- Xymon - Xymon mailman web

delayred on conn
by bakgat8＠hotmail.com 22 Mar '16

22 Mar '16

I have searched through the archives but other than finding this tantalizing match To: xymon at xymon.com > Date: Wed, 26 Mar 2014 12:59:35 +0100 > From: henrik at hswn.dk > Subject: Re: [Xymon] Have network tests report yellow instead of red? > > Den 2014-03-25 18:19, John Thurston skrev: > > I must be blind, but I am unable to find a way to have a xymonnet > > test result go yellow instead of red. > > > > If I have the following line in my hosts.cfg: > > 0.0.0.0 foo.bar.com # telnet > > > > I'd like the telnet test to report yellow instead of red when the > > port test is not responding. I see I can prefix it with "?" to have > > it > > return clear instead of red, but how can I make it return yellow > > instead of red? > > Not possible, sorry. > > You can use 'delayred' to give it some time to recover without > triggering an alert. > > > Regards, > Henrik > I have not been able to figure out how to have a conn test (ping test) only turn red if it has been failing for 10 minutes. Anybody! Please and thank you. G

3 7

(no subject)
by torkil.zachariassen＠gmail.com 22 Mar '16

22 Mar '16

On our xymon (4.3.26) server, which otherwise works just fine, /var/log/xymon/xymonlaunch.log issues the following warning the following every 5 minutes. This again indicates that the culprit is xymonlaunch : WARNING: Cannot open include file '/var/run/xymonclient-runtime.cfg', line was: include /var/run/xymonclient-runtime.cfg This seems related to an earlier report @ http://comments.gmane.org/gmane.comp.monitoring.hobbit/26155 stating " that in: /usr/lib/xymon/client/etc/xymonclient.cfg on the server once the RPM is installed you need to replace the include statement with the below text: XYMSRV="" # IP address of the Xymon server XYMSERVERS="" # IP of multiple Xymon servers. XYMSRV must be "0.0.0.0". This is because the init script for the client correctly uses the /etc/default/xymon-client to create a file /var/run/xymonclient-runtime.cfg that is what is included, but the server init script does not do these things." I suppose there are multiple ways to resolve this, but some advice is needed: 1) include a few line into the server init script (/etc/init.d/xymon) which creates the xymonclients-runtime.cfg file 2) modify or remove the include line in /usr/lib/xymon/client/etc/xymonclient.cfg on the server We use rpms created from the supplied spec files, and the server has the xymon package installed only, as the xymon(-server) and xymon-client packages conflicts (you can not install both) For now we have commented the include line out manually, but please advise on what a proper resolution might look like. regards ...torkil...

2 1

Advanced HTML Mail Alert Perl script
by helge.jacobsen＠atos.net 21 Mar '16

21 Mar '16

Hi all, there is an old html_mail.pl script on https://wiki.xymonton.org/doku.php/alerts:html_mail1.2 . I like it, but I miss some features. So I take this script and make some updates and modifications: Different Mail Subject depending on Errorlevel Duration Time for any Message Flapping Status included in Subject and Mailtext Colorstatus depends on BBALPHAMSG for Recover Status. Nesessary if you using yellow for OKCOLOR Add Enable/Disable Mail Subject / Removing Backgroundcolor: not accessible in Outlook and makes mails in Thunderbird unreadable Fix for disable "until okay": Convert XYmon Recover Bodytext "for -1 minutes" to "until okay" maybe it is useful for someone here in the community but nobody knows it ? It is running on Xymon 4.3.26 and tested with Outlook 2010 and Thunderbird 38.6.0 And you found it here: https://wiki.xymonton.org/doku.php/alerts:html_mail2.0 regards Helge

1 0

PORTS and STATE syntax
by dboldt＠usgs.gov 18 Mar '16

18 Mar '16

I'm not successful filtering on the connection state associated with a port. None of the syntax variations I have tried have been successful. If I remove the STATE specifier, matches are found. There are multiple hosts connecting to the same port: ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57765 ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57766 ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57768 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45096 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45104 ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45107 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36141 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36150 ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36151 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34320 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34321 ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34324 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50726 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50727 ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50729 LISTEN 0 0 *:61617 *:* I've set up several port monitoring specifications, but none of them match the state (the first example where no state is specified succeeds): PORT LOCAL=%[:](61617) REMOTE=%10.160.8.132 MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-DHCP PORT LOCAL=%[:](61617) REMOTE=%10.160.8.133 STATE=ESTABLISHED MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-nsp.er PORT LOCAL=%[:](61617) REMOTE=%136.177.16.3 STATE=ESTAB MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.cr PORT LOCAL=%[:](61617) REMOTE=%137.227.240.32 STATE=%ESTAB MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.er PORT LOCAL=%[:](61617) REMOTE=%130.118.4.2 STATE=%ESTAB* MIN=3 MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.wr Note: On this server netstat does not exist and ss is being used,. Observation: Discovering the syntax for REMOTE was trial and error. Specifying the IP address alone did not work, and I found no examples for the type of filtering above. -- -- David Boldt <dboldt at usgs.gov> "Discovery consists of seeing what everybody has seen and thinking what nobody has thought." --Albert Szent-Gyorgyi (1893 - 1986)

2 4

OS version tags
by johan.karlsson＠deltait.se 18 Mar '16

18 Mar '16

Hi! We have an issue with RHEL7 and xymon-client 4.3.26 In client-local.cfg on our xymon server we have these log rules: [linux] log:/var/log/daemon.log:102400 log:/var/log/kern.log:102400 log:/var/log/syslog:102400 log:/var/log/messages:102400 ignore MARK [rhel3] log:/var/log/messages:102400 ignore MARK We have an old RHEL5 server which reports the following to Xymon and thus get matched against [rhel3] in client-local.cfg: [collector:] client oldserver,xxx,com.rhel3 rhel3 However, unconfigured the RHEL7 server reports: [collector:] client newserver,xxx,com.linux linux Setting CLIENTOS="rhel3" in /etc/sysconfig/xymon-client only changes the first: [collector:] client newserver,xxx,com.rhel3 linux We need it to report: [collector:] client newserver,xxx,com. rhel3 rhel3 Any idea where to change the setting for that? The issue is that RHEL doesn't have daemon.log, kern.log etc, so these turn up as warnings in the msgs test Regards, Johan

2 2

information about alerts
by velpulavenkat6＠gmail.com 17 Mar '16

17 Mar '16

Hi, this is venkat am using xymon monitoring tool i want to know some information about sound alerts to alert mails like yellow and red marks. -- *Regards* *Venkat Yadav*

2 1

Server to Server communication
by trevor.t.woods＠lmco.com 17 Mar '16

17 Mar '16

Hi, what's the best way to send data between xymon servers when http is not available. Our network will be very restricted and we can only send files through. I have setup a centralized master xymon server ready to go just trying to find the best solution of getting the data to it from the child servers. All I have found so far is creating pre generated report for the master server to read. Regards, Trev

3 2

How Xymon invokes an SSH connection to the Client?
by cs＠agege.com 17 Mar '16

17 Mar '16

Greetings, Please what kind of code or internal scripts Xymon runs to invoke an SSH connection to the client and what runs the Xymon client scripts. In order words, please could you enlighten me with the actual commands or codes or scripts that Xymon uses for the SSH connection and any Xymon codes running on each Client. Thanks, Agege

5 13

Purple Interval
by john＠executech.com 17 Mar '16

17 Mar '16

Is it possible to shorten the purple for the entire server? We have servers that don't have ICMP access so when the server goes offline, we rely on the purple alert to let us know that the server is down. With the 30 minute delay, I'm not getting those alerts until much after the server needs to be back up. Is it possible to change the delay so I would know sooner if the server is down? John Tullis

4 3

Xymon Digest, Vol 62, Issue 8
by cs＠agege.com 17 Mar '16

17 Mar '16

Greetings, Is there anyway to get an Xymon alert on Windows server that has been running for over 120days. -Agege > On Mar 10, 2016, at 5:00 AM, xymon-request at xymon.com wrote: > > Send Xymon mailing list submissions to > xymon at xymon.com > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.xymon.com/mailman/listinfo/xymon > or, via email, send a message with subject or body 'help' to > xymon-request at xymon.com > > You can reach the person managing the list at > xymon-owner at xymon.com > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Xymon digest..." > > > Today's Topics: > > 1. PORTS and STATE syntax (Boldt, David) > 2. Re: jmxstat (Andy Smith) > 3. The testip option does not seem to be honored by the http > test (Shawn Heisey) > 4. Re: The testip option does not seem to be honored by the http > test (John Thurston) > 5. How to change the refresh time for acknowledgements (john boris) > 6. Re: How to change the refresh time for acknowledgements > (Ryan Novosielski) > 7. Re: How to change the refresh time for acknowledgements > (Ryan Novosielski) > 8. Re: How to change the refresh time for acknowledgements > (john boris) > 9. Re: jmxstat (Galen Johnson) > 10. Always purple history after time shift on server - how to fix > (Andrey Chervonets) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 9 Mar 2016 09:09:16 -0500 > From: "Boldt, David" <dboldt at usgs.gov> > To: <xymon at xymon.com> > Subject: [Xymon] PORTS and STATE syntax > Message-ID: > <CAC_ry0YJfGtLA9sHeqLH6RnwRfMYeKbq+3S7EnS5AEBVsfcFng at mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > I'm not successful filtering on the connection state associated with a port. > None of the syntax variations I have tried have been successful. > If I remove the STATE specifier, matches are found. > > There are multiple hosts connecting to the same port: > > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57765 > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57766 > ESTAB 0 0 10.160.8.130:61617 10.160.8.132:57768 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45096 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45104 > ESTAB 0 0 10.160.8.130:61617 10.160.8.133:45107 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36141 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36150 > ESTAB 0 0 10.160.8.130:61617 130.118.4.2:36151 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34320 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34321 > ESTAB 0 0 10.160.8.130:61617 136.177.16.3:34324 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50726 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50727 > ESTAB 0 0 10.160.8.130:61617 137.227.240.32:50729 > LISTEN 0 0 *:61617 *:* > > I've set up several port monitoring specifications, but none of them > match the state (the first example where no state is specified > succeeds): > > PORT LOCAL=%[:](61617) REMOTE=%10.160.8.132 MIN=3 MAX=3 COLOR=yellow > TEXT=ActiveMQ-DHCP > PORT LOCAL=%[:](61617) REMOTE=%10.160.8.133 STATE=ESTABLISHED MIN=3 > MAX=3 COLOR=yellow TEXT=ActiveMQ-nsp.er > PORT LOCAL=%[:](61617) REMOTE=%136.177.16.3 STATE=ESTAB MIN=3 MAX=3 > COLOR=yellow TEXT=ActiveMQ-ns.cr > PORT LOCAL=%[:](61617) REMOTE=%137.227.240.32 STATE=%ESTAB MIN=3 MAX=3 > COLOR=yellow TEXT=ActiveMQ-ns.er > PORT LOCAL=%[:](61617) REMOTE=%130.118.4.2 STATE=%ESTAB* MIN=3 > MAX=3 COLOR=yellow TEXT=ActiveMQ-ns.wr > > Note: On this server netstat does not exist and ss is being used,. > > > Observation: Discovering the syntax for REMOTE was trial and error. > Specifying the IP address alone did not work, and I found no examples > for the type of filtering above. > > -- > -- David Boldt > <dboldt at usgs.gov> > > > "Discovery consists of seeing what everybody has seen and thinking > what nobody has thought." > --Albert Szent-Gyorgyi (1893 - 1986) > > > ------------------------------ > > Message: 2 > Date: Wed, 9 Mar 2016 16:36:44 +0000 > From: Andy Smith <abs at shadymint.com> > To: Galen Johnson <Galen.Johnson at sas.com>, "xymon at xymon.com" > <xymon at xymon.com> > Subject: Re: [Xymon] jmxstat > Message-ID: > <CAFz9LfvL-9XVo5BOui2oDy4XXqRPmajP-yhAyfEfrObzxB6Y=g at mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > ---------- Forwarded message ---------- >> From: Galen Johnson <Galen.Johnson at sas.com> >> Date: 9 March 2016 at 00:26 >> Subject: [Possible Spam] [Xymon] jmxstat >> To: "xymon at xymon.com" <xymon at xymon.com> >> >> Hey, >> >> I don't think this is specific to jmxstat but I'm trying to implement. I'm getting the > following in apache log when I hit the page: >> >> Setup error: Service GCInfo has a graph GCInfo, but no graph-definition,... >> >> However, the definition does exist and I can view the graphs if I select a different > > service and change the name in the URL. RRDs are being created. >> >> Anyone else run into this and overcome it? >> >> thanks > > Not seen that before, but just check for me please, is GCInfo mentioned in > both TEST2RRD and GRAPHS in xymonserver.cfg? > -- > Andy > > > ------------------------------ > > Message: 3 > Date: Wed, 9 Mar 2016 10:53:08 -0700 > From: Shawn Heisey <hobbit at elyograg.org> > To: xymon at xymon.com > Subject: [Xymon] The testip option does not seem to be honored by the > http test > Message-ID: <56E06304.6040301 at elyograg.org> > Content-Type: text/plain; charset=utf-8 > > I have the following in my hosts.cfg file: > > 10.100.2.131 fourqueens.REDACTED.com # testip ssh > mgmt=10.2.6.131[http,https,ssh] https://megaagency.REDACTED.com > delayred=http:10 > 10.100.2.132 fitzgeralds.REDACTED.com # testip ssh > mgmt=10.2.6.132[http,https,ssh] https://megaagency.REDACTED.com > delayred=http:10 > > The "mgmt" option controls a custom server-side script we wrote that > verifies reachability of the out-of-band server management (Dell DRAC in > this case). > > I had expected the "testip" option to force the https URL test to be > sent directly to the server, not the DNS address (which is a load > balancer), but I can see the load balancer cookie in the response and > requests in the load balancer's log. > > Is there any way to get the intended behavior? > > The server is running 4.3.23 with the patch to fix http response code > interpretation. > > Thanks, > Shawn > > > ------------------------------ > > Message: 4 > Date: Wed, 09 Mar 2016 09:00:09 -0900 > From: John Thurston <john.thurston at alaska.gov> > To: xymon at xymon.com > Subject: Re: [Xymon] The testip option does not seem to be honored by > the http test > Message-ID: <56E064A9.300 at alaska.gov> > Content-Type: text/plain; CHARSET=US-ASCII; format=flowed > > On 3/9/2016 8:53 AM, Shawn Heisey wrote: > - snip - >> I had expected the "testip" option to force the https URL test to be >> sent directly to the server, not the DNS address (which is a load >> balancer), but I can see the load balancer cookie in the response and >> requests in the load balancer's log. > > The TESTIP controls the behavior of the CONN test. To make the HTTP test > use an IP address instead of resolving the name, use the following syntax: > http://www.sample.com=1.2.3.4/index.html > > From the hosts.cfg man page: > >> Testing sites by IP-address >> xymonnet ignores the "testip" tag normally used to force a test to use the IP-address from the hosts.cfg file instead of the hostname, when it performs http and https tests. >> The reason for this is that it interacts badly with virtual hosts, especially if these are IP-based as is common with https-websites. >> Instead the IP-address to connect to can be overridden by specifying it as: >> http://www.sample.com=1.2.3.4/index.html >> The "=1.2.3.4" will case xymonnet to run the test against the IP-address "1.2.3.4", but still trying to access a virtual website with the name "www.sample.com". >> The "=ip.address.of.host" must be the last part of the hostname, so if you need to combine this with e.g. an explicit port number, it should be done as >> http://www.sample.com:3128=1.2.3.4/index.html > > > -- > Do things because you should, not just because you can. > > John Thurston 907-465-8591 > John.Thurston at alaska.gov > Enterprise Technology Services > Department of Administration > State of Alaska > > > ------------------------------ > > Message: 5 > Date: Wed, 9 Mar 2016 13:03:13 -0500 > From: john boris <jborissr at gmail.com> > To: xymon at xymon.com > Subject: [Xymon] How to change the refresh time for acknowledgements > Message-ID: > <CAOk1TCyYkPqGEVNE=6eXDfOwpxd=_0_AneWivxn0WBjgaXdO0w at mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > How can you change the response time when you acknowledge an issue so that > it shows up as a check and you don't get pinged repeatedly. It looks like > it takes about 5 minutes for the acknowledgement to take place. > > -- > John J. Boris, Sr. >

3 2