- Xymon - Xymon mailman web

Xymon maintaienance
by eliap09＠yahoo.com 23 Oct '15

23 Oct '15

I am looking to set xymon to stop alerts on certain time of the day everyday ex. Between 3am- 4 am. How I can set that? I didn't see that option on regular exclude time option. Thanks. Eli

1 0

Disk test in Windows appending a ' with a large number of disks
by Daniel.Nordquist＠orlandohealth.com 22 Oct '15

22 Oct '15

Yes, bbwin was uninstalled and re-installed a couple times, along with the upgrade from .12 to .13... I'll check for other versions of the dll when I'm back in the office and reply with my findings. Thanks for the help! ________________________________ From: Kenneth S. Petersen [ksp at stougaards.dk] Sent: Tuesday, October 20, 2015 1:04 PM To: Nordquist, Daniel; Jeffcoat, Al; J.C. Cleaver Cc: Xymon Mailing List Subject: SV: [Xymon] Disk test in Windows appending a ' with a large number of disks Hi Daniel, Could be related to .dll version conflict. Is bbwin reinstalled after service pack or other updates on the exchange server? Try search for MSVCR100.dll though your system to see how versions is located in path. If an older or newer version is found in path before system32 it could be there your error is coming from. I’ve been using bbwin 0.13 for quite some time on exchange 2010 with no issue at all, related to this. Just a thought. Kenneth S. Petersen Fra: Xymon [mailto:xymon-bounces at xymon.com] På vegne af Nordquist, Daniel Sendt: 20. oktober 2015 18:47 Til: Jeffcoat, Al; J.C. Cleaver Cc: Xymon Mailing List Emne: Re: [Xymon] Disk test in Windows appending a ' with a large number of disks FYI – This is the dll error that generates when the disk.dll attempts to load: Log Name: Application Source: Application Error Date: 10/20/2015 12:43:19 PM Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: <my server name> Description: Faulting application name: BBWin.exe, version: 0.13.0.237, time stamp: 0x4f273487 Faulting module name: MSVCR100.dll, version: 10.0.30319.1, time stamp: 0x4ba1dbbe Exception code: 0xc0000005 Fault offset: 0x00001fd8 Faulting process id: 0x26904 Faulting application start time: 0x01d10b566be8eeca Faulting application path: C:\Program Files (x86)\BBWin\bin\BBWin.exe Faulting module path: C:\Program Files (x86)\BBWin\bin\MSVCR100.dll Report Id: aaa9999f-7749-11e5-a446-3cd92bf6e804 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application Error" /> <EventID Qualifiers="0">1000</EventID> <Level>2</Level> <Task>100</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2015-10-20T16:43:19.000000000Z" /> <EventRecordID>2594237</EventRecordID> <Channel>Application</Channel> <Computer>my server</Computer> <Security /> </System> <EventData> <Data>BBWin.exe</Data> <Data>0.13.0.237</Data> <Data>4f273487</Data> <Data>MSVCR100.dll</Data> <Data>10.0.30319.1</Data> <Data>4ba1dbbe</Data> <Data>c0000005</Data> <Data>00001fd8</Data> <Data>26904</Data> <Data>01d10b566be8eeca</Data> <Data>C:\Program Files (x86)\BBWin\bin\BBWin.exe</Data> <Data>C:\Program Files (x86)\BBWin\bin\MSVCR100.dll</Data> <Data>aaa9999f-7749-11e5-a446-3cd92bf6e804</Data> </EventData> </Event> -----Original Message----- From: Jeffcoat, Al Sent: Tuesday, October 20, 2015 11:53 AM To: Nordquist, Daniel <Daniel.Nordquist at orlandohealth.com<mailto:Daniel.Nordquist at orlandohealth.com>>; J.C. Cleaver <cleaver at terabithia.org<mailto:cleaver at terabithia.org>> Cc: Xymon Mailing List <xymon at xymon.com<mailto:xymon at xymon.com>> Subject: RE: [Xymon] Disk test in Windows appending a ' with a large number of disks To add more information, this is 100% a client problem. The bbwin client is crashing after the disks were added to the exchange server, which is causing the service test to turn purple on the xymon server. There are 5 other exchange servers with the exact same configuration that aren't having a problem. There's a warning that bbwin can't find a dll in the windows event log, but as I'm not a wintel admin here, I don’t have access to it. If it's of interest to anyone, I can get it from them if necessary. I suggested to the techs working the issue that they look into the xymonpsclient to see if it resolves the issue. Thank you, Al Al Jeffcoat, IBM Certified AIX Support Specialist System Programmer III (Storage and *NIX) Information Services Orlando Health orlandohealth.com facebook.com/orlandohealth youtube.com/orlandohealth @orlandohealth on twitter 2051 Mercy Drive Orlando, FL 32806 tel: 321.843.1051 fax: 321.843.6733 -----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Nordquist, Daniel Sent: Tuesday, October 20, 2015 11:31 AM To: J.C. Cleaver <cleaver at terabithia.org<mailto:cleaver at terabithia.org>> Cc: Xymon Mailing List <xymon at xymon.com<mailto:xymon at xymon.com>> Subject: Re: [Xymon] Disk test in Windows appending a ' with a large number of disks Not sure what you mean by the '[df]' section of the client report? It's running the .13 bbwin client. -----Original Message----- From: J.C. Cleaver [mailto:cleaver at terabithia.org] Sent: Monday, October 19, 2015 12:34 PM To: Nordquist, Daniel Cc: Xymon Mailing List Subject: RE: [Xymon] Disk test in Windows appending a ' with a large number of disks Can you send the output of the '[df]' section of the client report for this server? Also, are you using BBWin or the PowerShell client? -jc On Mon, October 19, 2015 4:51 am, Nordquist, Daniel wrote: > It just appends a ' to the disk name, like this; DB165' > > Diskpart and all other windows utils show the disk as a normal name, > it's just hobbit that is appending the ' > > Any ideas? > > > -----Original Message----- > From: J.C. Cleaver [mailto:cleaver at terabithia.org] > Sent: Saturday, October 17, 2015 11:49 PM > To: Nordquist, Daniel <Daniel.Nordquist at orlandohealth.com<mailto:Daniel.Nordquist at orlandohealth.com>> > Cc: Xymon Mailing List <xymon at xymon.com<mailto:xymon at xymon.com>> > Subject: Re: [Xymon] Disk test in Windows appending a ' with a large > number of disks > > > > On Fri, October 16, 2015 4:42 am, Nordquist, Daniel wrote: >> Disk test in Windows appending a ' with a large number of disks (over >> 150), which breaks the test. >> >> For some reason, we added additional disks to our exchange servers >> and hobbit is appending a single quote (') to the disk names and the >> disk test is broken because of it. >> >> Anyone have this happen to them and know of a solution? >> > > > Hi Dan, > > This is the first I've heard of something like this. Can you provide a > sample of what you're seeing? Also, the version numbers (on the server > side) and the client script. > > Do you see this in the 'df' section of the raw client report, or is it > just in the 'disk' status test? > > > Regards, > -jc > > > ________________________________ > > This e-mail message and any attached files are confidential and are > intended solely for the use of the addressee(s) named above. If you > are not the intended recipient, any review, use, or distribution of > this e-mail message and any attached files is strictly prohibited. > > This communication may contain material protected by Federal privacy > regulations, attorney-client work product, or other privileges. If you > have received this confidential communication in error, please notify > the sender immediately by reply e-mail message and permanently delete > the original message. To reply to our email administrator directly, > send an email to: postmaster at orlandohealth.com<mailto:postmaster at orlandohealth.com> . > > If this e-mail message concerns a contract matter, be advised that no > employee or agent is authorized to conclude any binding agreement on > behalf of Orlando Health by e-mail without express written > confirmation by an officer of the corporation. Any views or opinions > presented in this e-mail are solely those of the author and do not > necessarily represent those of Orlando Health. > ________________________________ This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com<mailto:postmaster at orlandohealth.com> . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health. _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon ________________________________ This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com<mailto:postmaster at orlandohealth.com> . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health. ________________________________ This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.

1 1

checking alerts file
by didds3＠yahoo.co.uk 21 Oct '15

21 Oct '15

I thought there was a alerts file checking command that would check it for syntax etc ... am I dreaming that? anyone know of some easy way fo checking that the alerts file "makes sense" - this to easily check there isn't some silly typo/stuff up half way down that breaks all the subsequent alerts. ta! ian

3 2

Disk test in Windows appending a ' with a large number of disks
by Daniel.Nordquist＠orlandohealth.com 20 Oct '15

20 Oct '15

Disk test in Windows appending a ' with a large number of disks (over 150), which breaks the test. For some reason, we added additional disks to our exchange servers and hobbit is appending a single quote (') to the disk names and the disk test is broken because of it. Anyone have this happen to them and know of a solution? Thank you, Dan ________________________________ This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.

3 6

Fix for RDP tests
by steuer＠hotmail.com 19 Oct '15

19 Oct '15

Hi Ryan – I tested with Windows 2003 server successfully. Anything older really shouldn’t be in operation anymore anyway. From: Novosielski, Ryan [mailto:novosirj at ca.rutgers.edu] Sent: Monday, October 19, 2015 1:34 PM To: J.C. Cleaver Cc: Rob Steuer; xymon at xymon.com; Kenneth S. Petersen Subject: Re: [Xymon] Fix for RDP tests Is it possible that this makes the test not work for older RDP servers? ____ *Note: UMDNJ is now Rutgers-Biomedical and Health Sciences* || \\UTGERS <file:///\\UTGERS> |---------------------*O*--------------------- ||_// Biomedical | Ryan Novosielski - Senior Technologist || \\ and Health | novosirj at rutgers.edu- 973/972.0922 (2x0922) || \\ Sciences | OIRT/High Perf & Res Comp - MSB C630, Newark `' On Oct 19, 2015, at 06:12, J.C. Cleaver <cleaver at terabithia.org> wrote: On Sun, October 18, 2015 10:22 pm, Kenneth S. Petersen wrote: Hi Rob, It works perfect here. Using Xymon 4.3.21 with both 2008 / 2008 R2 / 2012 / 2012 R2 with no issues at all. Thanks for the update, I'll deleted the RDPNLA witch was the approach I did to get it to work. I'll too backup on the protocols.cfg updates in the next release. Fra: Xymon [mailto:xymon-bounces at xymon.com] På vegne af Rob Steuer Sendt: 19. oktober 2015 01:20 Til: xymon at xymon.com Emne: [Xymon] Fix for RDP tests Hi, After trying to implement the RDP tests for monitored hosts I noticed that they were returning a yellow warning with the warning text "Unexpected service response". I tried this for older hosts running Windows 2003 and newer hosts running 2008/2012 with RDP using NLA. It gave the warning text for both. So I'm guessing the original rdp test was implemented many years ago (2010 per below) when things were handled differently. The specification currently in the protocols.cfg file for RDP as it stands today is as follows: # Microsoft Terminal Services / Remote Desktop Protocol # From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html) [rdp] port 3389 send "\x03\x00\x00\x1e\x19\xe0\x00\x00\x00\x00\x00Cookie: mstshash=\r\n" expect "\x03\x00\x00\x0b\x06\xd0" I couldn't find anyone who provided a true fix in the archives other than suggesting doing a network trace. So that's what I did. After a bit of testing I found the following to work: # Microsoft Terminal Services / Remote Desktop Protocol # From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html) # Updated By Rob Steuer 10-17-2015 with send and expect strings that work for current versions of RDP [rdp] port 3389 send "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x0b\x00\x00\x00" expect "\x03\x00\x00\x13\x0e\xd0\x00\x00\x12\x34" I was tempted to rename the protocol test to [rdpnla] or something like that to keep the old one around, but really the old one just didn't work for anything, so IMHO I think it just needs to be replaced entirely. I'd like feedback from others to see if this works for them also and see the protocols.cfg updated in the next release of Xymon. Thanks! Rob Hi Rob, I can confirm it's working for me as well. Thanks for the submission! It's been committed at https://sourceforge.net/p/xymon/code/7700/ Regards, -jc _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

2 1

Patch for xymonclient-darwin.sh to fix numerous bugs
by jdwhite＠menelos.com 19 Oct '15

19 Oct '15

Greetings, The following patch fixes these long-standing issues with xymonclient-darwin.sh: * Disk usage test erroneously uses inode usage values as Darwin combines disk usage and inode usage into the same 'df' output by default. * Mountpoints with spaces in them were not reported. The former issues is fixed by passing the '-P' flag to 'df' to restore legacy mode reporting. The latter issue replaces spaces with underscores in the mountpoint. In addition to checking mount options for 'nobrowse', this patch also exclude readonly volumes which I find are mostly transient DMG files. Regards, -Jason -- Jason White jdwhite at menelos.com

3 3

Fix for RDP tests
by steuer＠hotmail.com 19 Oct '15

19 Oct '15

Hi, After trying to implement the RDP tests for monitored hosts I noticed that they were returning a yellow warning with the warning text "Unexpected service response". I tried this for older hosts running Windows 2003 and newer hosts running 2008/2012 with RDP using NLA. It gave the warning text for both. So I'm guessing the original rdp test was implemented many years ago (2010 per below) when things were handled differently. The specification currently in the protocols.cfg file for RDP as it stands today is as follows: # Microsoft Terminal Services / Remote Desktop Protocol # From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html) [rdp] port 3389 send "\x03\x00\x00\x1e\x19\xe0\x00\x00\x00\x00\x00Cookie: mstshash=\r\n" expect "\x03\x00\x00\x0b\x06\xd0" I couldn't find anyone who provided a true fix in the archives other than suggesting doing a network trace. So that's what I did. After a bit of testing I found the following to work: # Microsoft Terminal Services / Remote Desktop Protocol # From Chris Wopat (http://www.xymon.com/archive/2010/01/msg00039.html) # Updated By Rob Steuer 10-17-2015 with send and expect strings that work for current versions of RDP [rdp] port 3389 send "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x0b\x00\x00\x0 0" expect "\x03\x00\x00\x13\x0e\xd0\x00\x00\x12\x34" I was tempted to rename the protocol test to [rdpnla] or something like that to keep the old one around, but really the old one just didn't work for anything, so IMHO I think it just needs to be replaced entirely. I'd like feedback from others to see if this works for them also and see the protocols.cfg updated in the next release of Xymon. Thanks! Rob

4 3

"invalid data" shown for swap usage; swap goes Clear (NOT red) and Memory goes Green
by mvanderw＠nd.edu 18 Oct '15

18 Oct '15

Hello, We've noticed that when total Swap being used is greater than the total Swap on the machine in the memory column/page, Xymon reports back with 0% for Swap usage and alongside it, it says, " - invalid data". We've noticed this happening several times for us and I assume it's due to excessive swap usage that causes the memory/swap usage being reported by the machine going completely out of wack... Here's a recent example: Memory Used Total Percentage[image: green] Physical 10183M 11910M 85%[image: green] Actual 9945M 11910M 83%[image: clear] Swap 1759218M 3967M 0% - invalid data This is fine and all and it's certainly not Xymon's fault in any way, as it's just reporting what the machine is reporting (and the machine is also showing wacked out numbers for swap usage). What I don't care for is that when this happens, the color/state for Swap just goes Clear, which causes the memory page/column to just go Green for the machine in question. This makes it very hard to know when this kind of thing happens and needs to be addressed (usually with a reboot of the machine), as it just appears that everything is fine since memory is showing Green. Often times, we don't even get any warning of excessive swap usage with any Yellow or Red alerts prior to this happening as it happens so fast on the machine, too fast for Xymon to catch it. Is it possible to make it so that this kind of situation causes the color/state for Swap to go Red, as an indication that something is very wrong and needs to be addressed, instead of going Clear? Or at least makes it go Yellow? I'd greatly appreciate this being changed so it at least doesn't show Clear! Any other suggestions for how to change this behavior are more then welcome! Thanks for the help!! -- Matt Vander Werf

2 2

Getting "ATT0001.bin" attachments sometimes -- MAILC fix is already in place
by hobbit＠elyograg.org 16 Oct '15

16 Oct '15

On 8/13/2015 9:01 AM, Ribeiro, Glauber wrote: > MAILC="tr -d \"\\001\\004\\015\" | mail" > > I think you shouldn't escape the quotes: > > MAILC="tr -d "\\001\\004\\015" | mail" I suspect that without the escapes, the variable won't have the right definition, since quotes are used to contain the value ... although it's possible that *with* the escapes, it won't have the right definition either. It's starting to sound like I need to write a script so that no special characters are required. An ugly hack, but I think it will work ... so I will go ahead and do that. A better option might be to create a feature where we can define a list of characters that should be stripped out of email text before it is sent, and have Xymon itself handle that. Thanks, Shawn

1 1

Xymon Proxy + Xymon Server
by mailinglists＠websitemanagers.com.au 13 Oct '15

13 Oct '15

Hi all, I was previously running an old version of hobbit and recently upgraded to Xymon (finally). I'm struggling again with the configuration of what must be an unusual case. The setup: Xymon server running on the main monitoring server in the office, internal IP is 192.168.x.1 and external IP does NAT for port 1984 into this internal IP so remote xymon clients can report in. At one location, the network consists of a linux based firewall, plus a bunch of servers. The firewall doesn't do NAT or any sort of forwarding, so all connections between the Internet and this bunch of servers must transit the squid proxy on the firewall (or similar). I also run a local xymon server on the linux firewall, and this works well. However, I want to forward all the status of everything back to the main xymon server in the office above. So, the obvious solution is to use the xymon proxy to receive reports from the "bunch of servers" and then send the data to both the local xymon server as well as the office xymon server. To do this I've configured things like this: From tasks.cfg: # Listen on 127.0.0.1 only [xymond] ENVFILE /usr/lib/xymon/server/etc/xymonserver.cfg CMD xymond --pidfile=/var/run/xymon/xymond.pid \ --restart=$XYMONTMP/xymond.chk --checkpoint-file=$XYMONTMP/xymond.chk --checkpoint-interval=600 \ --log=$XYMONSERVERLOGS/xymond.log \ --admin-senders=127.0.0.1,$XYMONSERVERIP \ --store-clientlogs=!msgs \ --listen=127.0.0.1 # Listen on the internal LAN IP, and send data to both 127.0.0.1 and the office xymon server [xymonproxy] ENVFILE /usr/lib/xymon/server/etc/xymonserver.cfg CMD $XYMONHOME/bin/xymonproxy --server=X.23.7.2,127.0.0.1 --listen=10.0.0.1 --report=$MACHINE.xymonproxy --no-daemon --pidfile=/var/run/xymon/xymonproxy.pid LOGFILE $XYMONSERVERLOGS/xymonproxy.log All the other normal xymon server tasks are enabled as well, such as xymonnet etc... However, if I set XYMONSERVERS=127.0.0.1 everything works well, except that most status reports from xymonnet and xymonclient don't get sent to the remote xymon server (since they don't get to the proxy). If I set XYMONSERVERS to the LAN IP of the xymon proxy 10.0.0.1 then all the status reports are sent to both servers, but the web interface is broken. Clicking on a dot to see the current status gives a error message 403 Invalid host. So, is there something I'm missing with my config? Should the proxy allow the www pages to work by passing whatever query through? How can I override XYMONSERVERS value depending on where it is used, and how do I know which parts I need to override? Any suggestions? Thanks, Adam

2 1