- Xymon - Xymon mailman web

xymond_alerts huge cpu usage
by leo＠minas.fr 27 Apr '15

27 Apr '15

hello my xymond_alerts is consuming 100% of the cpu. We have around 200 000 lines of configuration but a dump of the config witch xymond_alerts --test is taking less than 1s. Any idea ? oau

2 1

Acknowledgements Report - No events acked in last 0 minutes
by rectifier＠gmail.com 27 Apr '15

27 Apr '15

Tested the patch acknowledgementslog.patch and it works great so thanks for this! Minor feature request: Would be nice to have a 'clear all' next to the 'view log' button as if you are changing selections you have to manually go into the fields and delete. thanks all Steve On Sun, Apr 26, 2015 at 10:17 PM, Andy Smith <abs at shadymint.com> wrote: > Andy Smith wrote: > >> Steve B wrote: >> >>> Is the Acknowledgements Report working at the moment? I saw it was a new >>> feature of 4.3.19. >>> We have recently upgraded from Hobbit (2009) to Xymon 4.3.19. >>> >>> When I click on Acknowledgements report and select today, this week or >>> this month for example, it goes to a blank page and always says : >>> >>> No events acknowledged in the last 0 minutes. >>> >>> Any ideas? >>> >>> thanks >>> >> >> Steve, >> >> I cannot find where I read this, but in my tasks.cfg for the startup CMD >> for xymond, I think I had to add :- >> >> --ack-log=$XYMONSERVERLOGS/acknowledge.log >> >> if I didnt do this, the acks were not written to the log, even though an >> empty log exists. >> > > Draft patch for xymond man page attached. > -- > Andy >

1 0

Acknowledgements Report - No events acked in last 0 minutes
by rectifier＠gmail.com 26 Apr '15

26 Apr '15

Is the Acknowledgements Report working at the moment? I saw it was a new feature of 4.3.19. We have recently upgraded from Hobbit (2009) to Xymon 4.3.19. When I click on Acknowledgements report and select today, this week or this month for example, it goes to a blank page and always says : No events acknowledged in the last 0 minutes. Any ideas? thanks

3 7

In trends how to pass 'step' value
by prashantkad＠gmail.com 25 Apr '15

25 Apr '15

I’m passing data channel to pass trends. The RRD file get’s created fine. But does this support passing ’step’ value ? This is what I’m using to pass trends : xymon --debug xymonServer "data hostname.trends [test.rrd] DS:PSK:GAUGE:600:0:U 133 DS:XYZ:GAUGE:600:0:U 133 DS:ABC:GAUGE:600:U:U 599” This is what I tried : xymon --debug xymonServer "data hostname.trends [test.rrd] -s 60 DS:PSK:GAUGE:600:0:U 133 DS:XYZ:GAUGE:600:0:U 133 DS:ABC:GAUGE:600:U:U 599” I tried both -s and —step options but does not seems to affect default value of 300 seconds. Any idea what should I use to configure step value.

1 0

trimhistory command
by mpannucc＠ycp.edu 24 Apr '15

24 Apr '15

Hello I'm attempting to use the trimhistory command to free up some space on our xymon server. I can get a "man trimhistory" to work and show me all of the available options, but when I run anything with the trimhistory command I get the error of command not found. Is there a trick to this? Or does it sound like something is just setup wrong in our environment? Thanks! __________________ -- This information is intended solely for the use of the individual to whom it is addressed. Any review, disclosure, copying, distribution or use of this e-mail communication by others is strictly prohibited. If you are not the intended recipient, please notify us immediately by returning this message to the sender and delete all copies.

3 2

Windows server loads reported high by PowerShell client
by colin.coe＠gmail.com 23 Apr '15

23 Apr '15

Hi Martin Many thanks, you're right. Wrong syntax... On a related note, I see in the PS client a [netstat] test but this test has gone purple on th server I've changed from BBwin. Have you seen this? Thanks CC On Thu, Apr 23, 2015 at 11:54 AM, <martin.wojak at delwp.vic.gov.au> wrote: > Hi Colin, > > Yes, I had the same problem. I believe the issue is related to the > PowerShell client not using the CLASS=Win32 in analysis.cfg. I think a > recent update to the PS client has addressed that issue, but I haven't look > into it yet. > > Hence I just state the LOAD 80 90 in each PS client server in analysis.cfg. > Eg. > > HOST=PRDxxxx01 > LOAD 80 90 > > > > > From: Colin Coe <colin.coe at gmail.com> > To: "xymon at xymon.com" <xymon at xymon.com>, > Date: 23/04/2015 01:42 PM > Subject: [Xymon] Windows server loads reported high by PowerShell > client > Sent by: "Xymon" <xymon-bounces at xymon.com> > ________________________________ > > > > Hi all > > I'm testing the new PowerShell client. > > I'm seeing Windows nodes with loads of above 5% being reported as high > use such as the below. > > --- > Thu 23 Apr 11:32:18 2015 up: 0 days, 1 users, 63 procs, load=6.2% > > Load is HIGH > > CPU states: > total 6.2% > cores: 1 > > CPU PID Image Name Pri Time MemUsage > 2.3% 1676 SVC:MSSQL$MICROSOFT##WID 8 00:04:17 101200k > 0.8% 796 SVC:Appinfo/BITS/CertPropSvc/D 8 00:01:13 44244k > 0.7% 748 SVC:Dhcp/EventLog/lmhosts/Wcms 8 00:00:51 16184k > 0.6% 2176 WmiPrvSE 8 00:00:24 32676k > 0.6% 1648 powershell 8 00:01:07 86344k > 0.3% 1540 WmiPrvSE 8 00:00:24 23288k > 0.2% 1768 SVC:RHEV-Agent 8 00:00:34 21496k > 0.2% 1088 RMClient 8 00:00:29 191220k > 0.2% 3792 ServerManager 8 00:00:13 106148k > 0.1% 2952 WmiPrvSE 8 00:00:10 8656k > 0.1% 504 services 9 00:00:07 7640k > 0.0% 4 System 8 00:00:09 264k > 0.0% 3116 SVC:gupdate 8 00:00:00 9412k > 0.0% 2812 WmiPrvSE 8 00:00:00 10208k > 0.0% 1388 SVC:TermService 8 00:00:04 65560k > 0.0% 600 SVC:RpcEptMapper/RpcSs 8 00:00:01 6800k > 0.0% 3560 WmiPrvSE 8 00:00:00 5196k > 0.0% 512 SVC:KeyIso/Netlogon/SamSs 9 00:00:04 13348k > 0.0% 1692 SVC:wmiApSrv 8 00:00:00 5020k > 0.0% 1628 conhost 8 00:00:00 2720k > 0.0% 2072 SVC:RDMS/TScPubRPC 8 00:00:00 10748k > 0.0% 3308 SVC:RPCHTTPLBS 8 00:00:00 3024k > 0.0% 552 SVC:BFE/DPS/MpsSvc 8 00:00:00 9892k > 0.0% 3832 GoogleUpdate 4 00:00:00 2440k > 0.0% 352 csrss 13 00:00:01 3732k > 0.0% 3096 rdpclip 8 00:00:00 6376k > 0.0% 4064 GoogleUpdate 4 00:00:00 8780k > 0.0% 3720 iashost 8 00:00:00 11352k > 0.0% 3776 SVC:TSGateway 8 00:00:00 13508k > 0.0% 2092 SVC:Tssdis 8 00:00:00 11016k > 0.0% 4068 VCDDaemon 8 00:00:00 5572k > 0.0% 2800 dwm 13 00:00:01 39200k > 0.0% 2688 SVC:MSDTC 8 00:00:00 6616k > 0.0% 3088 taskhostex 8 00:00:00 6400k > 0.0% 3292 explorer 8 00:00:07 89732k > 0.0% 2324 SVC:COMSysApp 8 00:00:00 9872k > 0.0% 3464 ClassicStartMenu 8 00:00:00 8028k > 0.0% 2432 taskeng 6 00:00:00 4372k > 0.0% 2376 SVC:PolicyAgent 8 00:00:00 4284k > 0.0% 1820 vdagent 13 00:00:00 3768k > 0.0% 712 dwm 13 00:00:00 29124k > 0.0% 696 LogonUI 13 00:00:00 26172k > 0.0% 724 SVC:vdservice 10 00:00:00 2712k > 0.0% 928 SVC:CryptSvc/Dnscache/LanmanWo 8 00:00:00 16628k > 0.0% 828 SVC:EventSystem/FontCache/netp 8 00:00:00 11656k > 0.0% 568 SVC:BrokerInfrastructure/DcomL 8 00:00:00 10220k > 0.0% 208 smss 11 00:00:00 992k > 0.0% 0 Idle 0 4k > 0.0% 404 csrss 13 00:00:00 3272k > 0.0% 440 winlogon 13 00:00:00 5268k > 0.0% 412 wininit 13 00:00:00 3496k > 0.0% 1072 SVC:Spooler 8 00:00:00 10496k > 0.0% 1440 SVC:WIDWriter 8 00:00:00 5492k > 0.0% 1424 SVC:W3SVC/WAS 8 00:00:00 8352k > 0.0% 1576 SVC:XymonPSClient 8 00:00:00 3888k > 0.0% 1736 winlogon 13 00:00:00 5196k > 0.0% 1732 csrss 13 00:00:00 19372k > 0.0% 1368 SVC:ScDeviceEnum/SysMain/TrkWk 8 00:00:04 11180k > 0.0% 1124 SVC:IISADMIN 8 00:00:00 15408k > 0.0% 1100 SVC:AppHostSvc 8 00:00:00 7252k > 0.0% 1164 SVC:KPSSVC 8 00:00:00 3020k > 0.0% 1280 SVC:QEMU-GA 8 00:00:00 5060k > 0.0% 1208 SVC:QEMU Guest Agent VSS Provi 8 00:00:00 5292k > --- > > I've got the following in /etc/xymon/analysis.cfg > --- > CLASS=powershell > LOAD=80 90 > --- > > and in /etc/xymon/client-local.cfg > --- > [powershell] > eventlog:security > ignore success > ignore Success > ignore "The local computer may not have the necessary registry > information or message DLL files to display messages from a remote > computer" > eventlog:system > ignore "Contact the administrator to install the driver before you log in > again" > adreplicationcheck > terminalservicessessions:10:15 > --- > > Any ideas how I can get the thresholds in the analysis file to be honored? > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

2 1

Windows server loads reported high by PowerShell client
by colin.coe＠gmail.com 23 Apr '15

23 Apr '15

Hi all I'm testing the new PowerShell client. I'm seeing Windows nodes with loads of above 5% being reported as high use such as the below. --- Thu 23 Apr 11:32:18 2015 up: 0 days, 1 users, 63 procs, load=6.2% Load is HIGH CPU states: total 6.2% cores: 1 CPU PID Image Name Pri Time MemUsage 2.3% 1676 SVC:MSSQL$MICROSOFT##WID 8 00:04:17 101200k 0.8% 796 SVC:Appinfo/BITS/CertPropSvc/D 8 00:01:13 44244k 0.7% 748 SVC:Dhcp/EventLog/lmhosts/Wcms 8 00:00:51 16184k 0.6% 2176 WmiPrvSE 8 00:00:24 32676k 0.6% 1648 powershell 8 00:01:07 86344k 0.3% 1540 WmiPrvSE 8 00:00:24 23288k 0.2% 1768 SVC:RHEV-Agent 8 00:00:34 21496k 0.2% 1088 RMClient 8 00:00:29 191220k 0.2% 3792 ServerManager 8 00:00:13 106148k 0.1% 2952 WmiPrvSE 8 00:00:10 8656k 0.1% 504 services 9 00:00:07 7640k 0.0% 4 System 8 00:00:09 264k 0.0% 3116 SVC:gupdate 8 00:00:00 9412k 0.0% 2812 WmiPrvSE 8 00:00:00 10208k 0.0% 1388 SVC:TermService 8 00:00:04 65560k 0.0% 600 SVC:RpcEptMapper/RpcSs 8 00:00:01 6800k 0.0% 3560 WmiPrvSE 8 00:00:00 5196k 0.0% 512 SVC:KeyIso/Netlogon/SamSs 9 00:00:04 13348k 0.0% 1692 SVC:wmiApSrv 8 00:00:00 5020k 0.0% 1628 conhost 8 00:00:00 2720k 0.0% 2072 SVC:RDMS/TScPubRPC 8 00:00:00 10748k 0.0% 3308 SVC:RPCHTTPLBS 8 00:00:00 3024k 0.0% 552 SVC:BFE/DPS/MpsSvc 8 00:00:00 9892k 0.0% 3832 GoogleUpdate 4 00:00:00 2440k 0.0% 352 csrss 13 00:00:01 3732k 0.0% 3096 rdpclip 8 00:00:00 6376k 0.0% 4064 GoogleUpdate 4 00:00:00 8780k 0.0% 3720 iashost 8 00:00:00 11352k 0.0% 3776 SVC:TSGateway 8 00:00:00 13508k 0.0% 2092 SVC:Tssdis 8 00:00:00 11016k 0.0% 4068 VCDDaemon 8 00:00:00 5572k 0.0% 2800 dwm 13 00:00:01 39200k 0.0% 2688 SVC:MSDTC 8 00:00:00 6616k 0.0% 3088 taskhostex 8 00:00:00 6400k 0.0% 3292 explorer 8 00:00:07 89732k 0.0% 2324 SVC:COMSysApp 8 00:00:00 9872k 0.0% 3464 ClassicStartMenu 8 00:00:00 8028k 0.0% 2432 taskeng 6 00:00:00 4372k 0.0% 2376 SVC:PolicyAgent 8 00:00:00 4284k 0.0% 1820 vdagent 13 00:00:00 3768k 0.0% 712 dwm 13 00:00:00 29124k 0.0% 696 LogonUI 13 00:00:00 26172k 0.0% 724 SVC:vdservice 10 00:00:00 2712k 0.0% 928 SVC:CryptSvc/Dnscache/LanmanWo 8 00:00:00 16628k 0.0% 828 SVC:EventSystem/FontCache/netp 8 00:00:00 11656k 0.0% 568 SVC:BrokerInfrastructure/DcomL 8 00:00:00 10220k 0.0% 208 smss 11 00:00:00 992k 0.0% 0 Idle 0 4k 0.0% 404 csrss 13 00:00:00 3272k 0.0% 440 winlogon 13 00:00:00 5268k 0.0% 412 wininit 13 00:00:00 3496k 0.0% 1072 SVC:Spooler 8 00:00:00 10496k 0.0% 1440 SVC:WIDWriter 8 00:00:00 5492k 0.0% 1424 SVC:W3SVC/WAS 8 00:00:00 8352k 0.0% 1576 SVC:XymonPSClient 8 00:00:00 3888k 0.0% 1736 winlogon 13 00:00:00 5196k 0.0% 1732 csrss 13 00:00:00 19372k 0.0% 1368 SVC:ScDeviceEnum/SysMain/TrkWk 8 00:00:04 11180k 0.0% 1124 SVC:IISADMIN 8 00:00:00 15408k 0.0% 1100 SVC:AppHostSvc 8 00:00:00 7252k 0.0% 1164 SVC:KPSSVC 8 00:00:00 3020k 0.0% 1280 SVC:QEMU-GA 8 00:00:00 5060k 0.0% 1208 SVC:QEMU Guest Agent VSS Provi 8 00:00:00 5292k --- I've got the following in /etc/xymon/analysis.cfg --- CLASS=powershell LOAD=80 90 --- and in /etc/xymon/client-local.cfg --- [powershell] eventlog:security ignore success ignore Success ignore "The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer" eventlog:system ignore "Contact the administrator to install the driver before you log in again" adreplicationcheck terminalservicessessions:10:15 --- Any ideas how I can get the thresholds in the analysis file to be honored?

2 1

Possible defect in rrd handler causing divide-by-zero crashes
by john.thurston＠alaska.gov 22 Apr '15

22 Apr '15

It has been a long road, but I may have uncovered a defect in the rrd handler. I'm currently running xymon 4.3.17 (somewhat patched) on Solaris 10 on SPARC. :: Symptom :: The xymond_rrd process crashes. It leaves footprints in the log like: > 2015-04-20 19:09:18 Child process 23929 died: Signal 8 > 2015-04-20 19:09:18 Peer at 0.0.0.0:0 failed: Broken pipe > 2015-04-20 19:09:18 Peer not up, flushing message queue It also leaves a pid file behind. It also leaves gaps in the rrd data. :: Tracing :: By collecting core dumps and using pstack, I was able to see: > __divdi3+0x164(0, 0, 0, 0, 0, 0) > do_la_rrd+0x2d4(1017c8, 1017e4, 10181d, 101829, 1, 55369956) > update_rrd+0x76c(1017c8, 1017e4, 10182c, 55369956, 1017c0, 69000) > main+0xa40(10182c, ffbfdc3c, 101829, 68800, 3, 49538) > _start+0x5c(0, 0, 0, 0, 0, 0) By enabling --debug on the "xymond_channel --channel=status" task (after applying jc's patch of March 13 so that the debug code didn't crash xymond - Thank you!), I was able to see that the last messages received prior to crashes was always a sequence of status messages containing "mem" followed by "cpu". A "Signal 8" is commonly associated with a "divide by zero" event. Not being very C-aware, I had to consult google to learn that __divdi3 is a library used for unsigned long-int division. So if I'm reading the stack trace correctly, update_rrd called do_la_rrd which tied to do a division which failed. :: Smoking gun? :: One of the hosts (running a BBPE 4.3 client), whose status message triggered a crash, has the following in its last CPU message: > Memory Statistics > Total Physical memory: 0 bytes (1.00MB) > Available Physical memory: 0 bytes (1.00MB) > Total PageFile size: 17397915648 bytes (16.20GB) > Available PageFile size: 12473839616 bytes (11.62GB) > Total Virtual memory size: 17397915648 bytes (16.20GB) > Available Virtual memory size: 12487081984 bytes (11.63GB) And has the following in its last MEM message: > Physical Memory: 0.00MB/1.00MB (-1.#J%) > Commit Charge: 4.59GB/16.20GB (28.30%) > > Memory Statistics (Used/Available/Total in bytes) > Physical Memory: 0 (0.00MB) / 0 (1.00MB) / 0 (1.00MB) > Commit Charge: 4924112896 (4.59GB) / 12473839616 (11.62GB) / 17397915648 (16.20GB) > Virtual memory: 4910481408 (4.57GB) / 12487081984 (11.63GB) / 17397915648 (16.20GB) It isn't reasonable for a system to actually have 0MB of memory, but that is what the client has reported. :: Hypothesis :: The message handling code is accepting messages from clients stating 0MB total physical memory, but such information is making its way into the RRD handler and causing a divide by zero. Can anyone else test this hypothesis? Can someone with more C-skills look at do_la_rrd and see if a zero really can find its way into its division statements? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 3

SPLITNCV and graphs
by solitaryr＠gmail.com 22 Apr '15

22 Apr '15

I'm trying to add a new graph to a test using NCV (SPLITNCV actually). I read through the graphing tips, I read several emails that provided hints (not my exact problem but nudged me the right way)... long story short. I finally got he graph to show up on my test page...but the rrd file doesn't seem to be populating the fields as expected when I run "rrdtool dump". The only thing I can figure is that the test I'm performing doesn't run every 5 minutes but every 15 minutes. Does that matter? I would have expected in the worst case that only every 3rd row would have a value. What am I missing here? Note, I dropped my test to run every 5 minutes to see if this theory is true. As a side note, it would be extremely helpful if the NCV component didn't look at the entire status but required a comment block (for example) to contain it. That way you could keep your data stream isolated from your message. For example:  My test kept creating an rrd file for a date string that was part of the status message. That's a bit annoying. =G=

9 12

*nix servers are not emailing alerts
by mpannucc＠ycp.edu 22 Apr '15

22 Apr '15

Hello I currently took over xymon administration in our institution. We currently receive alerts for all of our Windows servers for just about any condition. However, *nix servers seem to be very reserved in what they sound out...if they send anything at all. I have tried to locate where I should be specifying that I would like the *nix servers to send alerts like the Windows serves do but have no had much luck. One thing In particular I would like to receive emails about is when the disk is reaching its threshold. If I log into the web interface I can see the live status...just no emails every go out, and everything looks to be setup correctly. If there are some things I should be looking at, any help would be great. Thank you Matt __________________ -- This information is intended solely for the use of the individual to whom it is addressed. Any review, disclosure, copying, distribution or use of this e-mail communication by others is strictly prohibited. If you are not the intended recipient, please notify us immediately by returning this message to the sender and delete all copies.

2 1