- Xymon - Xymon mailman web

xymongen hanging
by David.Logan＠nt.gov.au 20 Oct '22

20 Oct '22

Hi Folks, Just wondering if anybody has any experience with xymongen hanging. I have a large number of xymongen processes being kicked off sometime over the weekend, unfortunately they are owned by apache and have a PPID of 1 so I can't tell how they were started. I'm presuming either xymoncmd but I can't see anything in the crontab for xymon or in tasks.cfg that would kick off the snapshots and reporting processes. These then sit for a very long time (> 24hrs) while trying to read a data file from a specific server. apache 14749 1 44 Oct16 ? 10:28:39 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/14748-1665896723 apache 14867 1 43 Oct16 ? 10:26:32 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/14866-1665896747 apache 15107 1 43 Oct16 ? 10:26:05 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15106-1665896768 apache 15118 1 43 Oct16 ? 10:25:58 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15117-1665896774 apache 15125 1 43 Oct16 ? 10:25:12 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15124-1665896783 apache 15238 1 43 Oct16 ? 10:23:26 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15237-1665896797 apache 15269 1 43 Oct16 ? 10:25:31 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15268-1665896804 apache 15349 1 43 Oct16 ? 10:22:20 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15348-1665896807 apache 15382 1 43 Oct16 ? 10:23:40 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15381-1665896828 apache 15398 1 43 Oct16 ? 10:25:13 /xymon/server/server/bin/xymongen --snapshot=2222867979 XYMONGENSNAPOPTS /xymon/server/server/www/snap/15397-1665896834 apache 15400 1 43 Oct16 ? 10:22:59 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15399-1665896837 apache 15757 1 43 Oct16 ? 10:24:48 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15756-1665896864 apache 15842 1 43 Oct16 ? 10:22:32 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15841-1665896873 apache 15964 1 43 Oct16 ? 10:24:21 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15963-1665896897 apache 15996 1 43 Oct16 ? 10:22:25 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/15995-1665896912 apache 16133 1 43 Oct16 ? 10:22:07 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/16132-1665896933 apache 16149 1 43 Oct16 ? 10:23:37 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/16148-1665896954 apache 16215 1 43 Oct16 ? 10:23:45 /xymon/server/server/bin/xymongen --reportopts=2222871640:2222958039:1: /xymon/server/server/www/rep/16214-1665896972 An strace for the first pid is as follows (they are all the same) and looking at file descriptor 3 [root at dcslmonitor 15238]# strace -f -p 14749 Process 14749 attached read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 read(3, "", 4096) = 0 fd3 is xymongen 14749 apache cwd DIR 253,0 6 134320195 /xymon/server/data/acks xymongen 14749 apache rtd DIR 8,2 269 64 / xymongen 14749 apache txt REG 253,0 1106256 135222190 /xymon/server/server/bin/xymongen xymongen 14749 apache mem REG 8,6 155784 4448319 /usr/lib64/libselinux.so.1 xymongen 14749 apache mem REG 8,6 109976 4873245 /usr/lib64/libresolv-2.17.so xymongen 14749 apache mem REG 8,6 15688 4259351 /usr/lib64/libkeyutils.so.1.5 xymongen 14749 apache mem REG 8,6 67104 4471490 /usr/lib64/libkrb5support.so.0.1 xymongen 14749 apache mem REG 8,6 142144 4873243 /usr/lib64/libpthread-2.17.so xymongen 14749 apache mem REG 8,6 90632 4195838 /usr/lib64/libz.so.1.2.7 xymongen 14749 apache mem REG 8,6 19248 4358022 /usr/lib64/libdl-2.17.so xymongen 14749 apache mem REG 8,6 210824 4471445 /usr/lib64/libk5crypto.so.3.1 xymongen 14749 apache mem REG 8,6 15920 4939663 /usr/lib64/libcom_err.so.2.1 xymongen 14749 apache mem REG 8,6 967840 4259800 /usr/lib64/libkrb5.so.3.3 xymongen 14749 apache mem REG 8,6 320400 4256684 /usr/lib64/libgssapi_krb5.so.2.2 xymongen 14749 apache mem REG 8,6 2156272 4262067 /usr/lib64/libc-2.17.so xymongen 14749 apache mem REG 8,6 402384 4259730 /usr/lib64/libpcre.so.1.2.0 xymongen 14749 apache mem REG 8,6 2521008 4256674 /usr/lib64/libcrypto.so.1.0.2k xymongen 14749 apache mem REG 8,6 470360 4195836 /usr/lib64/libssl.so.1.0.2k xymongen 14749 apache mem REG 8,6 163312 4448246 /usr/lib64/ld-2.17.so xymongen 14749 apache 0r FIFO 0,8 0t0 404824379 pipe xymongen 14749 apache 1w FIFO 0,8 0t0 404824380 pipe xymongen 14749 apache 2w FIFO 0,8 0t0 404824381 pipe xymongen 14749 apache 3r REG 253,0 524 67195718 /xymon/server/data/hist/accessntg.sslcert Every process (in the process list above) shows they have the same file open as fd3, are they locking each other out or more to the point, should they be? Any ideas on where to look or what to do next? Thanks David Logan Senior Systems Administrator Data Centre Services Department of Corporate and Digital Development | Northern Territory Government GPO Box 2391, Darwin, NT 0801, Australia DCS Midrange Ticketing System p ... <+61> 8 8999 6968 m ... <+61> 458 631 117 New and Existing tickets: http://dcscentral.nt.gov.au/ e ... david.logan at nt.gov.au<mailto:david.logan at nt.gov.au> or dcs_service at nt.gov.au<mailto:dcs_service at nt.gov.au> w ... www.nt.gov.au<http://www.nt.gov.au/> Escalations: (08) 8999 7654 Our vision: improve government through services and solutions that exceed expectations Our values: Honest | Professional | Respectful | Accountable | Innovative The information in this e-mail is intended solely for the addressee named. It may contain legally privileged or confidential information that is subject to copyright. If you are not the intended recipient you must not use, disclose copy or distribute this communication. If you have received this message in error, please delete the e-mail and notify the sender. No representation is made that this e-mail is free of viruses. Virus scanning is recommended and is the responsibility of the recipient. Please consider the environment before printing this email.

5 6

Terabithia - certificate expired
by john.horne＠plymouth.ac.uk 29 Sep '22

29 Sep '22

Hello, It looks like the certificate used by the repository has expired: SSL peer certificate or SSH remote key was not OK for https://repo.terabithia.org/rpms/xymon/el9/x86_64/repodata/repomd.xml [SSL certificate problem: certificate has expired] Although the above is for the testing (el9) repository, I get a similar message for the el7 repository: https://repo.terabithia.org/rpms/xymon/el7/x86_64/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's Certificate has expired." John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

3 4

Weird devmon issue with Terabithia RPM's
by Neil.Simmonds＠studio.co.uk 29 Sep '22

29 Sep '22

Hi Bruno, Thanks for the suggestion. I did that and, because I was working on a copy I also took the step of moving all the files in hosts.d to be a part of the hosts.cfg file to rule that out. Thanks to doing that I realised that I have some includes in there that the files don't exist for yet as I haven't copied the scripts over that create them I've commented out those extra includes and it's all working now. So worth people being aware, if you have a specific file included and it's missing it devmon will fail. Regards, Neil. From: Bruno Manzoni <bruno.manzoni at ubi-network.ch> Sent: 29 September 2022 12:12 To: Neil Simmonds <Neil.Simmonds at studio.co.uk> Subject: Re: [Xymon] Weird devmon issue with Terabithia RPM's [CAUTION] This is an external email. Do not click links or open any attachments unless you are sure they are safe. Hi Neil, I manage devmon on github,(I try), and I never see your problem, but it seems to me a permission issue: you can may be place a copy of the hosts file in another location and set it in devmon.cfg: just to confirm that it is a permission issue. Hope this help. Regards Bruno Le 29.09.2022 ? 12:54, Neil Simmonds a ?crit : Hi folks, I'm currently building a new Xymon server and I'm going from Centos 5 running Xymon 4.3.4 to RHEL 8 running Xymon 4.3.30-1. I've also switched to using the Terabithia RPM's and I've gone from the old sourceforge Devmon to the new Github devmon. So all in all, quite a bit of change . I've had to do quite a lot of changing of paths in config files and scripts due to the different layout when using Terabithia but I'm happy I've made all those changes correctly. However, when trying to run devmon using "./devmon --readbbhosts -vvvvv" I'm getting an error of [22-09-29 at 10:41:50] Unable to open file '/etc/xymon/hosts.cfg' (No such file or directory) Exiting subroutine via next at /opt/devmon/modules/dm_config.pm line 1548 (#1) (W exiting) You are exiting a subroutine by unconventional means, such as a goto, or a loop control statement. Label not found for "next FILEREAD" at /opt/devmon/modules/dm_config.pm line 1548 (#2) (F) You named a loop to continue, but you're not currently in a loop of that name, not even if you count where you were called from. See "last" in perlfunc. Uncaught exception from user code: Label not found for "next FILEREAD" at /opt/devmon/modules/dm_config.pm line 1548. dm_config::read_hosts_cfg() called at /opt/devmon/modules/dm_config.pm line 575 dm_config::initialize("0.22.06") called at ./devmon line 27 I've checked permissions on /etc/xymon/hosts.cfg and it's 666 (probably only needs to be 644 but I made it 666 to try and solve this) The only thing I can think of is that I've only got 1 entry in the hosts.cfg file and that's an include for the /etc/xymon/hosts.d directory but that does seem to be being read by devmon as it lists all the checks it's doing before the error. (EG "Checking if # testip matches NET:." ) Has anyone seen this kind of error before and have any idea about how I might fix it? Thanks, Neil Simmonds. Studio is a trading name of Studio Retail Ltd which is authorised and regulated by the Financial Conduct Authority for consumer credit and general insurance. Studio Retail Ltd are members of the Finance and Leasing Association (FLA). Registered in England. No: 718151. Registered Office: Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Ltd and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Ltd reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error, please notify our careline on +44(0) 371 200 0378. _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…> Studio is a trading name of Studio Retail Ltd which is authorised and regulated by the Financial Conduct Authority for consumer credit and general insurance. Studio Retail Ltd are members of the Finance and Leasing Association (FLA). Registered in England. No: 718151. Registered Office: Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Ltd and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Ltd reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error, please notify our careline on +44(0) 371 200 0378.

2 1

Weird devmon issue with Terabithia RPM's
by Neil.Simmonds＠studio.co.uk 29 Sep '22

29 Sep '22

Hi folks, I'm currently building a new Xymon server and I'm going from Centos 5 running Xymon 4.3.4 to RHEL 8 running Xymon 4.3.30-1. I've also switched to using the Terabithia RPM's and I've gone from the old sourceforge Devmon to the new Github devmon. So all in all, quite a bit of change . I've had to do quite a lot of changing of paths in config files and scripts due to the different layout when using Terabithia but I'm happy I've made all those changes correctly. However, when trying to run devmon using "./devmon --readbbhosts -vvvvv" I'm getting an error of [22-09-29 at 10:41:50] Unable to open file '/etc/xymon/hosts.cfg' (No such file or directory) Exiting subroutine via next at /opt/devmon/modules/dm_config.pm line 1548 (#1) (W exiting) You are exiting a subroutine by unconventional means, such as a goto, or a loop control statement. Label not found for "next FILEREAD" at /opt/devmon/modules/dm_config.pm line 1548 (#2) (F) You named a loop to continue, but you're not currently in a loop of that name, not even if you count where you were called from. See "last" in perlfunc. Uncaught exception from user code: Label not found for "next FILEREAD" at /opt/devmon/modules/dm_config.pm line 1548. dm_config::read_hosts_cfg() called at /opt/devmon/modules/dm_config.pm line 575 dm_config::initialize("0.22.06") called at ./devmon line 27 I've checked permissions on /etc/xymon/hosts.cfg and it's 666 (probably only needs to be 644 but I made it 666 to try and solve this) The only thing I can think of is that I've only got 1 entry in the hosts.cfg file and that's an include for the /etc/xymon/hosts.d directory but that does seem to be being read by devmon as it lists all the checks it's doing before the error. (EG "Checking if # testip matches NET:." ) Has anyone seen this kind of error before and have any idea about how I might fix it? Thanks, Neil Simmonds. Studio is a trading name of Studio Retail Ltd which is authorised and regulated by the Financial Conduct Authority for consumer credit and general insurance. Studio Retail Ltd are members of the Finance and Leasing Association (FLA). Registered in England. No: 718151. Registered Office: Church Bridge House, Henry Street, Accrington, BB5 4EE NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Studio Retail Ltd and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Studio Retail Ltd. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Studio Retail Ltd reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error, please notify our careline on +44(0) 371 200 0378.

1 0

Capture and send data To Elasticsearch and Kibana
by francois.outteryck＠soprasteria.com 27 Sep '22

27 Sep '22

Hi Peter, Examples of task.cfg configuration with status and stachg events : [capture_status] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture.log LOGFILE /var/log/xymon/lunch_capture.log [capture_stachg] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEED xymond CMD xymond_channel --channel=stachg /home/xymon/server/ext/capture.sh --log=$XYMONSERVERLOGS/xymond_task_capture_stachg.log LOGFILE /var/log/xymon/lunch_capture_stachg.log Capture.sh script simple made to call a php script : #!/bin/sh /usr/bin/php /var/www/kibana/capture.php $@ </dev/stdin >>/var/log/xymon/xymond_capture_php.log 2>&1 And capture.php make all job : <?php date_default_timezone_set('Europe/Paris'); $TODO=FALSE; $ARRAY_COLLECTOR=array(); $COLLECTOR=null; while (FALSE !== ($line = fgets(STDIN))) if ($line!='') { $tab=reduce_array($line); if (sizeof($tab)==0) continue; if ($line=="@@\n") { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } else if (substr($tab[0],0,8)=='@@stachg') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@stachg#seq|timestamp|sender|origin|hostname|testname|expiretime|color|prevcolor|changetime|disabletime|disablemsg|downtimeactive|clienttstamp|modifiers */ $COLLECTOR='stachg'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'PrevStatus'=>$metadata[8], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[9], 'DisableTime'=>$metadata[10], 'DisableMSg'=>$metadata[11], 'Message'=>'' ); $id=$metadata['ServerName'].'_'.$metadata['Type'].'_'.$meta['LastChange']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else if (substr($tab[0],0,8)=='@@status') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } /* 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 /* @@status|timestamp|sender|origin|hostname|testname|expiretime|color|testflags|prevcolor|changetime|ackexpiretime|ackmessage|disableexpiretime|disablemessage|clientmsgtstamp|flapping */ $COLLECTOR='status'; $metadata=explode('|',$tab[0]); $sender=$metadata[2]; $hostname=$metadata[3]; $metadata=array( 'Collector'=>$COLLECTOR, 'Sender'=>$metadata[2], 'ServerName'=>$metadata[4], 'Type'=>$metadata[5], 'Status'=>$metadata[7], 'LogTime'=>$metadata[1], 'ValidTime'=>$metadata[6], 'LastChange'=>$metadata[10], 'DisableTime'=>$metadata[13], 'AckTime'=>$metadata[11], 'DisableMSg'=>$metadata[14], 'Message'=>'' ); $id=$metadata['ServerName'].'.'.$metadata['Type']; $ARRAY_COLLECTOR=null; $ARRAY_COLLECTOR=array(); $TODO=TRUE; } else { if (substr($tab[0],0,2)=='@@') { if ($TODO) { $metadata['Message']=implode('',$ARRAY_COLLECTOR); SendData($id,$metadata,$COLLECTOR); $TODO=FALSE; $COLLECTOR=null; } } if ($TODO) $ARRAY_COLLECTOR[]=$line; } } function CallAPI($method, $url, $data = false) { $curl = curl_init(); switch ($method) { case "POST": curl_setopt($curl, CURLOPT_POST, 1); if ($data) curl_setopt($curl, CURLOPT_POSTFIELDS, $data); break; case "PUT": curl_setopt($curl, CURLOPT_PUT, 1); break; default: if ($data) $url = sprintf("%s?%s", $url, http_build_query($data)); } curl_setopt($curl, CURLOPT_URL, $url); curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); $result = curl_exec($curl); curl_close($curl); return $result; } function reduce_array($line) { $tab=explode(' ',$line); $nr=array(); for ($i=0;$i<sizeof($tab);$i++) if (trim($tab[$i])!='') $nr[]=trim($tab[$i]); return $nr; } function SendData($id,$cc,$COLLECTOR=null) { if ($COLLECTOR==null) return; $d=new DateTime(); if ($cc['LastChange']!='') {$d->setTimestamp($cc['LastChange']);$cc['LastChange']=$d->format('c');} else {$cc['LastChange']='NaN';} if ($cc['LogTime']!='') {$d->setTimestamp($cc['LogTime']);$cc['LogTime']=$d->format('c');} else {$cc['LogTime']='NaN';} if ($cc['ValidTime']!='') {$d->setTimestamp($cc['ValidTime']);$cc['ValidTime']=$d->format('c');} else {$cc['ValidTime']='NaN';} if (isset($cc['AckTime'])) { if ($cc['AckTime']!='') {$d->setTimestamp($cc['AckTime']);$cc['AckTime']=$d->format('c');} else {$cc['AckTime']='NaN';} } if ($cc['DisableTime']!='') {$d->setTimestamp($cc['DisableTime']);$cc['DisableTime']=$d->format('c'); } else {$cc['DisableTime']='NaN';} $data = json_encode($cc); $data=str_replace('"NaN"','null',$data); echo $id.'=>'.$data."\n"; $url="http://127.0.0.1:9200/xymon/".$COLLECTOR."/".$id; $res=CallAPI("POST",$url,$data); } ?> De : Peter Welter [mailto:peter.welter at gmail.com] Envoyé : vendredi 23 décembre 2016 14:45 À : OUTTERYCK Francois Cc : xymon at xymon.com Objet : Re: [Xymon] Capture and send data To Elasticsearch and Kibana Hi Francois, Looks good, your sample. I am very interested in your integration efforts. How do you select what is going to be inserted in the ELK stack? All status messages that Xymon receives? And could you provide an example of the xymond_channel block in you task.cfg and the capture.sh? Tasks.cfg probably is something like: [es] ... CMD xymond_channel --channel=status /home/xymon/server/ext/capture.sh ... And the capture.sh contains some curl script to the ELK stack? Regards, Peter 2016-12-14 18:15 GMT+01:00 OUTTERYCK Francois <francois.outteryck at soprasteria.com<mailto:francois.outteryck at soprasteria.com>>: Hello, I just do a small work with Xymon in order to send status data to Elasticsearch. And with Kibana reporting is easy. How it work ? Simple : With capture of status message (xymond_channel --channel=status /home/xymon/server/ext/capture.sh ) script encode status message in json and send as document in elasticSearch. Example of Mapping document status in elasticsearch : "status"=> array( "properties"=>array( "ServerName"=> array("type"=> "string"), "Type"=> array("type"=> "string"), "Status"=> array("type"=> "string"), "LastChange"=> array("type"=> "date","format"=> "strict_date_optional_time"), "LogTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "ValidTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "AckTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "DisableTime"=> array("type"=> "date","format"=> "strict_date_optional_time"), "Sender"=> array("type"=> "string"), "DisableMSg"=> array("type"=> "string"), "Message"=> array("type"=> "string") ) ) All is done with a 130 lines script. So simple to integrate in existing environment and so powerfull usage of Xymon/elasticsearch/Kibana For those who don’t know kibana : https://www.elastic.co/products/kibana [cid:image001.png at 01D25EA3.F74489F0] _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

2 1

pfSense monitoring
by Brian.Scott＠bunyatech.com.au 03 Sep '22

03 Sep '22

Hi List, I've just set up Xymon monitoring of a pfSense system and I thought I'd share a few details for others. pfSense is a firewall system based on FreeBSD using the 'pf' packet filter system. The FreeBSD system is trimmed down to a smaller operating system than the normal distribution and has a very small number of available packages available in the default repository, all related to it's firewall functionality. I've seen reference to pulling in packages from the standard FreeBSD pkg system but have chosen not to go down that path. My starting point is Jeremy Laidman's xymon-rclient.sh script from xymonton. This is a quite well thought out shell script (in contrast to many of the add-ons, including mine), that connects to the target system using ssh (or others that don't matter) and fires off a combination of the standard xymon client scripts and a few extra shell commands. The resulting output looks like the normal client log which is then handed back to xymon. The idea is that no special software is required on the target system. After installing the script in the server/ext directory, you add a tasks entry (I use a tasks.d directory file) to run the script every 5 minutes. All pretty standard stuff so far. The recommended task entry is: [xymon-rclient] ??????? ENVFILE $XYMONHOME/etc/xymonserver.cfg ??????? CMD /$XYMONHOME/ext/xymon-rclient.sh ??????? LOGFILE $XYMONSERVERLOGS/xymon-rclient.log ??????? INTERVAL 5m This looks for RCLIENT tags on entries in your hosts.cfg file. My tag looks like this: ??? "RCLIENT:cmd(ssh -T -o BatchMode=yes admin at 10.0.1.54 /bin/sh),ostype(freebsd)" Key points include the ostype(freebsd) part which identifies the target system type. This identifies the client script to send to the target system, in this case client/bin/xymonclient-freebsd.sh. The /bin/sh at the end of the command solves a particular problem. It tells the ssh daemon to run this program rather than the normal login shell. This is important because if you connect to a pfSense system by ssh (BTW this must be enabled first in the pfSense web interface), you are greeted by a menu rather than a command prompt. It would be possible to patch the rclient.sh script to send an '8' (the option for a shell) as the first thing it does, but that would mess up using the script for any other target systems. Including the /bin/sh command bypasses the menu and sets up the system in a shell to begin work. Note that this is a more or less standard bourne shell. Bash would only be available as an unsupported package but is also completely unnecessary. SSH Setup ====== To use ssh you will need to generate some key pairs and transport the public key parts to the target system. On the xymon server machine I did this (as root), assuming the xymon server runs as user called 'xymon': ??? cd ~xymon ??? mkdir .ssh ??? chown xymon .ssh ??? cd .ssh ??? ssh-keygen -t rsa -f id_rsa -P '' ??? ssh-keygen -t dsa -f id_dsa -P '' ??? ssh-keygen -t ecdsa -f id_ecdsa -P '' ??? ssh-keygen -t ed25519 -f id_ed25519 -P '' ??? chown xymon * Your ssh may have less or additional key types than mine, check your manpage for ssh-keygen. Also, that's two consecutive single quotes at the end of the line. You then need to transfer your public keys over to the target system. To get your public keys, type: ??? cat ~xymon/.ssh/*.pub And copy the resulting 4 lines of output (some of which may be wrapped over a few lines). We need to exchange public keys with the target server. Log on to the pfSense system as the local xymon user. This is important because we need this user to capture the remote pfSense host's public key in xymon's .ssh/known_hosts file. ??? su - xymon -c "ssh admin at 10.0.1.54" If you are a 'sudo' fan, adjust as necessary. Accept the remote system's key and then give the remote password. The pfSense menu should appear, select 8 to get a shell. Create a .ssh directory: ??? mkdir .ssh And add our public keys to the system. ??? cat >>.ssh/authorized_keys Paste in our public keys from earlier and press control+D on a new line to end input. Type control+D again to exit the shell, then select option '0' to logout from the menu. You should now be able to ssh to the pfSense system (as the xymon user) without accepting a new key or supplying a password. Test and verify. ??? su - xymon -c "ssh admin at 10.0.1.54" Fixes to xymon-rclient.sh ================ I've sent a diff file to Jeremy Laidman a couple of days ago. He may or may not change the code on xymonton. That's how these things work. Essentially there are two essential changes to reflect the target system not being Linux. One is a problem with the sent command stream over-running a fresh shell invocation intended to set up proper environment variables. The other change is to some sed GNU extensions used. There shouldn't be any impact on other systems. There are a couple of other minor fixes that I'd recommend but are not essential. I'm including the patch in this email (not sure if the mail list server approves) incase you have an unpatched copy. Fixes for Xymon ========== The client script for a FreeBSD system includes a small C program to extract memory data. This is a problem since we don't want to install a program on the target machine. We can avoid including that section in the client data if the program isn't available but then we don't get memory tracking by xymon. The reason for the program is that the installed memory on the system is available as a number of bytes. With recent systems this often excedes a 32 bit number. The requirement is a memory size in MB and shell arithmetic is limited to 32 bit integers. I've implemented two workarounds for this: 1) A massive hack - drop the last three digits of the size and divide by 1048 to get the size in MB. This should be surprisingly good up to memory sizes in TB. I've only tested to 32GB though. 2) Send the size in bytes back to xymon where it can properly process the numbers as unsigned longs. Xymon already uses "memory free" from a later section (vmtotal) so we don't need to fake that up, although it also quite doable but commented out in my fix. The other diff file includes patches for both the FreeBSD client script, and the xymond reader for freebsd client messages. You have three choices depending on circumstances and how much you care: 1) Do nothing. You won't have a memory column. Remember to include a NOCOLUMNS:memory tag on your pfSense machine in this case. 2) Just patch the client script. This should be good to just short of 2TB pfSense memory. pfSense doesn't need anything like that much memory. 3) Patch the script and the xymond code. Should be good up to a full 64 bit used address space. No nasty hacks involved. [Side note: netbsd and openbsd also have client programs for the same purpose. I don't have ready access to either of these systems to develop/test equivalent patches.] Other systems ========= I've also tested this on a nanobsd system (the ssh stuff is a little harder because of read-only file systems) and a dell server running my hypervisor on a recent version of FreeBSD. Also found that msdosfs file system on FreeBSD doesn't have inodes (I've normally handled this with exclusions) so added it to the inodes exclusion list. I hope this helps someone in the future, Brian P.S. If this email doesn't have the diff files attached, check for another email following close behind with them included as the message body.

1 0

mrtg column
by kspringer＠innovateteam.com 29 Aug '22

29 Aug '22

Anyone know how to get an MRTG column to appear?? I've got graphs magically appearing in the Trends page for hosts, but there's no MRTG column on the main status pages.? This used to be standard many xymon versions ago, but seemingly things have changed. -- Kris Springer

1 0

Xymon migration issue
by matt＠oddprocess.org 23 Aug '22

23 Aug '22

I migrated a Xymon 4.3.30 install from Arch Linux to Ubuntu 20.04. Everything appears to work perfectly, however, I can no longer see the dropdown menu at the top when I am on the page of an actual test (conn, disk, etc). The menu is fine everywhere else. Any suggestions? Thanks!

3 3

False positives for applet.py (system-config-printer)
by alt36＠cam.ac.uk 22 Aug '22

22 Aug '22

On 21/08/2022 11:52, Jaap Winius via Xymon wrote: > After more experimentation, I've managed to get Xymon to give me the > "all green" again, but only after adding a rather generic line to > libs.local.yaml: > > ?? - '.*$deleted$.*' > > Any more specific and the aforementioned false positive pops up again. > Any suggestions on how to make it more specific would be welcome. That's a rather far-reaching config line; it will mean any and all (deleted) files will be ignored by the libs test, if you've put it under '*' ! The crucial line in the libs script is return 1 if $path =~ $regexp; i.e. you want a perl regular expression for the entries in libs.local.yml. Given you mentioned /nfs/home/jwinius/.xsession-errors (deleted) nfs.umrk.nl:/nfs/home) you could thus try, perhaps, - '^/nfs/home/.*/\.xsession-errors ' (NB the trailing space is deliberate, given the example string you'd like to match). Look for online tutorials about perl regular expressions if it's not clear what's going on there. Adam

1 0

False positives for applet.py (system-config-printer)
by jwinius＠umrk.nl 21 Aug '22

21 Aug '22

Hi folks, After more experimentation, I've managed to get Xymon to give me the "all green" again, but only after adding a rather generic line to libs.local.yaml: - '.*$deleted$.*' Any more specific and the aforementioned false positive pops up again. Any suggestions on how to make it more specific would be welcome. Thanks, Jaap Quoting Jaap Winius via Xymon <xymon at xymon.com>: > Hi folks, > > Adam Thorn mentioned to me in an exchange a few months ago that "the > libs test pretty much just runs the lsof command and looks for files > which are either 'deleted' or 'DEL', so you can do this check for > yourself for a particular pid." His example command didn't quite > work, but I get the idea. In the case of applet.py, I find lines > like the following: > > applet.py 237463 jwinius 2w unknown 0,51 > /nfs/home/jwinius/.xsession-errors (deleted) nfs.umrk.nl:/nfs/home) > > What must be added to /etc/xymon/libs.local.yaml to whitelist lines > like this for all users? > > Thanks, > > Jaap > > > Quoting Jaap Winius via Xymon <xymon at xymon.com>: > >> Hi folks, >> >> Our virtual workstations run CUPS along with the >> "system-config-printer" package, which provides a "graphical >> interface to configure the printing system." Unfortunately, Xymon >> keeps reporting false-positives for this package, in particular for >> lines involving this one python script: >> >> /usr/bin/python3 /usr/share/system-config-printer/applet.py >> >> Xymon often erroneously reports that such processes have "libs >> linked that were upgraded", even though no upgrades have taken >> place. Also, there may be multiple reports of this per user and per >> session, and these will persist even after the user has logged out. >> >> Can anyone explain how to prevent these false positives? I imagine >> the solution will involve creating /etc/xymon/libs.local.yaml with >> a few lines added to it. >> >> Our virtual workstations run Debian 11.4 (Bullseye) with Xfce 4.16, >> cups 2.3.3op2-3+deb11u2, system-config-printer 1.5.14-1, xrdp >> 0.9.12-1.1 and xymon-client 4.3.30-1. The xymon server is also runs >> version 4.3.30-1 on top of Debian 11.4. >> >> Thanks, >> >> Jaap

1 0