- Xymon - Xymon mailman web

ports check for a VIP...
by zechner＠vrvis.at 05 Oct '21

05 Oct '21

On 01/10/2021 17:39, Ian Diddams wrote: > > > >Do you also need the connection status as well? "ports" and "conn" are > >two different colums, I don't think mixing them would be wise? > > No - TBH not really > > > >That's why you need the "||", it's an or, so as long as one of your two > >hosts is green, your overall status is green. > > yes - but then presumably that emans the other host is red. And that > will just spoawn reports form our monitoring team or at the very least > obfuscate the page sending it red for no real reason. It will not spawn any reports or alarm, as long as one of them is green, everything is fine. So in your case, there would be three statuses: 1) overall status of this check: green if one is green 2) system A red or green 3) system B reg or green There are no alarms as long as one of them is green. > > The bottom line is only one server in the cluster has the port in use at > any one time and we dont want a "red" simoly becasue that is actually > the correct situation. > > cheers > > ian

2 4

ports check for a VIP...
by jeremy＠laidman.org 04 Oct '21

04 Oct '21

On Mon, 4 Oct 2021 at 19:25, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > well having set it up, the combo test is green indeed - but the two > servfers that make up the combo test are shwoing > > * one green (as the port check is green as mysqld is runnoing on that > system) > * one red (as the port check is red as mysqld is runnoing on that > system) > > So we do get a red showing that the monitoring team will respond to. I > cant make it "clear" as there are other procs and ports being checked that > do need a red if alerting. > > so unfortunately it doesnt seem to be the solution - but I do appreciate > the attem[pt to help :-) > You can silence the alarms for the individual tests, in alarms.cfg. J

1 1

ports check for a VIP...
by zechner＠vrvis.at 01 Oct '21

01 Oct '21

Hi, On 01/10/2021 14:15, Ian Diddams via Xymon wrote: > we have a HA mysql db cluster that runs with a VIP (drbd, pacemaker, > corosync) > > we want a ports check for 3306 - but if we configure it for the two > systems in the cluster one of them will always be red as its the slave > and not running mysqld (it only runs on the master). > > the clear alternative is to somehow run a 3306 check on the VIP...? but > the VIP itself is only an IP in hosts.cfg (so we can conn check its > existence etc) and so isnt a client sending reports back to the server. > > any hints as to how we can acheive such a test ? You could try a combo status test, I've implemented these for connection tests, but it should work for port checks too, I guess (have not tried it though). (all paths are for Debian, that's what I am using) I defined a target in /etc/xymon/combo.cfg like this: computer.conn = (computer1.conn || computer2.conn) This returns green if one of the machines is green and also shows both statuses in the web interface. I guess, this should also work with ports... Good luck! Christoph

2 2

ports check for a VIP...
by didds3＠yahoo.co.uk 01 Oct '21

01 Oct '21

we have a HA mysql db cluster that runs with a VIP (drbd, pacemaker, corosync) we want a ports check for 3306 - but if we configure it for the two systems in the cluster one of them will always be red as its the slave and not running mysqld (it only runs on the master). the clear alternative is to somehow run a 3306 check on the VIP...? but the VIP itself is only an IP in hosts.cfg (so we can conn check its existence etc) and so isnt a client sending reports back to the server. any hints as to how we can acheive such a test ?

1 0

SMTP checks
by lk＠man-da.de 01 Oct '21

01 Oct '21

On Mittwoch, 29. September 2021 12:18:19 CEST Ian Diddams via Xymon wrote: > > improper command pipelining after EHLO from unknown[x.x.x.x] Hello Ian, the following works for me without this log message: [smtp] send "ehlo xymonnet\r\n" expect "220" send "quit\r\n" options banner port 25 But I have the sends and expects commented out for smtps (with authentication) due to TLS 1.3 issues at the moment. Kind regards, Lars -- Lars Kollstedt Telefon: +49 6151 16-71027 E-Mail: lk at man-da.de man-da.de GmbH Dolivostra?e 11 64293 Darmstadt Sitz der Gesellschaft: Darmstadt Registergericht: Amtsgericht Darmstadt Handelsregisternummer: HRB 9484 Gesch?ftsf?hrer: Andreas Ebert

3 3

Xymon-client for Proxmox ve
by jgsuareza1984＠gmail.com 01 Oct '21

01 Oct '21

HI Where do I get the xymon client installer for proxmox ve? -- Saludos, GS

2 1

Baffled by absence of "ssh" in certain "hosts.cfg" entries, yet SSH tests are run
by earle＠isolar.DynDNS.ORG 30 Sep '21

30 Sep '21

I'm setting up a new instance of Xymon 4.3.30 on a RHEL 7.9 system and something simple has me absolutely baffled. -- [root at adm2 hosts.d]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.9 (Maipo) [root at adm2 hosts.d]# rpm -q xymon xymon-4.3.30-1.el7.x86_64 -- In the setup there are a couple of VMware vCenters and several VMware ESXi hosts. The vCenter(s) have SSH and Web server access, but the ESXi hosts have had their SSH servers disabled and they only run the Web services. A greatly oversimplified version of my "/etc/xymon/hosts.d/localhosts.cfg" file is as follows: -- [root at adm2 hosts.d]# grep https localhosts.cfg 192.168.1.1 vcenter01 # ssh https://vcenter01=192.168.1.1/ 192.168.1.100 esxi-1 # https://esxi-1=192.168.1.100/ 192.168.1.101 esxi-2 # https://esxi-2=192.168.1.101/ -- After putting in these entries, the vCenter shows up fine in the Web interface but the ESXi hosts all show up with an "ssh" column - and red entries for all! About 30 minutes later, they've turned to purple. As you can see, I didn't put "ssh" into the (local)hosts.cfg file entries for the ESXi hosts; so why are they showing up as red alerts? It's like as if the "https" test is implicitly causing an "ssh" test to be run, even if I didn't ask for it. Color me baffled. If I don't put "ssh" into the hosts.cfg entry, why is it running an "ssh" test? Any clues? I'm sure I could probably run "xymon 127.0.0.1 'drop <host> ssh'" for all of them, but I'd rather know why this is happening. Thanks in advance for any help. - Greg

2 1

SMTP checks
by jeremy＠laidman.org 29 Sep '21

29 Sep '21

Ian [disclaimer: I don't use the smtp check] I'm wondering if the "connect timeout" relates not to the TCP connection but the SMTP conversation. I would do a packet capture during the interaction between xymonnet and the mail server, and see if it closely matches your telnet interaction, or deviates. The smtp check is defined in protocols.cfg [smtp] send "mail\r\nquit\r\n" expect "220" options banner port 25 This expects a 220 in the response after the mail\r\nquit\r\n is sent: '*It will then expect a response beginning with "220".*' (my emphasis on the word "then") Your interaction shows 221 instead of 220, after the mail/quit strings. But if this is the problem, then protocols.cfg has been wrong for many, many years. I suspect (contrary to what I infer from the man page) that "expect" looks in the strings for the whole interaction, not just the ones after the "send" string is sent. In which case, the protocols.cfg entry for smtp should work fine. However, you might like to test removing the "expect" or altering to look for 221 instead of 220. Cheers Jeremy On Wed, 29 Sept 2021 at 00:22, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Ian Diddams <didds3 at yahoo.co.uk> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC) > Subject: SMTP checks > xymon server 4.3.28, centos 7.9 > mail server centos 6 (about to be replaced anyway) > > I'm in a bit of a quandary... > > we have an smtp check of a server ("oscar"). > > Literally for "years" (3+) the xymon in house smtp check has been more > than happy. > > Then since Sept 11th [1] its been flipping constantly beyween green and > happy to red > eg > > Service listening but unavailable (connect timeout) > > > Seconds: 0.001842000 > > > But if I run a telnet test from the xymon server itself it always connects > immediately, and responds instantaneously. > > eg > > $ telnet oscar 25 > Trying <redacted>... > Connected to oscar. > Escape character is '^]'. > 220 a.b.co.uk ESMTP Postfix > mail > 501 5.5.4 Syntax: MAIL FROM:<address> > quit > 221 2.0.0 Bye > Connection closed by foreign host. > $ > > > > All xymon logs show are emails being sent because of the alerts, ad > falling statuses that are a result of the constant flipping from red to > green. maillog has nothing untoward, ditto messages. > > Anyone any ideas what on earth is suddenly occurring that may explain this > recent timeout issue? any expereince of similar? > > didds > > > > [1] no changes made around that time etc. Networks confirm nothing shoing > in their logs etc. > > > > ---------- Forwarded message ---------- > From: Ian Diddams via Xymon <xymon at xymon.com> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC) > Subject: [Xymon] SMTP checks > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

2 2

SMTP checks
by jeremy＠laidman.org 29 Sep '21

29 Sep '21

Ian I believe the postfix warning is because there's a "mail" command before a "helo" or "ehlo" command. Pipelining is when Postfix checks to see that the mail client is waiting for the response to one command, before sending the next command, rather than just sending a "pipeline" of commands without checking the results of each. Spamming robots do this kind of thing. You can either modify the postfix configuration (see reject_unauth_pipelining), or adjust the [smtp] protocol to not start sending a mail message. I'd suggest sending "ehlo xymonnet\r\nquit\r\n". What triggers the smtp check is: a) you have "smtp" on the host's line in hosts.cfg, and b) you have xymonnet being launched every 5 minutes, which reads hosts.cfg, sees "smtp" and looks up the [smtp] section in protocols.cfg When there's a test failure, xymonnet-again runs every minute and does a rapid re-check of any failed tests. So a test that goes red can go green again a minute later. In fact, xymonnet and xymonnet-again don't seem to be synchronised at all, so I guess it's possible for xymonnet to run immediately after xymonnet has finished. J On Wed, 29 Sept 2021 at 20:18, Ian Diddams via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Ian Diddams <didds3 at yahoo.co.uk> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Wed, 29 Sep 2021 10:18:19 +0000 (UTC) > Subject: Re: [Xymon] SMTP checks > I also can see from the maillog that when the smtp check occurs > > > Sep 29 11:05:01 oscar postfix/smtpd[27269]: connect from unknown[x.x.x.x] > Sep 29 11:05:01 oscar postfix/smtpd[27269]: improper command pipelining > after MAIL from unknown [x.x.x.x] > Sep 29 11:05:01 oscar postfix/smtpd[27269]: disconnect from unknow > [x.x.x.x] > > so obviously the smtp check is sending something postfix doesnt > like/handle. That isnt a bhiggy in itself - bgut it nojw makes me wonder > out of curiosity exactly what the logic of the smtp check is.. > > I also tried Jeremy's example of "ehlo xymonnet\r\nquit\r\n" in > protocols.cfg - that also has the same warning/error in maillog > > improper command pipelining after EHLO from unknown[x.x.x.x] > > all jolly wierd,.... > > ian > > > > On Wednesday, 29 September 2021, 10:59:09 BST, Ian Diddams via Xymon < > xymon at xymon.com> wrote: > > > > secondary question... > > what triggers the smtp check? > > Ive had instances where the test goes red, and then just a few seconds > later back to green. So this isnt a standard "every 5 minutes" clearly ? > > ... > Wed Sep 29 08:44:39 2021 green 0:02:13 > Wed Sep 29 08:44:15 2021 red 0:00:24 > Wed Sep 29 07:44:36 2021 green 0:59:39 > ... > > anybody know? > > cheers > > ian > > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > > > > ---------- Forwarded message ---------- > From: Ian Diddams via Xymon <xymon at xymon.com> > To: xymon <xymon at xymon.com> > Cc: > Bcc: > Date: Wed, 29 Sep 2021 10:18:19 +0000 (UTC) > Subject: Re: [Xymon] SMTP checks > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

1 0

SMTP checks
by didds3＠yahoo.co.uk 29 Sep '21

29 Sep '21

I also can see from the maillog that when the smtp check occurs Sep 29 11:05:01 oscar postfix/smtpd[27269]: connect from unknown[x.x.x.x] Sep 29 11:05:01 oscar postfix/smtpd[27269]: improper command pipelining after MAIL from unknown [x.x.x.x]Sep 29 11:05:01 oscar postfix/smtpd[27269]: disconnect from unknow [x.x.x.x] so obviously the smtp check is sending something postfix doesnt like/handle.? That isnt a bhiggy in itself - bgut it nojw makes me wonder out of curiosity exactly what the logic of? the smtp check is.. I also tried Jeremy's example of "ehlo xymonnet\r\nquit\r\n" in protocols.cfg - that also has the same warning/error in maillog ?improper command pipelining after EHLO from unknown[x.x.x.x] all jolly wierd,.... ian On Wednesday, 29 September 2021, 10:59:09 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: secondary question... what triggers the smtp check? Ive had instances where the test goes red, and then just a few seconds later back to green.? So this isnt a standard "every 5 minutes" clearly ? ... Wed Sep 29 08:44:39 2021 green 0:02:13 Wed Sep 29 08:44:15 2021 red 0:00:24 Wed Sep 29 07:44:36 2021 green 0:59:39 ... anybody know? cheers ian _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0