- Xymon - Xymon mailman web

RSS option with critical view
by Andy.Farrior＠victoriacollege.edu 03 Feb '16

03 Feb '16

Thought I'd experiment with the XYMONGENOPTS "-rss" option today. It's creating the RSS files for each page and the main, nongreen, and red status pages just fine; however, the critical.rss file doesn't match the critical view display. The critical.rss file does match the critical.html file that's created. So, in my case, critical.rss and critical.html both display "No Critical Alerts" However, my /xymon-cgi/criticalview.sh lists the systems with issues. What did I miss in the configuration? Thx, Andy Andy Farrior Director of Technology Services Victoria College 2200 E Red River Victoria, TX 77901 Andy.Farrior at VictoriaCollege.edu Office: 361.582.2547 Fax: 361.572.6492

2 1

http tests
by matt＠oddprocess.org 03 Feb '16

03 Feb '16

I upgraded our xymon install from 4.3.17 to 4.3.24 and everything was very smooth, so thank you very much! However, I'm seeing some strange issues with http codes that worked fine before and now throw red alarms. I have 1 server that throws a red when checking an https url: https://server:8443/ Worked fine with .17, now throws a red 401 Unauthorized error: https://server:8443/ - Unauthorized HTTP/1.1 401 Unauthorized Server: Apache-Coyote/1.1 X-FRAME-OPTIONS: SAMEORIGIN Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Set-Cookie: JSESSIONID=3C8BDD2EF0D9FC1D6959D8410328186B; Path=/; Secure; HttpOnly Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Content-Length: 3452 Date: Wed, 03 Feb 2016 14:25:22 GMT Connection: close I poked around the archives and saw some random stuff regarding new http codes, but couldn't figure out how to make this go green. Any suggestions? Thanks for the help! -- Matthew Daubenspeck Gentoo Linux x86_64 Intel(R) Xeon(R) CPU E5-2680 v2 @ 2.80GHz 09:23:11 up 50 days, 9:57, 3 users, load average: 0.02, 0.02, 0.05

2 1

Increasing graph percentage to static number?
by Foster.Patch＠accuweather.com 03 Feb '16

03 Feb '16

Hello, Below I've included a graph of ephemeral port usage. Our team that monitors this will sometimes not notice the numbers to the left, and see the line getting up to the top, and assume it is hitting maximum, when it is only hitting 30%. I understand that these graphs are made relative to the percentage of use. I was wondering if there was any way to set a static percentage number to these graphs, so it will display 100%, even if the line may never hit it, so that this mistake no longer happens. Nothing with high importance here, just curious if this was a setting that could be modified. Thanks, Foster Patch

2 1

hostname retrieval is broken after adding a host
by john.thurston＠alaska.gov 02 Feb '16

02 Feb '16

This defect is getting to be a serious problem in my production Xymon. For specifics, see my notes of 20151201 and 20151214 : http://lists.xymon.com/pipermail/xymon/2015-December/042712.html http://lists.xymon.com/pipermail/xymon/2015-December/042787.html In general, adding a host to hosts.cfg corrupts the in-memory list of valid hosts. This causes other worker processes (specifically "alert") to fail. It doesn't fail _completely_. Some alerts continue to be sent, but there are footprints in the logs. I have a script watching for these footprints. When seen, I kill the "xymond_channel --channel=page" process, a new one is started, and business continues. I need to squash this bug. Is there a way to interactively run a worker process and have it hit the in-memory table of hostnames? If not, is there a way to spill the in-memory table of hostnames without using a debugger? Can anyone tell me which worker processes us the in-memory host list? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

3 6

xymond crashing! -- Please help!
by matt1299＠gmail.com 31 Jan '16

31 Jan '16

Hello, I'm having a major issue with xymond crashing shortly after the service starts. I'm using the the latest Terabithia RPM for RHEL 7 (4.3.24-3.el7.terabithia). When I check the status of the xymon service, it shows it as up but with only the xymonlaunch parent process and vmstat processes. Upon restarting the service, I see it start normally (all the normal channel processes, etc.) and then after a while they all go away, leaving the following process behind: ├─2760 xymon-signal 0.0.0.0 status+1d/group:signal <server hostname>.xymond red (Check time of report) - xymond program crashed Fatal signal caught! along with the xymonlaunch process and some vmstat processes. After a while that process goes away. Sometimes a single xymond_rrd will show up alongside the xymonlaunch and vmstat processes as well after a little while. I'm already running xymond in --debug mode. This is what I see in the xymond log around the time of the crash: 2773 2016-01-30 11:02:32.515505 Status: Host=<host>, test=ntp 2773 2016-01-30 11:02:32.515507 -- create_hostlist_t for <host> (<client IP address>) 2773 2016-01-30 11:02:32.515513 Status: Host=<host>, test=conn 2773 2016-01-30 11:02:32.515520 Status: Host=<host>, test=raid 2773 2016-01-30 11:02:32.515529 Status: Host=<host>, test=memory 2773 2016-01-30 11:02:32.515534 Status: Host=<host>, test=files 2773 2016-01-30 11:02:32.515670 Status: Host=<host>, test=procs 2773 2016-01-30 11:02:32.515879 Status: Host=<host>, test=inode 2773 2016-01-30 11:02:32.515891 Status: Host=<host>, test=disk 2773 2016-01-30 11:02:32.516004 Status: Host=<host>, test=cpu 2773 2016-01-30 11:02:32.516605 Loaded 14419 status logs 2016-01-30 11:02:32 Setting up network listener on 0.0.0.0:1984 2016-01-30 11:02:32.516677 Cannot bind to listen socket (Address already in use) 2016-01-30 11:02:59.538906 Whoops ! Failed to send message (Timeout) 2016-01-30 11:02:59.539020 -> 2016-01-30 11:02:59.539023 -> Recipient '<server IP address>', timeout 50 2016-01-30 11:02:59.539024 -> 1st line: 'status+1d/group:signal <server hostname>.xymond red (Check time of report) - xymond program crashed' It seems to get finished with loading all the hosts and then it crashes (the last host before it crashes is the last client I have alphabetically). I've tried stopping the service, killing off any remaining xymon owned processes, and started the service with the same results. I've also tried restarting the xymon server machine itself, with the same crash happening when the service starts the first time. This just started happening out of the blue a couple of hours ago... Looking in netstat, there are no active connections using port 1984 on the local side, just a bunch of clients trying to connect to the server with 1984 in the foreign address. ANY help would be much appreciated as currently our Xymon server is not working!! Thanks!! -- Matt Vander Werf

2 10

Memory data handling from Windows clients
by john.r.rothlisberger＠accenture.com 29 Jan '16

29 Jan '16

We recently experienced a series of memory alerts on our windows servers that didn't make sense. Although Xymon was indicating that virtual memory was completely used, logging into the server itself showed there were no issues. At first, I had thought there was something wrong with the data that the XymonPS client was sending and working with Zak Beck we found a small tidbit of code to resolve a "bbwin bug". By flopping a 0 to a 1 we could reverse the way the numbers were reported and yet this didn't resolve the problem. It became obvious that the data being sent from the XymonPS client was correct but once on the server something was getting handled differently. Below is a detailed look at what we were seeing and then how I corrected it. The corrections may or may not want to be included in future code releases. Here is what the XymonPS data looked like when we were getting alerts. As you can see there is nothing that would indicate a problem: [memory] memory Total Used physical: 4095 1266 virtual: 4506 4111 <--- These are the numbers we are interested in. page: 8600 5297 This is what was the Xymon server used to create our alert: Memory Used Total Percentage Physical 1266M 4095M 30% Actual 4111M >>> 4095M <<< 100% <--- Here is the alert Swap 5297M 8600M 61% As you can see - the "Total" available "Actual" memory is the same as the Total available Physical memory. But, this is not right, the total available Actual memory should have been 4506M. Just for the sake of having this information included, here is what the memory data looks like from a linux client (there is no issue here): Linux data: [free] total used free shared buffers cached Mem: 16556808 4895408 11661400 0 259376 2508448 -/+ buffers/cache: 2127584 14429224 Swap: 1340412 0 1340412 Displayed: Memory Used Total Percentage Physical 4780M 16168M 29% Actual 2077M 16168M 12% Swap 0M 1308M 0% So, I had to find out why the total physical memory was used to calculate the percentage of used space for the "Actual" memory when the client is a Windows server (XymonPS or BBWin). What I found was that although there is a variable used for memactused there was nothing for memacttotal. So I added a new value for memacttotal which then required me to add the same values to bbwin.c (see below). This also required a modification to linux.c (see below) which instead of using memacttotal, it simiply reususes the value for memphytotal which is essencially the same thing that is currently being done now. Although I have provided patch files for bbwin.c and linux.c ALL of the xymond/client/*.c files need to be modified. xymond_client.c patch: --- xymond_client.c.ORIG 2016-01-27 09:53:58.321793949 -0600 +++ xymond_client.c 2016-01-28 12:57:51.676006980 -0600 @@ -909,7 +909,7 @@ void unix_memory_report(char *hostname, char *clientclass, enum ostype_t os, void *hinfo, char *fromline, char *timestr, - long memphystotal, long memphysused, long memactused, + long memphystotal, long memphysused, long memacttotal, long memactused, long memswaptotal, long memswapused) { long memphyspct = 0, memswappct = 0, memactpct = 0; @@ -938,7 +938,7 @@ if (memswappct > swapred) swapcolor = COL_RED; } - if (memactused != -1) memactpct = (memphystotal > 0) ? ((100 * memactused) / memphystotal) : 0; + if (memactused != -1) memactpct = (memacttotal > 0) ? ((100 * memactused) / memacttotal) : 0; if (memactpct <= 100) { if (memactpct > actyellow) actcolor = COL_YELLOW; if (memactpct > actred) actcolor = COL_RED; @@ -965,30 +965,30 @@ memorysummary); addtostatus(msgline); - sprintf(msgline, " %-12s%12s%12s%12s\n", "Memory", "Used", "Total", "Percentage"); + sprintf(msgline, " %-16s%12s%12s%12s\n", "Memory", "Used", "Total", "Percentage"); addtostatus(msgline); - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(physcolor), "Physical", memphysused, memphystotal, memphyspct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(physcolor), "Real/Physical", memphysused, memphystotal, memphyspct); addtostatus(msgline); if (memactused != -1) { if (memactpct <= 100) - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(actcolor), "Actual", memactused, memphystotal, memactpct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(actcolor), "Actual/Virtual", memactused, memacttotal, memactpct); else - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%% - invalid data\n", - colorname(COL_CLEAR), "Actual", memactused, memphystotal, 0L); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%% - invalid data\n", + colorname(COL_CLEAR), "Actual/Virtual", memactused, memacttotal, 0L); addtostatus(msgline); } if (memswapused != -1) { if (memswappct <= 100) - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%%\n", - colorname(swapcolor), "Swap", memswapused, memswaptotal, memswappct); + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%%\n", + colorname(swapcolor), "Swap/Page", memswapused, memswaptotal, memswappct); else - sprintf(msgline, "&%s %-12s%11ldM%11ldM%11ld%% - invalid data\n", + sprintf(msgline, "&%s %-16s%11ldM%11ldM%11ld%% - invalid data\n", colorname(COL_CLEAR), "Swap", memswapused, memswaptotal, 0L); addtostatus(msgline); bbwin.c patch: --- bbwin.c.ORIG 2016-01-27 09:54:13.989793661 -0600 +++ bbwin.c 2016-01-27 09:54:17.709793593 -0600 @@ -487,7 +487,7 @@ if (p) sscanf(p, "\nvirtual: %ld %ld", &memacttotal, &memactused); dbgprintf("DEBUG Memory %ld %ld %ld %ld %ld\n", memphystotal, memphysused, memactused, memswaptotal, memswapused); /* DEBUG TODO Remove*/ unix_memory_report(hostname, clienttype, os, hinfo, fromline, timestr, - memphystotal, memphysused, memactused, memswaptotal, memswapused); + memphystotal, memphysused, memacttotal, memactused, memswaptotal, memswapused); } splitmsg_done(); linux.c patch: --- linux.c.ORIG 2016-01-27 09:54:23.861793480 -0600 +++ linux.c 2016-01-27 09:54:27.545793413 -0600 @@ -135,7 +135,7 @@ } unix_memory_report(hostname, clienttype, os, hinfo, fromline, timestr, - memphystotal, memphysused, memactused, memswaptotal, memswapused); + memphystotal, memphysused, memphystotal, memactused, memswaptotal, memswapused); } if (mdstatstr) { After modifications the data from the client remains the same but what the server acts upon and displays now looks like: Windows/XymonPS: Memory Used Total Percentage Real/Physical 1444M 5119M 28% Actual/Virtual 57M 2047M 2% Swap/Page 1742M 10237M 17% Linux: Memory Used Total Percentage Real/Physical 3625M 3949M 91% Actual/Virtual 889M 3949M 22% Swap/Page 6M 4092M 0% You will notice that I changed the labels of each line to include what the names are in the graphs. I figured if I was modifyng these scripts I might as well fix what has been annoying me for a long long time. :) I hope this all makes sense. Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

3 4

HTTP Status 301
by Foster.Patch＠accuweather.com 28 Jan '16

28 Jan '16

Hello, No matter what I do, I cannot get rid of this http error on xymon. Here is the line for my includes: 0.0.0.0 AccuWeatherStore # noconn http://www.accuweatherstore.com/ httpstatus=http;http://www.accuweatherstore.com/;301; And here is what the page prints: http://www.accuweatherstore.com/ - OK HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 28 Jan 2016 15:49:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Status: 301 Moved Permanently X-Frame-Options: DENY X-ShopId: 8909382 X-ShardId: 5 Content-Language: en Location: http://accuweatherstore.com/ Content-Security-Policy-Report-Only: default-src 'self' *; connect-src 'self' *; font-src 'self' * data:; frame-src 'self' *; img-src 'self' * data:; media-src 'self' *; object-src 'self' *; script-src 'self' * 'unsafe-inline' 'unsafe-eval'; style-src 'self' * 'unsafe-inline'; frame-ancestors www.accuweatherstore.com; report-uri /csp-report/63ec6a02-51ba-4f9c-8800-5a8e7a947a3b?source%5Baction%5D=index&source%5Bcontroller%5D=shop&source%5Bsection%5D=storefront; X-XSS-Protection: 1; mode=block; report=/xss-report/63ec6a02-51ba-4f9c-8800-5a8e7a947a3b?source%5Baction%5D=index&source%5Bcontroller%5D=shop&source%5Bsection%5D=storefront X-Request-Id: 63ec6a02-51ba-4f9c-8800-5a8e7a947a3b P3P: CP="NOI DSP COR NID ADMa OPTa OUR NOR" X-Dc: chi2,ash X-Content-Type-Options: nosniff X-Content-Type-Options: nosniff Seconds: 0.159071000 I have tried to change around both URLs for the includes, with no success. Any suggestions?

2 1

xymon.sh: add return codes for status
by lifanov＠mail.lifanov.com 27 Jan '16

27 Jan '16

Can you please add LSB return codes to either the init script or xymon.sh please? A sample implementation: --- trunk/files/xymon/usr/lib/xymon/server/bin/xymon.sh Wed Jan 27 14:41:07 2016 (r6869) +++ trunk/files/xymon/usr/lib/xymon/server/bin/xymon.sh Wed Jan 27 14:42:58 2016 (r6870) @@ -56,12 +56,15 @@ if test $? -eq 0 then echo "Xymon (xymonlaunch) running with PID `cat /var/log/xymon/xymonlaunch.pid`" + exit 0 else echo "Xymon not running, removing stale PID file" rm -f /var/log/xymon/xymonlaunch.pid + exit 1 fi else echo "Xymon (xymonlaunch) does not appear to be running" + exit 3 fi ;; See "status" under this page: http://refspecs.linuxbase.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/i…

2 2

How to query all red systems ignoring nopropred hosts
by thorsten.erdmann＠daimler.com 27 Jan '16

27 Jan '16

Hi for creating an interface to another monitoring system I want to query the xymon server for a list of all currently red systems. I can do this with the xymon utility: xymon 127.0.0.1 "xymondboard color=RED" But this lists also hosts which have the nopropred tag set and I want to ignore these. The only way I found was querying the config for each red host and search for the tag myself. This can result in very much queries to the xymon server if there are currently much red states. Is there a nicer way to realize this? Maybe I have missed a filter option. Or maybe I can see the tag in some field supported by the xymondboard's output. Thanks for help Thorsten If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.

2 2

Feature request -- additional info in "disabled" notification
by hobbit＠elyograg.org 27 Jan '16

27 Jan '16

Currently I get an email notification when a test is disabled. The subject is "Xymon host:test disabled [cfid:xxx]". I'm running 4.3.23 with the patch from 4.3.24 that fixes http response code parsing. It would be extremely helpful if this notification email included the basic auth username of the person who disabled the test, the reason that they entered, and the duration of the disable. Having the IP address of the computer that made the disable request would also be useful. Looking at the "X-Fordwarded-For" http header might be required. I have not delved into the source code for test disabling, so currently I have no idea how difficult this idea is to implement. If I find the time, I may look into the source code to see if I can implement it myself and contribute the change to the project. I would think this has been requested before, but using some simple searches, I could not locate a similar request in my own archive of this mailing list, which goes back to early 2011. Thanks, Shawn

2 1