- Xymon - Xymon mailman web

smtp test - how/what does it actually do?
by didds3＠yahoo.co.uk 28 Oct '21

28 Oct '21

we ahve a client configured thus 10.108.249.162? colt # ssh ntp MAINTNC:linux smtp This smtp check has been green for ever - literally. It has suddenly alerted overnight and is remaining so Service smtp on colt is not OK : Service listening but unavailable (connect timeout) Seconds: 0.001814000 I can telnet from the xymon server on port 25 fine. postfix services on colt are working seemingly correctly? (eg i can send a mail successfully from a client that uses colt as a smtp server) So Im now trying to find out what it is that this smtp check atually does in order to find out why it now thinks it cant do it. The error suggests indeed its a timeout issue - but the telnet test connects immeditaely (no obvious lag anyway) thoughts/ ian

1 0

no reports because of full root disk - workaround
by zechner＠vrvis.at 22 Oct '21

22 Oct '21

Hi, a while ago, we encountered a rather annoying problem: if the root disk of our Linux servers got full between two xymon checks, we were not notified, because xymon was not able to report this, due to to remaining space. It did not matter whether the machine was in xymon local mode or not (we wanted to be sure). We then found a workaround for this problem: * creating a ramdisk (10 MB should suffice) * mount it as /var/lib/xymon/temp (unlike "tmp" originally) * change the tmp location in xymonclient.cfg * restart xymon-client This allows the system to send reports even if the root disk is completely full and there's no need for repartitioning or adding other disks. Any thoughts about that? Are there any repercussions I did not think about? I'd love to hear your opinions. Thanks in advance! Cheers Christoph

2 2

ports check for a VIP...
by didds3＠yahoo.co.uk 18 Oct '21

18 Oct '21

sorted.,... combostatus --debug --no-update does the job

1 0

ports check for a VIP...
by jeremy＠laidman.org 18 Oct '21

18 Oct '21

What was the output on the combo check page, during the outage? On Mon, 11 Oct 2021 at 19:16, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Ian Diddams <didds3 at yahoo.co.uk> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Mon, 11 Oct 2021 08:16:02 +0000 (UTC) > Subject: Re: [Xymon] ports check for a VIP... > Purely a sort of FYI I guess... not sure what was occurring but last > Friday early hours the clusetrr had a bit of a tizz and both nodes had no > mysqld running and so procs was not green on both nodes... but the combo > check remained green throughout.. > > > > On Thursday, 7 October 2021, 09:41:02 BST, Ian Diddams via Xymon < > xymon at xymon.com> wrote: > > > That's great Jeremy - many thanks > > Now > > (wp\-vldyn\-estrela.ports)||(wp\-vldyn\-rafeiro.ports) = (1)||(1) = 1 > [image: clear] wp-vldyn-estrela.ports > [image: green] wp-vldyn-rafeiro.ports > > ian > > > On Wednesday, 6 October 2021, 05:15:11 BST, Jeremy Laidman < > jeremy at laidman.org> wrote: > > > On Mon, 4 Oct 2021 at 23:15, Ian Diddams via Xymon <xymon at xymon.com> > wrote: > > > > > intrigiingly the actual output on that combo check shows > > > > (wp-vldyn-estrela.ports)||(wp-vldyn-rafeiro.ports) = (0-0-1)||(0-0-1) = 1 > > <snip> > > > i.e. its all showing clear for the individual lines which are also > separated where the hostname includes a hyphen... is that all correct ? > > I don't think so. From the manpage of combo.cfg: > > "Note: If the expression involves hostnames with a character that is also > an operator - e.g. if you have a host "t1-router-newyork.foo.com" with a > dash in the hostname - then the operator-character must be escaped with a > backslash '\' in the expression, or it will be interpreted as an operator. > E.g. like this: > nyc.conn = (t1\-router\-nyc.conn || backup\-router\-nyc.conn)" > > That's why it thinks you have hostnames like "wp" and "vldyn". It's almost > certainly not testing what you want it to be testing. > > Cheers > Jeremy > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > > ---------- Forwarded message ---------- > From: Ian Diddams via Xymon <xymon at xymon.com> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Mon, 11 Oct 2021 08:16:02 +0000 (UTC) > Subject: Re: [Xymon] ports check for a VIP... > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

2 4

clients in local mode (Debian 10/11)
by zechner＠vrvis.at 18 Oct '21

18 Oct '21

Hi, this is just a little guide for anybody wishing to put xymon clients (all Debian 10 respectively 11) into local mode. We tried changing the appropriate config part [1] (but did not succeed, because in the Debian package the binary "xymond_client" was missing when installing the "xymon-client" package. This has previously been reported to the Debian bug tracker [2], but with little progress unfortunately. So we tried to copy the binary from our server and distributed it to the clients and it just worked. No need to manually compile the client package, just take the binary from the server package and use it on the client. Tested successfully with Debian 10 (xymon-client 4.3.28) and Debian 11 (xymon-client 4.3.30). Chers Christoph [1] LOCALMODE="yes" in /etc/xymon/xymonclient.cfg [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903614

1 0

[bug report] logfetch: disable executing arbitrary commands
by zechner＠vrvis.at 15 Oct '21

15 Oct '21

Hi, I was surprised to learn that executing arbitrary commands via logfetch is the default in xymon and I think it shouldn't be. Overall it would make xymon a little bit more secure and if needed, it could be easily activated. Attached is the necessary patch for this, please let me know if this suits the general idea of xymon or if there are arguments against this measure. Thanks in advance! Cheers, Christoph patch: --- xymonclient.cfg.DIST +++ xymonclient.cfg.NEW @@ -15,7 +15,7 @@ XYMONCLIENTLOGS="$XYMONHOME/logs" # Where we store the client logfiles # Options to logfetch, the xymon binary which examines log files for recent changes. -LOGFETCHOPTS="" +LOGFETCHOPTS="--noexec" # Local Mode (Only) Options

1 0

Remote Code execution
by zechner＠vrvis.at 14 Oct '21

14 Oct '21

Hi, after reading an old thread about remote code execution on here [1], I wondered if something like this is still possible nowadays with xymon? In 2016 [2] this has been classified as a security risk, whereas in 2007, it was considered a feature/addon. I am wondering if remote code execution is still possible either via this mechanism or in some other way or if the development team has been taking precautions against attacks like that. Thanks in advance. Cheers Christoph [1] https://lists.xymon.com/archive/2007-June/013587.html [2] https://packetstormsecurity.com/files/135758/xymon-execoverflowdisclsoe.txt

3 5

Monitor Windows service if installed
by colin.coe＠gmail.com 12 Oct '21

12 Oct '21

Hey all Is there a way to alert if a particular Windows service is installed but not running? Thanks

5 8

ports check for a VIP...
by didds3＠yahoo.co.uk 11 Oct '21

11 Oct '21

Purely a sort of FYI I guess...? not sure what was occurring but last Friday early hours the clusetrr had a bit of a tizz and both nodes had no mysqld running and so procs was not green on both nodes...? but the combo check remained green throughout.. On Thursday, 7 October 2021, 09:41:02 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: That's great Jeremy - many thanks Now (wp\-vldyn\-estrela.ports)||(wp\-vldyn\-rafeiro.ports) = (1)||(1) = 1 wp-vldyn-estrela.ports wp-vldyn-rafeiro.ports ian On Wednesday, 6 October 2021, 05:15:11 BST, Jeremy Laidman <jeremy at laidman.org> wrote: On Mon, 4 Oct 2021 at 23:15, Ian Diddams via Xymon <xymon at xymon.com> wrote: intrigiingly the actual output on that combo check shows (wp-vldyn-estrela.ports)||(wp-vldyn-rafeiro.ports) = (0-0-1)||(0-0-1) = 1 ?<snip> i.e. its all showing clear for the individual lines which are also separated where the hostname includes a hyphen...? is that all correct ? I don't think so. From the manpage of combo.cfg: "Note: If the expression involves hostnames with a character that is also an operator - e.g. if you have a host "t1-router-newyork.foo.com" with a dash in the hostname - then the operator-character must be escaped with a backslash '\' in the expression, or it will be interpreted as an operator. E.g. like this: ?nyc.conn = (t1\-router\-nyc.conn || backup\-router\-nyc.conn)" That's why it thinks you have hostnames like "wp" and "vldyn". It's almost certainly not testing what you want it to be testing. CheersJeremy _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

ports check for a VIP...
by jeremy＠laidman.org 07 Oct '21

07 Oct '21

On Mon, 4 Oct 2021 at 23:15, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > > > intrigiingly the actual output on that combo check shows > > > > (wp-vldyn-estrela.ports)||(wp-vldyn-rafeiro.ports) = (0-0-1)||(0-0-1) = 1 > <snip> > > i.e. its all showing clear for the individual lines which are also > separated where the hostname includes a hyphen... is that all correct ? > > I don't think so. From the manpage of combo.cfg: "Note: If the expression involves hostnames with a character that is also an operator - e.g. if you have a host "t1-router-newyork.foo.com" with a dash in the hostname - then the operator-character must be escaped with a backslash '\' in the expression, or it will be interpreted as an operator. E.g. like this: nyc.conn = (t1\-router\-nyc.conn || backup\-router\-nyc.conn)" That's why it thinks you have hostnames like "wp" and "vldyn". It's almost certainly not testing what you want it to be testing. Cheers Jeremy

2 1