- Xymon - Xymon mailman web

Service smtp on hostname is not OK : Unexpected service response
by tawilcox＠fs.fed.us 25 Mar '14

25 Mar '14

We are getting yellow alerts for all SMTP tests in Xymon. The error given is "Service smtp on hostname is not OK : Unexpected service response". This is a new installation and all of the SMTP servers have been yellow since Xymon was started. Telnet into the server gives the response: "220 sv62.r1.fs.fed.us ESMTP Service ready at Mon, 24 Mar 2014 12:23:42 -0600". The hosts file is from Big Brother. All SMTP tests are SMTP.S. We tried commenting out any line in the [SMTP] section that starts with "Send", but that didn't change anything. There is nothing recent in the archives about this. Any suggestions? Ted This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.

2 1

Xymon Digest, Vol 38, Issue 21
by s.watkins＠nhm.ac.uk 25 Mar '14

25 Mar '14

> Message: 1 > Date: Mon, 24 Mar 2014 18:43:26 +0000 > From: "Wilcox, Theodore A -FS" <tawilcox at fs.fed.us> > To: "Xymon at xymon.com" <Xymon at xymon.com> > Subject: [Xymon] Service smtp on hostname is not OK : Unexpected > service response > Message-ID: > <77942EE84FB4A845897BD3D18ED44CEA0105AA61 at 001FSN2MPN1- > 028.001f.mgd2.msft.net> > > Content-Type: text/plain; charset="us-ascii" > > We are getting yellow alerts for all SMTP tests in Xymon. The error given is > "Service smtp on hostname is not OK : Unexpected service response". This is > a new installation and all of the SMTP servers have been yellow since Xymon > was started. Telnet into the server gives the response: "220 > sv62.r1.fs.fed.us ESMTP Service ready at Mon, 24 Mar 2014 12:23:42 -0600". > The hosts file is from Big Brother. All SMTP tests are SMTP.S. We tried > commenting out any line in the [SMTP] section that starts with "Send", but > that didn't change anything. There is nothing recent in the archives about > this. Any suggestions? > > Ted Hello Ted, I suspect this is caused by the 'reply' that the Xymon server is getting when it "handshakes" the SMTP server on the tested system. To explain: I had a similar problem with solid yellow results for the sshd tests on some of my servers, not all even though the ssh daemons were available and reliable on the servers that were yellowing out. I took a look through documentation and newsgroups and found that it was most likely caused by the header line that was being returned by the ssh daemon when the xymon test was run against it. The expected response was set in the protocols.cfg file, in the following section: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22 That line, expect "SSH", instructs the xymon server to "expect" the response to be (to start with?) the phrase "SSH". As I had a mix of different ssh server daemons, most Openssh, some Sun-specific, some linux-specific, this meant that the initial header response from the various ssh servers were different. Some returned the required "SSH" tag in their headers and others didn't. So, xymon seemed to be reporting that it could connect to the ssh daemon, but that it was not getting the expected response hence a "yellow" light. I commented out the 'expect "SSH"' line and ever since I have not seen the erroneous yellow light. Now, onto your issue in particular, if you look in the [$XYMONDIR]/server/etc/protocols.cfg file you will (most likely) find the default setup which is shown below: ----- [smtp] send "mail\r\nquit\r\n" expect "220" options banner port 25 ----- Unless you have a definite reason for checking the text that is returned in the header when connecting to your SMTP server[1] I would suggest that you comment out the 'expect "220"' line. Xymon would still just be checking that it could connect to your SMTP server just it would not be "expect"ing your SMTP server to return a specific header. I can't remember if I needed to restart the xymon server to pickup the changes to protocols.cfg so please be aware that you "may" have to restart the xymon server. Hope that helps. [1] this could be useful for checking which servers are in need of upgrading, are running unwanted versions of servers or have changed for some reason Regards, Steff Watkins ----- Steff Watkins Natural History Museum, Cromwell Road, London,SW75BD Systems programmer Email: s.watkins at nhm.ac.uk Systems Team Phone: +44 (0)20 7942 6000 opt 2 ======== "Many were increasingly of the opinion that they'd all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans." - HHGTTG

1 0

What did the acronym NK stand for?
by abs＠shadymint.com 21 Mar '14

21 Mar '14

I know it's not used anymore, but it lives on in the minds of many but just what was it short for? Thanks -- Andy

2 2

Log file monitoring
by neilsimmonds1808＠gmail.com 20 Mar '14

20 Mar '14

Hi all, As far as I can see there is no built in way in Xymon to monitor a log for the number of times a string has occurred in a specified time period. Is this something that other people would find useful? (even if it was only a count of occurrences within the last 30 minutes and not a configurable time). Is there any chance something like this may be in a future release Henrik? Regards, Neil Simmonds Senior Operations Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: <mailto:neil.simmonds at Express-Gifts.co.uk> neil.simmonds at Express-Gifts.co.uk

5 5

test for absence of http service
by JAlexander＠feeneywireless.com 20 Mar '14

20 Mar '14

I would like to test for the absence of the http service on a system and alert if it responds to http. This is easy with most of the other network tests using a negation (!). Ideas? John Alexander Network Administrator John.Alexander at feeneywireless.com<mailto:John.Alexander at feeneywireless.com> Feeney Wireless, LLC - PO Box 2549, Eugene, Oregon 97402 (Free) 800-683-4818 (P) 541-685-9045 (F) 541-284-0030 www.feeneywireless.com<http://www.feeneywireless.com/> [FW_Acronym_email]<http://feeneywireless.com/> This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.

3 2

Generate eventlog
by mark.rosedale＠gmail.com 19 Mar '14

19 Mar '14

Hello, I'm trying to generate some statistics on eventlogs from xymon. I'd love to be able to generate logs based upon date date range, Tests to Match, and maybe filter by color. Basically I'd like to generate events similar to eventlog.sh, but without the html if at all possible. Is there a way to do this directly querying xymon? Thanks, mjr

1 0

Setting up a new non-green page for a specific list of systems
by rectifier＠gmail.com 18 Mar '14

18 Mar '14

I would like to have a non-green page that only shows network devices (at the moment I just have the one setup with all machines) and saw the following in a previous exchange of emails: Alternatively, you can set up a new non-green page for just that specific list of systems. Look here for more information.http://www.hswn.dk/hobbiton/2008/05/msg00121.html Was wondering if the old hobbiton archives were out there somewhere so I could read that linked post (from 2008) as it seemed to have helped a couple of users or alternatively some pointers as to how to set up a second or third non-green page to show machines I select. thanks Steve

5 6

How to make log errors repeat for an hour
by sys1002＠yahoo.com 18 Mar '14

18 Mar '14

I am trying to capture BMC alerts, and it works, but there is only one alert email, and on a busy day it could be missed. I saw a reference to making an alert last longer, similar to what is done for Windows Event logs ( they last an hour ). How do I do this for normal log monitoring as well as any custom checks. Thanks ! Michael Resnick Sr. Systems Eng.

1 0

What happens to errors in analysis.cfg?
by David.Mills＠ngc.com 18 Mar '14

18 Mar '14

All -- Hi! Are syntax errors in analysis.cfg logged someplace or are they silently ignored? Thx! david ~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~ David Mills Systems Administrator Northrop Grumman (512) 873-6665

2 1

UDP open ports monitoring
by xymon＠elysiria.fr 17 Mar '14

17 Mar '14

Hi. I would like to monitor UDP ports as TCP ports, with the client module, and a display in the "ports" column. I don't understand why this module is limited to TCP connections, and I would like to extend it to active UDP connections. Why does the client module run a "netstat -ant" command (file "xymonclient-linux.sh")? Is there a reason not to add UDP connections as well? What would be the best solution? Clone the section and run a "netstat -anu"? Patch the existing client and run "netstat -antu"? Another solution? Thanks. -- Christian

5 5