- Xymon - Xymon mailman web

Error when starting recently installed client
by chris＠chrisshort.net 15 May '14

15 May '14

I have xymon-client running on a handful of RHEL6 servers. But, other RHEL6 servers where I am rolling out the client throw up this unusual error: # service xymon-client restart Restarting xymon-client: su: warning: cannot change directory to /usr/share/xymon-client: No such file or directory This account is currently not available. Any ideas why /usr/share/xymon-client isn't being built? Thanks, Chris Short http://chrisshort.net Public PGP Key: http://cshort.co/pub_key

2 8

ANALYSIS.CFG evaluation order question
by robert.herron＠gmail.com 14 May '14

14 May '14

Please disregard this question. I found the answer in the man pages for hobbit-client.cfg and analysis.cfg. And the answer is yes, the file is still evaluated from top to bottom. Robert Herron robert.herron at gmail.com On Wed, May 14, 2014 at 11:43 AM, Robert Herron <robert.herron at gmail.com>wrote: > Currently running Xymon 4.2.3 and on the verge of upgrading to 4.3.17. > Given the various filename changes involved with 4.3.x move, I'm reviewing > and cleaning my config files. > > The last block of documentation in my current hobbit-clients.cfg says: > > "Rules are evaluated from the top of this file and down, and the first > matching rule is used. So you should put the specific rules first, and the > generic rules last." > > Is this still true? > > The ~/xymon-4.2.3/hobbitd/etcfiles/hobbit-clients.cfg and > ~/xymon-4.3.17/xymond/etcfiles/analysis.cfg do not have this block or > anything on order of evaluation. > > Basically, I want to verify db1 goes RED for a load of 35, db[3-5] at 22, > and everything else at 10 using this configuration: > HOST=%db1 > LOAD 33.0 35.0 > HOST=%db(1|3|4|5) > LOAD 17.0 22.0 > PROC tnslsnr > PROC ntpd > PROC postfix > DEFAULT > # These are the built-in defaults. > UP 1h > LOAD 5.0 10.0 > > Thanks. > > > Robert Herron > robert.herron at gmail.com >

1 0

Getting erratic NaN RRD file entries from Unix-Linux hosts only.
by Mark.Deiss＠xerox.com 14 May '14

14 May '14

Running Xymon server version 4.3.11 on Fedora Core 20 with rrdtool 1.4.8-8. A mess of HPUX/Linux clients running Xymon and Windows clients running MrBig. Noticing that the rrd databases on only the Unix/Linux clients (including the Linux Xymon server itself) have holes in the disk, memory, process, CPU utilization, TCP/IP and network traffic graphs. The RRD databases have NaN values of varying time periods in the files - do not see consistent time holes. In some of the filesystem plots the holes do not overlap but are scattered around time-wise. Some of the plots/RRD files look okay such as CPU load and TCP/IP connection times. Not seeing anything in the xymon server logs indicating rrd issues. I am drilling with google and so far the xymon threads on this seem to cover xymon_rrd type bugs that predate 4.3.11. I am also mystified why not seeing the NaN data splotches scattered around in the Windows RRD files. Would not expect this is network issue as the data splotches are showing up on the Xymon server's RRD files themselves - should be a short return hop sending any data out the Xymon server NIC back to itself. If there was congestion issues then would expect the NaN entries to occur across all received client transmissions to include the Windows clients. Some of the threads mention using the no-cache tag with the rrddata and rrdstatus channels - have not done that yet. Threads were indicating this was a fix for plots not ~including the filesystem/disk plots. Will be trying this next - but does not explain why the Windows filesystem rrd's are populating properly. Any thoughts other then the usual: upgrade, RTFM (umm, which M...), shoot up with massive amounts of heroin, discharge shotgun at head, switch everything over to Windows hosting. For any upgrade, what is the recommended next stable release? Seems I am always upgrading into a different set of issues...

1 0

ANALYSIS.CFG evaluation order question
by robert.herron＠gmail.com 14 May '14

14 May '14

Currently running Xymon 4.2.3 and on the verge of upgrading to 4.3.17. Given the various filename changes involved with 4.3.x move, I'm reviewing and cleaning my config files. The last block of documentation in my current hobbit-clients.cfg says: "Rules are evaluated from the top of this file and down, and the first matching rule is used. So you should put the specific rules first, and the generic rules last." Is this still true? The ~/xymon-4.2.3/hobbitd/etcfiles/hobbit-clients.cfg and ~/xymon-4.3.17/xymond/etcfiles/analysis.cfg do not have this block or anything on order of evaluation. Basically, I want to verify db1 goes RED for a load of 35, db[3-5] at 22, and everything else at 10 using this configuration: HOST=%db1 LOAD 33.0 35.0 HOST=%db(1|3|4|5) LOAD 17.0 22.0 PROC tnslsnr PROC ntpd PROC postfix DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 Thanks. Robert Herron robert.herron at gmail.com

1 0

[PATCH] Fix summary messages when using https
by david＠basis.is 14 May '14

14 May '14

Hi all, Please see the attached patch. When sending summary status to an upstream xymon daemon, the given URL sent to the upstream xymon is parsed to find the page. The parsing assumes xymon is served over http, and if another URI scheme is given, the parsing will fail, xymon will find the NULL page and always return red. It would be better to implement a real generic URI scheme parser, since the protocol used is really just an implementation detail, and should not matter to xymon. But this simple patch works for me, by adding another special case for https. -- Bestu kveðjur / Best regards Davíð Steinn Geirsson Basis ehf | Síðumúli 32 | (+354) 575-0400

1 0

regular expression in alerts/analysis
by Russell.Blumenthal＠stonybrookmedicine.edu 14 May '14

14 May '14

I have 2 pages within my setup, AIX and AIX_VIO. I am trying to create a single entry in alerts and analysis to cover both of these pages. I started with, PAGE=%AIX, and then started playing around with ^, * and a bunch of stuff I looked up. I can only get the alert entry to show in the AIX page, not the AIX_VIO page. I'll admit I'm not great at these expressions so any help would be great Thanks This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by e-mail and destroy all copies of the original.

1 0

Possible BUG in how Xymon interprets data for monitoring "FILE" and "MSGS"
by waa-hobbitml＠revpol.com 14 May '14

14 May '14

Hi everyone! We have a random issue with a Samba server where it core dumps each new smbd process as users log in. Generally the server functions 24/7/365, but once something (we don't know what yet) triggers this, each new smbd process spawned core dumps and no new logins are possible. Simple way to monitor with Xymon is by looking for the non-existance (NOEXIST) of one of these core files: /var/log/samba/cores/smbd/core The Xymon issue I am reporting here is that by default, the directories above this file were created with 600 root:root permissions, and as such, Xymon can not see/access this file even when it exists and will report GREEN for the 'files' test. Interesting thing is that if I remove the NOEXIST parameter from the analysis.cfg line for this file - meaning that this file needs to exist - and the file does exist, Xymon also reports it GREEN. Clicking on the files test and then the /var/log/samba/cores/smbd/core link on the test's page brings you to a white web page with the following: [file:/var/log/samba/cores/smbd/core] ERROR: Permission denied At the bare minimum, I would think that Xymon would report this test as yellow, not green because "something is wrong" that an admin monitoring, or configuring Xymon needs to address. For now, I have modified the permissions in the directory tree to allow for Xymon to access the dir that this file gets created in, but if for some reason, perhaps on syslog-ng startup or some other reason these permissions are reverted, Xymon will always think this test is GREEN, and no one will ever be notified when the file does appear. Of course, I can add additional tests for this host to monitor each directory's ownership and permissions down to the file, but that becomes more cumbersome and opens things up to more places where an admin can make mistakes. I have noticed a similar thing with regards to monitoring MSGS. By default (on Gentoo systems with syslog-ng, at least) /var/log/messages is created root:root 640, and as such, the Xymon user can not read this file to parse it. The MSGS test however shows GREEN. But on its page shows: --[snip]-- No entries in /var/log/messages Full log /var/log/messages Cannot open logfile /var/log/messages : Permission denied --[snip]-- I generally fix this by greating a group 'log', adding the xymon user to it and configuring syslog-ng to create the /var/log/messages file with root:log 640 perms.. But again, if my monitoring server is (default) set to monitor a log file and is told "permission denied" I would consider that to be at least a yellow status that an admin needs to investigate and address. Thanks for listening -- Bill Arlofski Reverse Polarity, LLC http://www.revpol.com/ -- Not responsible for anything below this line --

1 1

ext script does not show up at webpage
by s.watkins＠nhm.ac.uk 14 May '14

14 May '14

> Message: 1 > Date: Tue, 13 May 2014 13:25:53 +0200 > From: Simon H?jberg Jespersen <Simon.Jespersen at stab.rm.dk> > Subject: [Xymon] ext script does not show up at webpage > I have a script placed at > /home/bb/client/ext/monitorfs_xymon.sh on the client > > It is doing some disk check and end up with this command $xymon $XYMSRV "status $MACHINE.$COLUMN $COLOR `date` ${MSG}" > /home/bb/bin/xymon "10.83.82.9 status aarapp144.available storage green Tuesday, 13 May 2014 13:10:20 CEST Looking good" Hello Simon, If you look at the line you are expecting to get from the script and the line you are actually getting from the script you will see that they are different in format. The line you have given as output from the script includes the $XYMSRV within the double-quoted content section that is meant to be passed on the the xymon binary rather than passed as the first, separate option stating the recipient host. As such, the xymon binary is being called and given its first parameter as a complex string containing pjrases such as 'status' and 'thursday', rather than being given the IP details of the system that it is meant to be forwarding the message onto. This shows up in the output you get on commandline (as follows): > When I try to run it from commandline the output is > > Xymon version 4.3.17 > Usage: /home/bb/bin/xymon [--debug] [--merge] [-- > proxy=http://ip.of.the.proxy:port/] RECIPIENT DATA > RECIPIENT: IP-address, hostname or URL > DATA: Message to send, or "-" to read from stdin The xymon binary is running and then saying "I don't know what it is you have just sent to me but it isn't a host's IP details!" Looking at the script you supplied I can see the following line: echo "$XYMON $XYMSRV status $MACHINE.$COLUMN $COLOR `date` ${MSG}" >> /tmp/du_i_run.log $XYMON $XYMSRV "status $MACHINE.$COLUMN $COLOR `date` ${MSG}" Is it meant to be a run-on line like this with the call to $XYMON after the /tmp/du_i_run.log? If so I doubt that the script would get beyond the echo call to du_i_run.log . The rest of the line would not be interpreted as a command/action but as spare operands on the line. So, you would need to actually split that line into two lines, between du_i_run.log and $XYMON, to make that one line back into two separate lines. The echo command will still run but now you will have an executable commandline, starting $XYMON, would would successfully forward your output to $XYMSRV. Give those a try. Regards, Steff Watkins ----- Steff Watkins Natural History Museum, Cromwell Road, London,SW75BD Systems programmer Email: s.watkins at nhm.ac.uk Systems Team Phone: +44 (0)20 7942 6000 opt 2 ======== "Many were increasingly of the opinion that they'd all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans." - HHGTTG

1 0

ext script does not show up at webpage
by Simon.Jespersen＠stab.rm.dk 14 May '14

14 May '14

Hi xymon list This is my first post, and it is about a custom script on a sun solaris client. I have a script placed at /home/bb/client/ext/monitorfs_xymon.sh on the client It is doing some disk check and end up with this command $xymon $XYMSRV "status $MACHINE.$COLUMN $COLOR `date` ${MSG}" When I echo this command line to a file for debug The full commandline looks lige this /home/bb/bin/xymon "10.83.82.9 status aarapp144.available storage green Tuesday, 13 May 2014 13:10:20 CEST Looking good" When I try to run it from commandline the output is Xymon version 4.3.17 Usage: /home/bb/bin/xymon [--debug] [--merge] [--proxy=http://ip.of.the.proxy:port/] RECIPIENT DATA RECIPIENT: IP-address, hostname or URL DATA: Message to send, or "-" to read from stdin Can anybody help me to figure what is wrong , I think i followed to description in tips & tricks. Another question, can I use the cfg script to source my own variable to use in scripts ? Regards Simon PS.. /* the whole script */ #!/usr/bin/bash FILESYSTEMS=/,/export,/local IFS="," MACHINE=`hostname` COLUMN="available storage" COLOR=green MSG="Looking good" TRESHOLDUSEDGB=50 TRESHOLDMAXPROCENTUSED=100 TRESHOLDAVAILGB=10 function teratogb { tb=$1 echo $((GB*1024)) } function kbtogb { kb=$1 #echo $1 echo $((kb/1024*1024)) } function measurement { in=$1 len=${#in} tp=${in:len -1:1} if [ "$tp" == "K" ] then in=${in:0:len -1} kbtogb $in fi if [ "$tp" == "T" ] then echo "$1 :call teratogb with" echo ${in:0:len -1} fi if [ "$tp" == "G" ] || [ "$tp" == "%" ] then value=${in:0:len -1} x=0 returnvalue="" while [ $x -lt $len ] do ch=${value:$x:1} if [ "$ch" == "." ] then break else returnvalue=$returnvalue$ch fi x=$((x + 1)) done echo $returnvalue fi } for i in ${FILESYSTEMS};do lfil=`df -h $i | tail -1` >> /dev/null usedgb=`echo $lfil | awk ' { print $3 } '` >> /dev/null usedgb=`measurement $usedgb` >> /dev/null if [ $usedgb -ge $TRESHOLDUSEDGB ] then COLOR="red" MSG="Treshold used space on $i exceeded the limit set on $TRESHOLDUSEDGB gb " fi availgb=`echo $lfil | awk ' { print $4 } '` >> /dev/null availgb=`measurement $availgb` if [ $availgb -le $TRESHOLDAVAILGB ] then COLOR=red MSG="Treshold available diskspace on $i exceeded the limit set on at least $TRESHOLDAVAILGB gb " fi procentused=`echo $lfil | awk ' { print $5 } '` >> /dev/null procent=`measurement $procentused` >> /dev/null if [ $procent -ge $TRESHOLDMAXPROCENTUSED ] then COLOR=red MSG="treSHOLD ON MAXIMUM USED DISKSPACE IN PROCENT ON $I EXCEEDED THE LIMIT SET TO $trESHOLDMAXPROCENTUSED" fi done echo "$XYMON $XYMSRV status $MACHINE.$COLUMN $COLOR `date` ${MSG}" >> /tmp/du_i_run.log $XYMON $XYMSRV "status $MACHINE.$COLUMN $COLOR `date` ${MSG}" exit 0

2 2

xymond crashing ~23 hours or so in do_message
by sean.clark＠twcable.com 13 May '14

13 May '14

I am running the latest RH5 32-bit version of JC Cleaver’s excellent packages – however, it is crashing with a sig abrt every day or so, and core dumping. I put on version of xymond that had debugging symbols to make it easier to read, and analyzed the core files It looks to crash on compiling “trends-test” for a host, when a remote host sends “xymondboard” The sigabort comes from —> response = newstrbuffer(lastboardsize); in the code One example: #6 0x08055f4f in do_message (msg=0x7a7cabc0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x22988 <Address 0x22988 out of bounds>, clientsave = 123} infotest = {name = 0xbff5b336 "info", clientsave = 0} logfields = 0x2dbb1e80 havehostfilter = 0 fields = 0x6a5568f “hostname,testname" Another: #6 0x08055f4f in do_message (msg=0x8bddbad0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x208b8 <Address 0x208b8 out of bounds>, clientsave = 123} infotest = {name = 0xbfefb336 "info", clientsave = 0} logfields = 0x13fb0008 havehostfilter = 0 fields = 0x5889672 “hostname,testname,color,acktime,disabletime,cookie,ackmsg,dismsg,lastchange,line1" And a third: #6 0x08055f4f in do_message (msg=0x8001c4c0, origin=0x8073d54 "", can_respond=1) at xymond.c:4006 hosthandle = <value optimized out> lwalk = <value optimized out> firstlog = <value optimized out> trendstest = {name = 0x20d40 <Address 0x20d40 out of bounds>, clientsave = 123} infotest = {name = 0xbfd4d336 "info", clientsave = 0} logfields = 0x7debb8f8 havehostfilter = 0 fields = 0x8630217 "hostname,testname" I guess what I am asking is, what are my next steps? Henrik, or JC (or anyone who knows C well) have any ideas? I’ve attached the full core file analysis log files to this message, if that helps, but I don’t know exactly how to proceed. If the origin was just one host, I would think it’s some bad thing happening from the one host, but these three crashes all came from communications from three different hosts, with different field requests to xymondboard Let me know -Sean ________________________________ This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

2 2