- Xymon - Xymon mailman web

Xymon 4.3.19-rc1 available
by cleaver＠terabithia.org 25 Mar '15

25 Mar '15

Hello all! A pre-release (RC1) candidate of Xymon 4.3.19 has been posted to SourceForge and should be slowly making its way through the mirror system now! You can pick it up at: https://sourceforge.net/projects/xymon/files/Xymon/4.3.19-rc1/ There are a fair number of bug fixes in it, so I'd definitely appreciate as many people as possible taking it for a spin. WinPS Client processing should be better supported, and a number of issues with logfetch have been fixed (particularly in unusual filtration and regex situations). Please see the RELEASENOTES and Changelog for a full list. New features include additional "xymondboard" filters, EXTIME= rule support, compiler/building fixes, more efficient operation while running in --debug mode. If you notice any (new) bugs, or if I missed any patches or current issues, let me know! If no major problems pop up, I'm shooting to release 4.3.19 final some time this weekend. Regards, -jc

2 2

rrd logs and graphs
by everett.vernon＠gmail.com 25 Mar '15

25 Mar '15

Hi all Patched and reinstalled. But it didn't go quite as well as expected. Lots of shit broke. Then I remembered it overwrites most of the config files. Which will do that. There were a few minutes of panic there, until I remembered it makes backups of everything. :-) Copied the backup configs back, and it started to look good again. Whew! And, it looks like we have debug data. Now to catch it when it goes wrong. Regards Vernon On 25 March 2015 at 13:07, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote: > On 25 March 2015 at 15:54, Vernon Everett <everett.vernon at gmail.com> > wrote: > >> Ah! >> There are two patches for this. >> Yours, and JC's. >> I have been trying to apply JC's >> Attempting yours fails too. :-( >> > > Mine would possibly fail if JC's has already been applied, and vice versa. > > Both patches do a similar thing, just at different places in the code > execution path. Mine catches the null pointer and avoids calling > binview(), whereas JC's catches the null pointer inside binview(). I > suspect JC's patch will end up going into a future release of Xymon, so I'd > probably go with his. > > J > > -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

1 0

Bug in handling of Windows services
by Neil.Simmonds＠express-gifts.co.uk 25 Mar '15

25 Mar '15

I believe there is a bug in the way Xymon handles Windows service data. I've always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports, Service is started/automatic - want started/automatic This is with the analysis.cfg line of SVC Service status=started startup=automatic I'm currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client. I'm on version 4.3.4 of Xymon Server. I had a look through the release notes for all versions since 4.3.4 and couldn't find any mention of it so I suspect it is still an issue. Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

5 7

dnsreg script question
by john＠executech.com 24 Mar '15

24 Mar '15

Apologies for resurrecting an old thread. I added the sleep to the command because I'm running bbcmd on a few hundred domains. The script failed to run and I'm not sure why. My other issue is that there are a few domains that I want to run individually instead of it running the script on all the domains. Is there a way to kick off a test for a single host? I tried using "bbcmd hobbitd_alert --test domain.com dnsreg" but that only told me what alert rules applied to this but didn't update anything. Is there some command where I can tell a specific domain to do a fresh dnsreg? John Tullis ________________________________ Ok let me tweak it around. What does this line do anyhow? I keep seeing that pop up and then the error about command being not found thanks "status+90000 $DOMAIN.dnsreg $COLOR `date` From: Dugan, Darin D [EIT] [mailto:dddugan at iastate.edu<http://lists.xymon.com/mailman/listinfo/xymon>] Sent: Friday, September 21, 2012 10:50 AM To: Russell Blumenthal; xymon at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon> Subject: RE: dnsreg script question Rereading your message, it seems perhaps $XYMON or $XYMDISP are not populated. Are you running this under xymoncmd to set the environment? I run from cron daily with: /home/xymon/server/bin/xymoncmd --env=/home/xymon/server/etc/xymonserver.cfg /home/xymon/server/ext/dnsreg A few other differences in my script: 1. I'm using $XYMSRV instead of $XYMDISP. Hmm...I don't have a $XYMDISP anywhere, maybe $BBDISP wasn't updated to $XYMSRV properly? 2. Added a "sleep 60" command before "done". Whois seems to get angry with me if I query a bunch of domains in quick succession. 3. Had to modify the sed commands for EXPIRESTRING: EXPIRESTRING="`whois $DOMAIN | egrep -i "Expires.*:|Expiration.*:|Renewal.*:" | head -n 1 | cut -d: -f2 | sed -e's/^\s*//' | sed -e's/\s.*//'`" Cheers. From: Russell Blumenthal [mailto:rblumenthal at telmar.com<http://lists.xymon.com/mailman/listinfo/xymon>] Sent: Friday, September 21, 2012 8:09 AM To: Dugan, Darin D [EIT]; xymon at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon> Subject: RE: dnsreg script question I installed 'whois' and I am able to do a manual query 'whois domain.com'. but unable to run the script manually to test it. From: Dugan, Darin D [EIT] [mailto:dddugan at iastate.edu<http://lists.xymon.com/mailman/listinfo/xymon>] Sent: Friday, September 21, 2012 9:05 AM To: Russell Blumenthal; xymon at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon> Subject: RE: dnsreg script question I'm guessing you don't have 'whois' available or in the path. From: xymon-bounces at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon> [mailto:xymon-bounces at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon>] On Behalf Of Russell Blumenthal Sent: Thursday, September 20, 2012 4:30 PM To: xymon at xymon.com<http://lists.xymon.com/mailman/listinfo/xymon> Subject: [Xymon] dnsreg script question I am having an issue trying to get the dnsreg script working. I install it and all and when I go to test it I get this (I took out my domain). Any help would be appreciated. Thanks ./dnsreg.sh: line 31: status+90000 mydomain.com.dnsreg red Thu Sep 20 17:27:42 EDT 2012 Domain mydomain.com expires on : command not found The script looks like this: #!/bin/sh # Check DNS registrations in whois and warn when they are about to expire. # # NOTE: Requires a "whois" command that knows what servers to query. # Requires GNU date. # Should run only once a day. NOW=`date "+%s"` WARNTIME=`expr $NOW + 864000` # 10 days ALARMTIME=`expr $NOW + 432000` # 5 day /home/xymon/server/bin/xymongrep dnsreg | while read L do set $L DOMAIN=$2 EXPIRESTRING="`whois $DOMAIN | egrep -i "Expires.*:|Expiration.*:|Renewal.*:" | head -n 1 | cut -d: -f2 | sed -e's/^[ ]*//'`" EXPIRES=`date --date="$EXPIRESTRING" "+%s"` if test $EXPIRES -le $ALARMTIME then COLOR=red elif test $EXPIRES -le $WARNTIME then COLOR=yellow else COLOR=green fi $XYMON $XYMDISP "status+90000 $DOMAIN.dnsreg $COLOR `date` Domain $DOMAIN expires on $EXPIRESTRING " done

2 1

Migrating from BBWin to Xymon PS Client
by timothy_persoon＠hotmail.com 24 Mar '15

24 Mar '15

Hi, I'm migrating from BBWin to the newest Xymon PS Client. However, there are some settings in the BBWin.cfg file that I can't seem to migrate to the analysis.cfg file. In BBWin there are several message checks: <msgs> <setting name="alwaysgreen" value="false" /> <ignore logfile="Application" eventid="1000" /> <ignore logfile="Application" eventid="16385" /> <ignore logfile="Application" eventid="8198" /> <ignore logfile="Application" eventid="489" /> <ignore logfile="System" eventid="6038" /> <setting name="delay" value="1h" /> <match logfile="System" type="error" alarmcolor="red" /> <match logfile="System" type="warning" alarmcolor="yellow" /> <match logfile="Application" type="error" alarmcolor="red" /> <match logfile="Application" type="warning" alarmcolor="yellow" /> <match logfile="Security" type="fail" /> </msgs> but how do I migrate those to analysis.cfg? There seem to be two options: 1) LOG eventlog_application %^warning COLOR=red 2) LOG eventlog:Application %warning COLOR=red Is there a difference between these two notations and is it even possible to migrate the settings of BBWin.cfg to the analysis.cfg? Kind regards, Timothy

1 0

Windows Powershell client v2.01
by zak.beck＠accenture.com 24 Mar '15

24 Mar '15

I have today committed v2.01. Changes: * event logs now include the event id, in square brackets * added clientclass to xymonclient_config.xml to allow overriding the default class of 'powershell' The XymonPSClient.doc file has been updated. Event log records now contain the event id just after the date, in square brackets to make it easier to pick out in a regex. For example, in this case the event id is 9724: Information - 03/24/2015 08:38:32 - [9724] - MSSQLSERVER - The activated proc.... Secondly, a new configuration item 'clientclass' has been added to xymonclient_config.xml to allow setting the class reported back to the server. By default, this is 'powershell'. Zak

1 0

WinPSClient configuration question.
by me＠tdiehl.org 23 Mar '15

23 Mar '15

Hi, I am getting ready to migrate from BBWin to the WinPSClient. In my testing I cannot find a way to set the class. With bbwin, there is a setting called "configclass" value="win32". I have various entries in analysis.d with entries like the following: CLASS=e2013 LOAD 80 90 # Load threholds are in % MEMPHYS 99 101 MEMSWAP 90 97 MEMACT 97 99 PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen SVC MSExchangeADTopology startup=automatic status=started SVC MSExchangeAntispamUpdate startup=automatic status=started SVC MSExchangeDelivery startup=automatic status=started SVC MSExchangeDiagnostics startup=automatic status=started SVC MSExchangeEdgeSync startup=automatic status=started ... This allows me to set the configclass variable to e2013 and xymon will use that to process the data from that client. This allows me to greatly simplify the xymon configuration. Is it possible to replicate this behavior with WinPSClient? Regards, -- Tom me at tdiehl.org Spamtrap address me123 at tdiehl.org

2 1

Troubleshooting XymonPS
by rectifier＠gmail.com 23 Mar '15

23 Mar '15

Set clientsoftware entry in xml config file to bbwin and it's working now. Thanks to all S On Thu, Mar 19, 2015 at 4:32 PM, Steve B <rectifier at gmail.com> wrote: > Thanks Brandon, > > unfortunately no change with switching off the evt logs. > > I have found an error though in clientdata.log: > > clientdata.log:2015-03-19 16:16:51 No client backend for OS 'powershell' > sent by (ip address of host) > > so will look into it from this angle. > > cheers! > > > > > On Thu, Mar 19, 2015 at 12:57 AM, Brandon Dale <BDale at kitchengroup.com.au> > wrote: > >> Something else to try is turn off eventlog collection in the powershell >> client and/or increase the MAXMSG sizes in the hobbit equivalent of the >> xymonserver.cfg and see if that makes a difference. >> >> >> >> Regards, >> >> >> >> >> >> *Brandon * >> >> >> >> *From:* Xymon [mailto:xymon-bounces at xymon.com] *On Behalf Of *Steve B >> *Sent:* Thursday, 19 March 2015 6:19 AM >> *To:* Xymon at xymon.com >> *Subject:* Re: [Xymon] Troubleshooting XymonPS [senderbase] >> >> >> >> Hi John, >> >> no - nothing. I had actually tested this out by removing the host from >> bb-hosts and then it did appear in the ghost client list. >> >> rgds >> >> S >> >> >> >> On Wed, Mar 18, 2015 at 7:57 PM, <john.r.rothlisberger at accenture.com> >> wrote: >> >> Dumb question #1 – is there anything showing up in the ghost client list? >> >> >> >> Thanks, >> >> John >> >> Upcoming PTO: >> >> >> >> _____________________________________________________________________ >> >> John Rothlisberger >> >> IT Strategy, Infrastructure & Security - Technology Growth Platform >> >> TGP for Business Process Outsourcing >> >> Accenture >> >> 312.693.3136 office >> >> >> > >

3 3

Xymon PowerShell Windows client
by cleaver＠terabithia.org 22 Mar '15

22 Mar '15

Hi all, For some reason, my spam filter seems to have been penalizing xymon emails (perhaps a few too many commits coming through ;) ), and I missed this entire thread. I've just pushed an update into 4.3.19 that should take care of adding this into the RRD parsers: https://sourceforge.net/p/xymon/code/7609/. It seems to work on reports from my Win8x64 machine, but additional testing and validation would be greatly appreciated. In somewhat related news: I'm still looking at a few bug reports that I believe I missed (thank goodness for list archives!), but I'm currently hoping to put together a 4.3.19-RC1 within the next few days. And if all goes well, a full release perhaps by the end of this coming week. Regards, -jc

1 0

rrd logs and graphs
by everett.vernon＠gmail.com 22 Mar '15

22 Mar '15

Hi all Am busy trying to investigate a curious problem with rrd graphs, and I stumbled on something else I don't understand, and was hoping somebody out there could help. As part of my investigation, I added --debug to the [rrdstatus] and [rrddata] entries on the server tasks.cfg And the logs started showing heaps of the message 2014-11-14 10:41:36 Peer not up, flushing message queue What is that? It doesn't look right to me. I might as well explain why I am doing this. I am running an experimental script, zresources.ksh Its supposed to allow me to graph the resources being used by individual zones on Solaris. Here's part of the code $XYMON $XYMSRV "status $MACHINE.zmem green $(date) $OUT " $XYMON $XYMSRV "data $MACHINE.zmem $COLOR $(echo; cat "$TEMPFILE.mem" ;echo;echo)" $XYMON $XYMSRV "data $MACHINE.zcpu $COLOR $(echo; cat "$TEMPFILE.cpu" ;echo;echo)" $XYMON $XYMSRV "data $MACHINE.zswap $COLOR $(echo; cat "$TEMPFILE.swap" ;echo;echo)" echo $XYMON $XYMSRV "status $MACHINE.zmem green $(date) $OUT " echo $XYMON $XYMSRV "data $MACHINE.zmem $COLOR $(echo; cat "$TEMPFILE.mem" ;echo;echo)" echo $XYMON $XYMSRV "data $MACHINE.zcpu $COLOR $(echo; cat "$TEMPFILE.cpu" ;echo;echo)" echo $XYMON $XYMSRV "data $MACHINE.zswap $COLOR $(echo; cat "$TEMPFILE.swap" ;echo;echo)" cat $TEMPFILE.swap cat $TEMPFILE.cpu cat $TEMPFILE.mem The first 4 lines are "real" and the rest I added for debug. It's supposed to send data containing the zone names, and the amount of resources it's using. global : 293 zone1 : 575 zone2 : 899 zone3 : 754 All good, it makes nice pretty graphs and what have you. And I expect and get rrd files as follows zmem,global.rrd zcpu,global.rrd zswap,global.rrd zmem,zone1.rrd zcpu,zone.rrd zswap,zone1.rrd etc.etc. Except every now and then, I get something like zmem,c2t0d1.rrd I get others too, like zmem,rmt_0 and sometimes even with database SIDs too. And not just for zmem, for zcpu and zswap with about equal frequency. And often, the database SID is not even a database running on that host! I look inside the rrd file, with rrdtool dump, and there will usualy be only a single data point. Looking in the client logs, which contains the output of the debug code above, there is no indication that the client ever sent any data using anything else but the zone names. So where are these spurious data points coming from? Has anybody seen anything like this? Regards Vernon -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

5 36