host libthread_db library > "/lib/tls/libthread_db.so.1". > > Core was generated by `hobbitd_history'. > Program terminated with signal 6, Aborted. > Reading symbols from /lib/tls/libc.so.6...done. > Loaded symbols for /lib/tls/libc.so.6 > Reading symbols from /lib/ld-linux.so.2...done. > Loaded symbols for /lib/ld-linux.so.2 > #0 0x003ff7a2 in _dl_sysinfo_int80 () from > /lib/ld-linux.so.2 (gdb) bt #0 0x003ff7a2 in > _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 > 0x0043f955 in raise () from /lib/tls/libc.so.6 #2 > 0x00441319 in abort () from /lib/tls/libc.so.6 #3 > 0x0804d5f6 in sigsegv_handler (signum=11) at sig.c:57 #4 > <signal handler called> #5 nldecode (msg=0x804e926 "(No > reason given)") at encoding.c:250 #6 0x0804a9ac in main > (argc=1, argv=0xfeec01b4) at hobbitd_history.c:195 > (gdb) > > ~~~~~~~~~~~~~~ > David Stuffle > dstuffle at deltafaucet.com Delta Faucet Company Just found out that the person disabling didn't put a duration or a reason. I am having him change the scripts. ~~~~~~~~~~~~~~ David Stuffle Delta Faucet Company This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

2 1

A few questions about larrd and alerts
by frederic.mangeant＠steria.com 23 Jun '05

23 Jun '05

Hi Henrik I would like to graph only a few specific colums (namely those related to Hobbit), so I have this in etc/hobbitserver.cfg : LARRDS="bbgen,bbtest,bbproxy,hobbitd" GRAPHS="bbgen,bbtest,bbproxy,hobbitd" But the "trends" column shows on every host. Is there a way to disable it ? Another thing, I think I got some alerts which shouldn't be there. Here's my hobbit-alerts.cfg : HOST=foo MAIL frederic.mangeant at steria.com SERVICE=* EXSERVICE=cpu,Oracle REPEAT=12h MAIL frederic.mangeant at steria.com SERVICE=cpu DURATION>15m REPEAT=12h MAIL frederic.mangeant at steria.com SERVICE=Oracle REPEAT=1h TIME=W:0800:1900 COLOR=red,purple I got paged 3 times : - Hobbit [65660] HQSTERIAOAFOR:Oracle CRITICAL (RED) - Hobbit [65660] HQSTERIAOAFOR:Oracle CRITICAL (RED) - Hobbit [65660] HQSTERIAOAFOR:Oracle CRITICAL (RED) In the "info" column I can see : Service Recipient 1st Delay Stop after Repeat Time of Day Colors OAP frederic.mangeant at steria.com - - 12h - purple,yellow,red Oracle frederic.mangeant at steria.com - - 1h W:0800:1900 purple,red conn frederic.mangeant at steria.com - - 12h - purple,yellow,red cpu frederic.mangeant at steria.com 15m - 12h - purple,yellow,red disk frederic.mangeant at steria.com - - 12h - purple,yellow,red errpt frederic.mangeant at steria.com - - 12h - purple,yellow,red memory frederic.mangeant at steria.com - - 12h - purple,yellow,red procs frederic.mangeant at steria.com - - 12h - purple,yellow,red It seems to be coherent with hobbit-alerts.cfg... Do you have any clue ? Thanks in advance. -- Frédéric Mangeant Steria EDC Sophia-Antipolis

2 1

Increase DURATION for all alerts
by ctbeers＠syr.edu 23 Jun '05

23 Jun '05

I know this has been hashed before, but I can't seem to find the answer. How can I prevent hobbit from sending alerts unless the test has been down for 15 minutes (or some time) without using the DURATION tag? I seem to be putting DURATION>15 in all alert rules, so I am looking to set it globally. Regards, -- Christopher T. Beers Lead UNIX Architect - System Infrastructure Services (SIS) Syracuse University | 250 Machinery Hall | Syracuse, NY 13244 (315) 443-4103 Office | (315) 443-1621 Fax | p-ctbeers at syr.edu Pager

2 1

[hobbit] Unexpected service response
by mlowery＠alliedtechgroup.com 23 Jun '05

23 Jun '05

Michael Lowery, MCSE/CCNP Allied Technology Group, LLC. 501.372.4909 ext. 223 Yes, the strange thing is that they all give the 501 error, except Exchange servers, which give a 502 response. They all were returning the 220 message, in the banner, though. I have changed the smtp test to the following, and I get green, no flapping between Yellow and green anymore in the history files either. Is the test just wrong by default, or should I be concerned that I had to change it from the default? [smtp] send "ehlo hostname.domainname.com\r\nquit\r\n" expect "220" options banner port 25 -----Original Message----- From: Thomas [mailto:tlp-hobbit at holme-pedersen.dk] Sent: Friday, June 10, 2005 2:32 PM To: hobbit at hswn.dk Subject: Re: [hobbit] Unexpected service response Have you tried to do a telnet to the host on port 25 and type the commands to see the responce ? Br Thomas Lowery, Michael wrote: >Well, I've upgraded to Hobbit 4.0.4 and I'm still having smtp testing >issues. I'm hoping someone can help me figure out why this is happening >and guide me in the right direction. > >The problem is that I get Yellow results for a host that I'm running the >smtp test on. The server is running postfix and I thought that >information might be relevant, but it apparently isn't. This is >happening on all my smtp servers, but this is the only host that remains >Yellow. The others are always green, but have the same symptoms in >their history files. > >The error I get is "Unexpected service response" on the hobbit page. > >In bb-services I have: >[smtp] > send "mail\r\nquit\r\n" > expect "220" > options banner > port 25 > >In the hist file for the hosts, I get messages like the following: > >Wed Jun 8 23:20:11 2005 yellow 1118290811 38 >Wed Jun 8 23:20:49 2005 green 1118290849 262 >Wed Jun 8 23:25:11 2005 yellow 1118291111 38 >Wed Jun 8 23:25:49 2005 green 1118291149 262 >Wed Jun 8 23:30:11 2005 yellow 1118291411 38 >Wed Jun 8 23:30:49 2005 green 1118291449 263 >Wed Jun 8 23:35:12 2005 yellow 1118291712 20405 >Thu Jun 9 05:15:17 2005 green 1118312117 302 >Thu Jun 9 05:20:19 2005 yellow 1118312419 30 >Thu Jun 9 05:20:49 2005 green 1118312449 268 >Thu Jun 9 05:25:17 2005 yellow 1118312717 33 >Thu Jun 9 05:25:50 2005 green 1118312750 267 >Thu Jun 9 05:30:17 2005 yellow 1118313017 33 >Thu Jun 9 05:30:50 2005 green 1118313050 268 >Thu Jun 9 05:35:18 2005 yellow 1118313318 32 >Thu Jun 9 05:35:50 2005 green 1118313350 268 >Thu Jun 9 05:40:18 2005 yellow 1118313618 31 >Thu Jun 9 05:40:49 2005 green 1118313649 269 >Thu Jun 9 05:45:18 2005 yellow 1118313918 31 >Thu Jun 9 05:45:49 2005 green 1118313949 272 >Thu Jun 9 05:50:21 2005 yellow 1118314221 100607 >Fri Jun 10 09:47:08 2005 green 1118414828 297 >Fri Jun 10 09:52:05 2005 yellow 1118415125 10 >Fri Jun 10 09:52:15 2005 green 1118415135 292 >Fri Jun 10 09:57:07 2005 yellow 1118415427 20 >Fri Jun 10 09:57:27 2005 green 1118415447 279 >Fri Jun 10 10:02:06 2005 yellow 1118415726 31 >Fri Jun 10 10:02:37 2005 green 1118415757 268 >Fri Jun 10 10:07:05 2005 yellow 1118416025 44 >Fri Jun 10 10:07:49 2005 green 1118416069 256 >Fri Jun 10 10:12:05 2005 yellow 1118416325 49 >Fri Jun 10 10:12:54 2005 green 1118416374 251 >Fri Jun 10 10:17:05 2005 yellow 1118416625 56 >Fri Jun 10 10:18:01 2005 green 1118416681 244 >Fri Jun 10 10:22:05 2005 yellow 1118416925 1202 >Fri Jun 10 10:42:07 2005 green 1118418127 299 >Fri Jun 10 10:47:06 2005 yellow 1118418426 55 >Fri Jun 10 10:48:01 2005 green 1118418481 244 >Fri Jun 10 10:52:05 2005 yellow 1118418725 61 >Fri Jun 10 10:53:06 2005 green 1118418786 243 >Fri Jun 10 10:57:09 2005 yellow 1118419029 62 >Fri Jun 10 10:58:11 2005 green 1118419091 239 >Fri Jun 10 11:02:10 2005 yellow 1118419330 11 >Fri Jun 10 11:02:21 2005 green 1118419341 286 >Fri Jun 10 11:07:07 2005 yellow 1118419627 25 >Fri Jun 10 11:07:32 2005 green 1118419652 273 >Fri Jun 10 11:12:05 2005 yellow 1118419925 41 >Fri Jun 10 11:12:46 2005 green 1118419966 259 >Fri Jun 10 11:17:05 2005 yellow 1118420225 51 >Fri Jun 10 11:17:56 2005 green 1118420276 249 >Fri Jun 10 11:22:05 2005 yellow 1118420525 10703 > >Any help is greatly appreciated. > >Thanks, >Michael > >-----Original Message----- >From: Lowery, Michael >Sent: Tuesday, June 07, 2005 8:00 AM >To: hobbit at hswn.dk >Subject: RE: [hobbit] Unexpected service response > >Ok, this may have been a stupid question, I don't know. But after >further investigations, I see that this happens quite a bit on the other >SMTP servers as well, they just report it occasionally and not long >enough for me to be notified. There is only one host that constantly >reports this. > >Is there something I should change in the way the test works to avoid >getting the "Unexpected service response" message? > > >Thanks, >Michael > > >-----Original Message----- >From: Lowery, Michael >Sent: Monday, June 06, 2005 1:51 AM >To: hobbit at hswn.dk >Subject: [hobbit] Unexpected service response > >I've never had a problem with the SMTP test before. Now, testing a >postfix mail server, I get a Yellow alert, and the page says: > >Service smtp on mail.domain.com is not OK : Unexpected service response > > >501 Syntax error in parameters or arguments > > > >I can telnet to port 25 on this server with no problems from the hobbit >server, I get a 220 message upon connect. Here is exactly what I get >(names and IPs changed to protect the innocent). So what can be the >problem here? > >[root at hobbit etc]# telnet mail.domain.com 25 >Trying 20.30.40.51... >Connected to adsl-20-30-40-51.dsl.hometown.isp.net (20.30.40.51). >Escape character is '^]'. >220 SMTP service ready > >Thanks, >Michael > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > > >To unsubscribe from the hobbit list, send an e-mail to >hobbit-unsubscribe at hswn.dk > > > > > -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.4 - Release Date: 06-06-2005 To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

3 3

NT Client trend graphs
by caboyce＠rodney.govt.nz 23 Jun '05

23 Jun '05

Hi, I have moved from BB to hobbit and am having problems getting the memory data graphed from all the windows clients, There is no graph being generated for memory while Cpu and Disk are. I have also added Henrik's Citrix script and these stats are not being passed through. I have checked the LARRDS and GRAPHS section of hobbitserver.cfg and the entries to graph these items are enabled by default. I have enabled the debug options for larrdstatus and larrddata, In checking the log files I can see no entries for the client memory or the citrix stats. Any Ideas. Thanks Craig Boyce ##################################################################################### Disclaimer: The information in this electronic mail message is confidential and may be legally privileged. It is intended solely for the Addressee.Access to this internet electronic mail message by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you have received this message in error please notify us immediately. Rodney District Council accepts no responsibility for any effects this email message or attachments has on the recipient network or computer system. #####################################################################################

4 3

[hobbit] Multiple Views
by craig＠cookitservices.com 22 Jun '05

22 Jun '05

An embedded and charset-unspecified text was scrubbed... Name: not available URL: <http://lists.xymon.com/pipermail/xymon/attachments/20050622/91f161f3/attach…>

1 0

Multiple Views
by Al.Jeffcoat＠orhs.org 22 Jun '05

22 Jun '05

Hello All, I've got a question... And I apologize ahead of time if it's been covered already. We have been running bb/hobbit for some time. First it was on UNIX only, because the windows admins didn't like it. Then our execs saw it, and liked it. They then mandated that all systems will be monitored by hobbit. Here's where the problem starts. Windows has been generating a lot of red events. The execs overreact to red events that are really not problems. We've tired to explain that just because something is red, doesn't mean that a system is down. The windows admins are tuning it down as best as they can, but it still happens. So my thought was to have two hobbit's, one that receives client data for our engineers to see and work with, and then another that just does the network tests, and this would be what our execs see. Both would be sitting on the same server, running in separate directories, and separate virtual servers. What I'm trying to get to is two views, an executive view, and a technical view. Has anyone done something like this? Is there a better way within hobbit itself? TIA __________________________________ Al Jeffcoat This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandoregional.org . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Regional Healthcare by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Regional Healthcare.

4 3

[hobbit] System Log Monitoring
by Larry.Barber＠usda.gov 22 Jun '05

22 Jun '05

Enter the phrases you want to look for in the bb-msgtab file in your BB client's etc directory. Thanks, Larry Barber On Wed, 2005-06-22 at 09:26 -0500, callahant at tessco.com wrote: > Morning all, > Is there a way to monitor for certain key words that show up in > the > system logs? ie. I would like for hobbit to page me "iff" the words > "FAILOVER", "LOOP DEAD", and "LOOP DOWN" are detected in the > /var/logs/messages file on our Linux machines. > > Let me know if this is possible. > > Thanks, > Tom Callahan > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > > >

1 0

System Log Monitoring
by callahant＠tessco.com 22 Jun '05

22 Jun '05

Morning all, Is there a way to monitor for certain key words that show up in the system logs? ie. I would like for hobbit to page me "iff" the words "FAILOVER", "LOOP DEAD", and "LOOP DOWN" are detected in the /var/logs/messages file on our Linux machines. Let me know if this is possible. Thanks, Tom Callahan

1 0