- Xymon - Xymon mailman web

When Xymon is offline
by lists＠benjamindsmith.com 11 Jun '14

11 Jun '14

We have a xymon server hosted on a local (dev office) server so that we can monitor our servers "from outside" - as customers would see things. Generally, it works great. However, the office connection, being a business class cable Internet, does experience some downtime, and when it comes back online, my phone is deluged with messages about the sky falling and all our services being down. Is there a way for xymon to detect that it's off line and not send hundreds of alerts? Ideal would be to have 3 or more xymon server instances in a distributed wan cluster, and only generate alerts when a quorum of >50% has been achieved. Is this possible? Thanks, Ben

2 1

alert IGNORE question
by KVerMeer＠peoplenetonline.com 11 Jun '14

11 Jun '14

I have one client that has a maintentance window every night. I have two questions related to the IGNORE alert option. 1. Is the time specified in the IGNORE the server time or the client time? 2. The time I would like to ignore wraps around midnight. Do I need two separate IGNORE statements for that? Below are the pertinent lines in alert.cfg, and an error being generated to /var/log/xymon/alert.log HOST=* SERVICE=linkthreads COLOR=red ## ignore linkthreads on 10144 for this duration IGNORE HOST=CCHWOOPNL TIME=2345:0245 SCRIPT /usr/local/xymonutil/alertscripts/daemondown.sh internal REPEAT=15 RECOVERED 2014-06-11 07:41:38 Bad timespec (missing colon or no endtime): 2345:0245 Thanks, Kevin VerMeer [cid:image001.jpg at 01CF8537.E6D7C6B0] 4400 Baker Road, Minnetonka, MN 55343 TOLL FREE 888-346-3486 x 520 | FAX 952-908-6131 www.peoplenetonline.com<http://www.peoplenetonline.com/> PeopleNet is the leading provider of fleet mobility systems to the transportation industry, including truckload, LTL, private, and energy service fleets.

2 4

alerts.cfg regex ignoring $ (dollar)
by spah＠syntec.co.uk 06 Jun '14

06 Jun '14

Hi all, Can anyone confirm if this issue, alerts.cfg regex ignoring $ (dollar), from 2006 is fixed in the latest 4.3 code? I can confirm that it is not fixed in 4.3.7, but the best work-around is to add an exclude. (Although that does not help if you wanted to put the $ in your exclude. FYI, ^ works fine in regex.) Example: HOST=%MyHost$ SERVICE=conn Testing as xymon user with: ~/server/bin/xymoncmd xymond_alert --test MyHost conn --color=red --duration=700 | egrep "(Match with|Mail alert)" with MyHost1, MyHost2, etc. firing. Old references: Ref: http://lists.xymon.com/archive/2006-November/010871.html Ref: http://lists.xymon.com/archive/2010-January/027218.html Kind regards, SebA

1 0

Xymon alerting on acknowledged events
by feld＠feld.me 06 Jun '14

06 Jun '14

Hi all, Our xymon server seems to disobey acknowledged events and still alert anyway. If we mark it blue to disable the service it will stop alerting us. We've seen this behavior before a long time ago and the fix was possibly a missing directory or something to that effect but we cannot seem to find it on Google nor locate it in our notes / ticketing system. Too much noise in there from the word "xymon". Any hints? Thanks

3 4

PfSense firewall client
by kspringer＠innovateteam.com 06 Jun '14

06 Jun '14

Thanks for the tip. I got it working pretty quickly with that. :) Now I just need to figure out how to get it to run at startup without me logging into the console and manually starting it. Anyone know how to do that on a PfSense OS? Thank you. ------------------------------------------------ Kris Springer From: Dernier Rondón [mailto:darc7983 at gmail.com] Sent: Thursday, February 20, 2014 11:45 AM To: Kris Springer Cc: Xymon MailingList Subject: Re: [Xymon] PfSense firewall client I hope this helps, pfsense forum mentioned step by step how to install the client XyMon for pfsense (thanks gwhynott). You need only modify files that are in "/usr/local/www/xymon/client/etc" then start the service ./runclient.sh start Regards! 2014-02-20 14:44 GMT-04:30 Kris Springer <kspringer at innovateteam.com <mailto:kspringer at innovateteam.com> >: Ive got some PfSense firewalls that I would love to have running with xymon client. Anyone have a step-by-step guide to get this working? PfSense is BSD. Thank you. ------------------------------------------------ Kris Springer _______________________________________________ Xymon mailing list Xymon at xymon.com <mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon -- -- Dernier Rondón Linux Counter reg# 473239 Machine's counter reg# 381205

2 1

Why Xymon?
by david.gore＠verizon.com 06 Jun '14

06 Jun '14

Hi All, We are being asked "Why Xymon?". We have some answers but I was hoping someone else may have been more eloquent and articulate than myself in defending the use of Xymon. Perhaps you could share your wisdom? We started using Xymon when we lost our first level 24x7 monitoring group and have not looked back since. Now we are being asked to use an in-house application and offshore assets. Some of the Xymon features we like are: *big picture of all our apps via the nonongreen page, application, OS, network and databases monitored *graphing and historical trending *ease of use *light weight/low resource *multiple scripting languages support (any) *redundant (warm standby) *cost (free) thanks Henrik and everyone else *support via the mailing list, We have been using Xymon from the beginning back in 2005. Before using Xymon/Hobbit we used Big Brother. Thanks in advance for any advice. ~David W Gore

8 8

Fwd: WAN performance/monitoring
by jlaidman＠rebel-it.com.au 06 Jun '14

06 Jun '14

Whoops, forgot to CC this to the list. I hate it when that happens. So in case it helps someone else, my off-list email is below. And just for the record, I still reckon Smokeping is the go. I see no reason why it wouldn't detect a lot of transient errors, more likely if you adjust the parameters for step and ping count. There's no way of guaranteeing that you would see a transient error, unless you happen to be sending every packet received by the device you're testing! Instead you should be monitoring the error rates on the switch port and the device NIC, probably using SNMP. ==== Adam On Thursday, 5 June 2014, Adam Goryachev < mailinglists at websitemanagers.com.au> wrote: > > Specifically, I now want to record at least the following data into RRD's > for later viewing: > 1) Maximum ping time per minute > 2) Average ping time per minute > 3) Minimum ping time per minute > 4) Packet loss per minute Seems to me that this is exactly what Smokeping can provide for you. Have a look at the demo site, drill down to a single device, and have a look at the graphs. eg: http://oss.oetiker.ch/smokeping-demo/?target=Customers.OP.octopus One thing that does happen is obviously drift, ie, the processing time of > my script will take a fraction of a second, so I won't really get a value > for every single second One way to overcome this is to run the probe in background, so that it doesn't really matter how long it takes (as long as you're not accumulating processes over time). Like this: #!/bin/sh doping() { ... } while true; do SECONDS=`date +%s` # in case not bash sleep `expr 60 - $SECONDS % 60` doping >> /var/log/pingmon.log & done This runs the subroutine do_ping in the background, but first waits how ever long it needs until the clock ticks over for the next minute. You would always have the subroutine run at the start of the minute. Cheers Jeremy

1 0

WAN performance/monitoring
by mailinglists＠websitemanagers.com.au 05 Jun '14

05 Jun '14

Hi All, First some background, then sharing some scripts I've written/used, and finally asking for some advice please. Some time ago I was having a LAN issue (dropped packets) which I wrote a small script to measure, and quantify the problem. (If you can't see the problem, you can't fix it, and you can't prove it is fixed afterwards). All the script did was use fping to ping a group of IP's once per second, then every minute it would record a log of the date/time plus one line for each IP that had one or more dropped packets. This worked nicely for the above purpose, allowing me to easily pinpoint the common machines experiencing the problem, and then eventually solve it. Now I'd like to extend the script to cover my WAN connections, but I also need more information, and don't want to re-invent the wheel. So, I'm looking for suggestions on how to implement what I need, and/or other products that already do this. Specifically, I now want to record at least the following data into RRD's for later viewing: 1) Maximum ping time per minute 2) Average ping time per minute 3) Minimum ping time per minute 4) Packet loss per minute Now the first three could be done by using my script to calculate the value and then record those three values per minute, or I could record 60 values per minute and let RRD do the calculation. One thing that does happen is obviously drift, ie, the processing time of my script will take a fraction of a second, so I won't really get a value for every single second, but then that is probably overkill anyway, if I can get one value for 99% of seconds, then I should get a clear picture of my links, performance, and any issues. The second part of this question is what values for the above 4 things do you use for xymon as alarms? What is acceptable, what is marginal, and what is downright awful? In my case I'm using connections for RDP (Windows Remote Desktop). BTW, currently the script doesn't actually integrate with xymon, that is still doing it's own standard network ping monitoring, but obviously this is a lot more intense/detailed, and I'd like to integrate the result (to get alerting/history/etc). The current script I'm using which is started by /etc/rc.local at boot with "nohup /usr/local/bin/pingmon.sh >> /var/log/pingmon.log #!/bin/bash HOSTLIST="x.x.x.10 x.x.y.254 x.x.z.254" HOSTLIST=$HOSTLIST function doping { START=`date '+%Y%m%d-%H:%M:%S'` result=`fping -C 60 -q ${HOSTLIST} 2>&1` echo "${result}" | grep -q -- - 2>&1 > /dev/null res=$? if [ $res == 0 ] then echo -en "${START}\n${result}" | grep -- - else echo "${START}" fi } while /bin/true do doping >> /var/log/pingmon.log done I also wrote a report generator which was supposed to parse the log file and generate a summary/report in perl. I've attached that script here, but I can't claim that it is bug free, it also hard codes some business parameters (ie, business hours/days/etc), search for XXXX to find most things you will want to change. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au

3 3

DISK check: HOST must be before CLASS
by bakgat8＠hotmail.com 03 Jun '14

03 Jun '14

in analysis.cfg - it surprised me that this did not work: CLASS=linux DISK /cdrom IGNORE DISK * 100 102 PROC ntpd PROC sshd 1 PROC cron HOST=athyna,xymam00 DISK * 88 96 HOST=appel,banana PROC sendmail But putting the host athyna (which is linux) first does: HOST=athyna,xymam00 DISK * 88 96 CLASS=linux DISK /cdrom IGNORE DISK * 100 102 PROC ntpd PROC sshd 1 PROC cron HOST=appel,banana PROC sendmail I do many PROC tests per HOST after the CLASS definition - why is DISK difficult about sequence? I run my own disk test for most servers, that is why the CLASS basically turns the test off. Then I realized I was not testing athyna at all, and the default would actually be fine.

1 0

tasks.cfg - strange CRONDATE behaviour
by abs＠shadymint.com 03 Jun '14

03 Jun '14

Hi, Can anyone else confirm this. I have in tasks.cfg, something like so :- [xxx_refresh] ENVFILE /apps/xymon/server/etc/xymonserver.cfg CMD /apps/scripts/xxx_refresh.sh LOGFILE $XYMONSERVERLOGS/xxx_refresh.log CRONDATE 15 8-18 * * 1-5 What I deduce by adding echo statements to xxx_refresh.sh, is that if this shell script completes in less than 60 seconds, xymonlaunch runs it a second time :- grep Running xxx_refresh.log Running as pid 10044 at Mon Jun 2 08:15:03 BST 2014 Running as pid 29168 at Mon Jun 2 09:15:04 BST 2014 Running as pid 15931 at Mon Jun 2 10:15:03 BST 2014 Running as pid 17089 at Mon Jun 2 10:15:59 BST 2014 Running as pid 2805 at Mon Jun 2 11:15:02 BST 2014 Running as pid 4021 at Mon Jun 2 11:15:59 BST 2014 Running as pid 22545 at Mon Jun 2 12:15:00 BST 2014 Running as pid 23730 at Mon Jun 2 12:15:57 BST 2014 I have added a (redundant?) INTERVAL keyword, I have also played around with GROUP, but i cant stop it running twice. Presumably adding a sleep at the end of the script would be a workaround, I'll try that next. -- Andy

2 4