- Xymon - Xymon mailman web

logstash output for xymon
by wbeauchaine＠katei.net 18 Apr '15

18 Apr '15

Hello i use http://www.logstash.net and xymon so i adapted the logstash output zabbix for xymon: http://pastebin.com/UQBJF7m7 Actually i have not contacted logstash team to add this output. So if you want use this you need to copy this code to logstash/outputs/xymon.rb. Execute jar -uf logstash-1.1.0.1-monolithic.jar logstash/outputs/xymon.rb to add this on jar file i have only test this on linux if you have any question please contact me by email Regards, Wilfrid

4 6

Any way to do http tests with HEAD request?
by landrew＠pnnl.gov 17 Apr '15

17 Apr '15

I've been converting from running an installation of BigBrother professional to Xymon (4.3.18), and I've had some complaints that the HTTP test is impacting a few of our servers (lots of back-end database requests and calculations for a generated page that is being tested for availability.) I didn't understand why nobody was complaining previously, until I saw that BigBro was set up to use the "curl" command with the "-I" option (aka the "--head" option) to send a "HEAD" request to the server. The BigBro web test used this setting: .... hawkeye{root}169: grep curl etc/bbdef-server.sh # OR USE curl, WHICH IS BETTER... LYNX="/usr/bin/curl -g -s -S -m 45 -I -k --connect-timeout 15 --user-agent 'Mozilla/5.0' " hawkeye{root}170: .... Is there some equivalent ability in Xymon to just issue a "HEAD" request when testing http and https services? I expected I'd find an equivalent option for use in the hosts.cfg file in Xymon, but haven't been able to find it if it's there. Any ideas on how to -Andrew

5 8

Bug in msgs test in 4.3.19
by johan.sjoberg＠deltait.se 16 Apr '15

16 Apr '15

Hi. I upgraded our Xymon server to 4.3.19. Unfortunately, I experienced problems with the msgs test for the Xymon server itself. The most serious bug is that I am getting log rows associated with the wrong log file, and triggering alerts for that file. If I look in the client data, I can see that a few lines are from the correct file, but then it switches over to another log file's content: [msgs:/var/log/server01.log] <...SKIPPED...> Apr 16 15:53:32 server01 AppMailImporter[INFO]: KTRO2155 Successfully made deed avaliable to registrator group propID = 10029300 Apr 16 15:54:38 server01 AppMailImporter[INFO]: KESK2216 Email did not have a body or contains crap from scanners only. Not creating deed, but for attachments! Apr 16 15:54:38 server01 AppMailImporter[INFO]: KESK2216 PostList item created with propID = 10101563 Apr 16 15:54:38 server01 AppMailImporter[INFO]: KESK2216 Attachment written to disk with GUID = 6fc966f7-796b-427f-b114-173f927ae451.pdf Apr 16 15:54:39 server01 AppMailImporter[INFO]: KESK2216 Created document with propID = 10101564 and ObjectID = 15612 <...CURRENT...> Apr 16 15:54:39 server01 AppMailImporter[INFO]: KESK2216 Successfully connected document with deed propID = 10101563 and ObjectID = 15612 cal proxy 192.168.105.10/255.255.255.255/0/0 on interface outside Apr 16 15:51:02 fw2-v10 %ASA-3-713902: Group = 192.168.206.250, IP = 192.168.206.250, QM FSM error (P2 struct &0x00007fff4a020c40, mess id 0x5ac031d1)! Apr 16 15:51:02 fw2-v10 %ASA-3-713902: Group = 192.168.206.250, IP = 192.168.206.250, Removing peer from correlator table failed, no match! The logs for "server01" are from the correct file, but the ones from "fw2-v10" are from a different log file which has different alert match rules. The log file for fw2-v10 is also included in the client data, as a separate section Also, if I alert on all log entries, I now get alerts for <...CURRENT...>, which I guess is some tag that is added internally by Xymon. This I can avoid by adding ignore for this string, so it's not a big problem. Regards, Johan

2 1

Xymon 4.3.19 Released
by cleaver＠terabithia.org 16 Apr '15

16 Apr '15

Hello, Xymon 4.3.19 has been released to SF and should be available on a mirror near you! It can be downloaded from https://sourceforge.net/projects/xymon/ 4.3.19 contains a number of bug fixes and improvements, along with a several new features. - a report on all recent acknowledgements is now available - a specific time range can now be excluded for analysis or alerting purposes with the EXTIME= directive - additional filters are available with the "xymondboard" command, including searching the full body text of a status report - the last position read in a log file is now indicated on the 'msgs' status report - a new 'deltacount' option for counting recent matching lines in a log file - improved Windows PowerShell client support For a full list of changes, see the Changes file inside the tarball. All users of 4.3.x or earlier versions of Xymon are encouraged to upgrade. Regards, -jc

5 7

xymon-snmpcollect - state ? xymond_channel worker needed for trending ?
by steve＠nerdynomads.net 16 Apr '15

16 Apr '15

Sorry for the replying to an old message, but seems there hasn't been any recent discussion of snmp polling. I believe I have everything working perfectly with 4.3.18, I see clientdata coming in on my test switch and I am collecting data on the [ifmib] definition in "server/etc/snmpmibs.cfg". What I don't have is trending on that data. I am assuming that is because the data is coming in under to xymon via "client" message versus a "data" message. To get trends, I assume I could write a xymond_channel worker listening on the client channel and using a filter option to target only "snmpcollect" messages. This would process the raw data, and submit the data I want to trend on via "data" messages ? Or am I just to bogged in the details and missing something obvious ? Thanks, -Steve -----Original Message----- To: hobbit (at) hswn.dk *Subject: Re: [hobbit] snmp *From: Henrik Stoerner <henrik (at) hswn.dk> *Date: Fri, 7 Mar 2008 07:34:31 +0100 *References: <001001c88014$695664f0$0500a8c0 (at) noip.org> *User-agent: Mutt/1.5.15+20070412 (2007-04-11) On Fri, Mar 07, 2008 at 06:30:53AM +0100, Lars Ebeling wrote: > I would like to have an examle of the snmp configuration file: > hobbit-snmphosts.cfg-- Here's one: [osiris.hswn.dk] version=2c community=public ip=172.16.10.100 ifmib={172.16.10.100} # ifmib={*} hrsystem hrstorage=(Real Memory) hrstorage=(Swap Space) hrstorage=(/) hrstorage=(/work) hrtask=<*> To understand how it works, you need to look at the hobbit-snmpmibs.cfg file also. In this file you'll find an [ifmib] section that begins with [ifmib] keyidx (IF-MIB::ifDescr) keyidx [IF-MIB::ifPhysAddress] keyidx <IF-MIB::ifName> validx {IP-MIB::ipAdEntIfIndex} ifDescr = IF-MIB::ifDescr Note the different kind of parentheses / brackets ? What these do is they act like an index into the list of network interfaces. So the line "ifmib={172.16.10.100}" means "grab the ifmib data for the network interface whose {IP-MIB::ipAdEntIfIndex} (IP-address) is 172.16.10.100. If you wanted the statistics from the "eth0" net-interface, you would use "ifmib=(eth0)". The line that just read "hrsystem" has no index, because this data - part of the Host Ressources MIB - only has one entry globally (e.g. there is only one count of how many users are logged on). The "hrtask=<*>" of course means to fetch information about all of the tasks running on the system. Regards, Henrik

2 2

Xymon prominently displayed in "Weather Channel" TV commercials in CT, USA
by waa-hobbitml＠revpol.com 16 Apr '15

16 Apr '15

Saw a Weather Channel commercial the other and when they display their NOC and pan around, there is a screen in the middle of the room clearly displaying what appears to be a Xymon "nongreen.html" page, and another much larger one on the NOC's main video wall. Wondering if anyone else has noticed this, or if it is not even Xymon. :) Cheers! -- Bill Arlofski Reverse Polarity, LLC http://www.revpol.com/ -- Not responsible for anything below this line --

7 8

xymon client message STATUSLIFETIME?
by jlaidman＠rebel-it.com.au 15 Apr '15

15 Apr '15

I'll assume you've looked at the "dialup" keyword, which will make client (eg cpu and disk) statuses clear instead of purple. The default lifetime (30 minutes) is defined by the STATUSLIFETIME variable defined in xymonserver.cfg on the server. To override this value for network checks, you can specify "--validity=N" on the command-line used to run xymonnet. Neither of these are likely to help you. The client messages are turned into status messages by xymond_client. All instances of code in xymond_client that sends a status message do so without a validity specified. One thing you could do is to write a script that reads and refreshes the status for all relevant entries for the server in question, run every 25 minutes. For example: $XYMON $XYMSRV 'xymondboard host=host.example.com test=^(disk|memory|cpu)$ fields=hostname,testname,color,clntstamp' This gives you the client timestamp (in epoch seconds) - when the client message was received. You can subtract this from the current time (eg from "date +%s") to get the age of the client message. If it's less than 25 minutes, you have a status message that needs to be "refreshed". What you then would do is to query (with: $XYMON $XYMSRV "xymondlog host.example.com.cpu") and replay the status message (including whatever colour it had) with "+LIFETIME" added. Also, you could label all such hosts with a special keyword like how xymonnet uses "dialup", perhaps "daily". Then use "xymongrep daily" to get the hostnames you want to refresh. Cheers Jeremy On 14 April 2015 at 01:09, Werner Maier <werner at maiers.de> wrote: > Hi, > > I have the following problem: > > I want to monitor the client data of a machine that is only up > once a day. > > the machine gets waked up w/ wakeonlan, takes an rsnapshost of other > servers, and shuts down again. (no need to be up 24/7 with 8 2 TB HDDs, > raidcontroller)... > > I know about the normal xymon status+LIFETIME protocol. > but I don't see where or how to configure that client to send > a LIFETIME with the "xymonclient.sh" - it uses the > "client" protocol. > > how do I set the validity for these tests to 24h+ ? > (1600 minutes should be ok). > > thanks in advance. > > Werner > -- > Dipl.-Ing. Univ. Werner Maier > http://www.maiers.de/ > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

New XymonPSClient running in central mode
by colin.coe＠gmail.com 15 Apr '15

15 Apr '15

Hi all I've googled but not found an answer to this. Anyone know if the new PowerShell client supports central mode? Thanks CC

2 2

Improving memory monitoring
by mburger＠bubbanfriends.org 14 Apr '15

14 Apr '15

Forgot to reply all. On 2015-04-14 10:00 am, Mike Burger wrote: > On 2015-04-14 7:56 am, Steve Hill wrote: >> I'm working on improving my Xymon configuration to reduce the number >> of false alerts that we get. In particular, memory monitoring is a >> bit of a problem so I'm hoping someone will be able to offer some >> advice. >> >> At the moment, Xymon is set up with something like: >> >> MEMPHYS 100 101 >> MEMSWAP 20 40 >> MEMACT 95 97 >> >> I pretty much don't care about MEMPHYS. The problem with MEMSWAP and >> MEMACT is that they work independently or each other - i.e. the above >> will give me an alert if > 97% of the RAM is used OR > 40% of swap is >> used. >> >> However, this results in warnings for systems that have a lot of idle >> data in memory. The Linux kernel will page out idle data (increasing >> swap usage and reducing RAM usage) and use that space for >> buffers/caches, and this is a very sensible strategy. Unfortunately, >> then Xymon comes along and notices that there's lots of swap in use >> and throws an alert, even though there's plenty of RAM free. >> >> Basically, I don't care that a machine is 4GB into swap if it has 5GB >> of free ram - that isn't a problem, it just means there's quite a lot >> of idle data that the kernel has decided can be paged out. I do care >> if it's 4GB into swap and only has 0.5GB of free RAM since this would >> indicate that it's actually short of memory. >> >> What I really need is to warn if > x% of the RAM is used AND > y% of >> swap is used - is there a way to do that? > > I'll say that I've never run into this...I've never had a system swap > memory out to disk unless active memory was utilized at a high > percentage...in either AIX or Linux. > > In AIX, there is some sort of algorithm in place where, if a process' > memory has been swapped out and then swapped back in, the memory > manager holds onto the paging space until either something else needs > paging space or the previously swapped out process ends, but I don't > think I've ever seen a situation in Linux where idle memory pages were > swapped to disk and physical/active memory had some large percentage > free. > > Now, on the other side of this, to take a stab at the question, I'd > wager that, at present, you'd need to script such a test/alert..but I > would agree that it would be useful to be able to set an "alarm if > this or this" or an "alarm if this and this" type scenario. At > present, the only tests I can think of that allow this, "out of the > box" are the process monitors, where you can set minimum and maximum > thresholds. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

3 2

HTTPS tests fails when TLS 1.1 and 1.2 only is enabled
by dito74＠gmail.com 14 Apr '15

14 Apr '15

I saw a post back that someone suggested to use "httpst://url" but that is not working either. I am running build .17 , not sure if upgrading to .18 or .19 will work, I'll read the notes. Is there another way to fix? Gab

2 10