- Xymon - Xymon mailman web

Housekeeping on /xymon/data/hostdata
by Neil.Simmonds＠express-gifts.co.uk 28 Oct '13

28 Oct '13

We've been getting some space issues recently on our /xymon filesystem. We don't really want to add more space so I am looking at implementing some housekeeping on the /xymon/data/hostdata folder. If I run a find command there are nearly 58000 files over 180 days old and I don't really think we need to keep client data from alerts older than that. Is there a built in way to manage this or is it a case of writing a script to manage it? Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

3 5

[Bbwin-help] win32 svcs monitoring
by malcolm.hunter＠gmx.com 28 Oct '13

28 Oct '13

Good spot. I'll fix these typos tonight and run a build. ----- Original Message ----- From: Neil Simmonds Sent: 10/28/13 09:25 AM To: xymon at xymon.com Subject: Re: [Bbwin-help] [Xymon] win32 svcs monitoring I've just been looking at this again as this is still causing confusion. I've been looking at the svcs.cpp part of the BBWin code and while I'm not a programmer, I noticed that in 2 places the word "stopped" is actually spelt "stoppped". It's just a feeling but it might be that it is causing the false status to be reported. > -----Original Message----- > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Mark Felder > Sent: 11 October 2013 15:48 > To: xymon at xymon.com > Subject: Re: [Xymon] win32 svcs monitoring > > On Fri, Oct 11, 2013, at 9:21, Neil Simmonds wrote: > > Actually in my experience if it reports this, there is an issue but > > it's just not reporting it correctly. If you look at the list below > > you will probably find that it's actually stopped. > > > > This has been a major bugbear of mine for quite some time but I've not > > been able to find a solution. It seems that it always reports the > > status as whatever the "want" value is but when you look at the actual > > process then there really is an issue. > > > > This causes confusion for our operators as they are left wondering why > > Xymon is reporting red for a service that appears at first look to be > > in exactly the state required. > > > > > > I can't login to this specific server to confirm your suspicions, but I'll pass this info > to the other techs here _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Conduct Authority ----------------------------------------------------------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences ar ising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030 -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net

1 0

win32 svcs monitoring
by feld＠feld.me 28 Oct '13

28 Oct '13

Sometimes windows svc monitoring does strange things like report that there's an issue with a service when there really isn't. See attached image Is this something that can be fixed on the xymon-server side? Is there a parsing error?

2 4

XyMon 4.3.12 - what about HTTPS problems reported for 4.3.11 ?
by A.Chervonets＠cominder.eu 27 Oct '13

27 Oct '13

Problem is for some sites with valid certificates too. I had checked to access page with wget or lynx - and it is working. So I do not see reason why Xymon should get "Server Timeout" for the same target. Here is the debug of wget. Please, advice how to diagnose/debug Xymon to find the solution. I am a bit confused why nobody reporting the same problem: * nobody using new openssl libraries? * nobody do https tests for some, may a bot non-standard SSL certificates or web-sites? Anyway, my opinion - if this is working for all other tools like lynx, wget, browsers, this could also work in Xymon. Test case: both URL get Server Timeout in Xymon, but working with wget: URL1: https://epak.pmlp.gov.lv/ (here is redirect - I had found Xymon may have trouble with redirects over https) URL2: https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx (no redirects here, certificate valid, but XyMon can not access it) ========= URL1: =========== [xymon at myhost~]$ wget --debug https://epak.pmlp.gov.lv/ DEBUG output created by Wget 1.12 on linux-gnu. --2013-10-23 13:02:52-- https://epak.pmlp.gov.lv/ Resolving epak.pmlp.gov.lv... 195.234.144.230 Caching epak.pmlp.gov.lv => 195.234.144.230 Connecting to epak.pmlp.gov.lv|195.234.144.230|:443... connected. Created socket 3. Releasing 0x0000000001606440 (new refcount 1). Initiating SSL handshake. Handshake successful; connected socket 3 to SSL handle 0x0000000001607570 certificate: subject: /C=LV/ST=Riga/L=Riga/O=Office of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv issuer: /C=US/O=Thawte, Inc./CN=Thawte SSL CA X509 certificate successfully verified and matches host epak.pmlp.gov.lv ---request begin--- GET / HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 301 Moved Permanently Content-Length: 179 Content-Type: text/html Location: https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Date: Wed, 23 Oct 2013 10:02:45 GMT Connection: keep-alive ---response end--- 301 Moved Permanently Registered socket 3 for persistent reuse. Location: https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx [following] Skipping 179 bytes of body: [<head><title>Document Moved</title></head> <body><h1>Object Moved</h1>This document may be found <a HREF=" https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx">here</a></body>] done. --2013-10-23 13:02:52-- https://epak.pmlp.gov.lv/NYX.Nyx001.WebSite/Default.aspx Reusing existing connection to epak.pmlp.gov.lv:443. Reusing fd 3. ---request begin--- GET /NYX.Nyx001.WebSite/Default.aspx HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Connection: keep-alive Date: Wed, 23 Oct 2013 10:02:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=xpwkktquphtyv02va2ms1ejv; path=/; HttpOnly Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 7365 ---response end--- 200 OK Stored cookie epak.pmlp.gov.lv -1 (ANY) / <session> <insecure> [expiry none] ASP.NET_SessionId xpwkktquphtyv02va2ms1ejv Length: 7365 (7.2K) [text/html] Saving to: `Default.aspx.2' 100%[====================================================================================================================>] 7,365 --.-K/s in 0s 2013-10-23 13:02:52 (832 MB/s) - `Default.aspx.2' saved [7365/7365] ========= URL2 ========================= [xymon at myhost~]$ wget --debug https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx DEBUG output created by Wget 1.12 on linux-gnu. --2013-10-23 13:03:58-- https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx Resolving epak.pmlp.gov.lv... 195.234.144.230 Caching epak.pmlp.gov.lv => 195.234.144.230 Connecting to epak.pmlp.gov.lv|195.234.144.230|:443... connected. Created socket 3. Releasing 0x00000000013ae4d0 (new refcount 1). Initiating SSL handshake. Handshake successful; connected socket 3 to SSL handle 0x00000000013af620 certificate: subject: /C=LV/ST=Riga/L=Riga/O=Office of Citizenship and Migration Affairs/OU=Department of Population Register/CN=*.pmlp.gov.lv issuer: /C=US/O=Thawte, Inc./CN=Thawte SSL CA X509 certificate successfully verified and matches host epak.pmlp.gov.lv ---request begin--- GET /NYX.Nyx002.WebSite/Default.aspx HTTP/1.0 User-Agent: Wget/1.12 (linux-gnu) Accept: */* Host: epak.pmlp.gov.lv Connection: Keep-Alive ---request end--- HTTP request sent, awaiting response... ---response begin--- HTTP/1.1 200 OK Connection: keep-alive Date: Wed, 23 Oct 2013 10:03:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: ASP.NET_SessionId=pecngh45oqe2sk45vhthua55; path=/; HttpOnly Cache-Control: no-cache Pragma: no-cache Expires: -1 Content-Type: text/html; charset=utf-8 Content-Length: 8619 ---response end--- 200 OK Stored cookie epak.pmlp.gov.lv -1 (ANY) / <session> <insecure> [expiry none] ASP.NET_SessionId pecngh45oqe2sk45vhthua55 Registered socket 3 for persistent reuse. Length: 8619 (8.4K) [text/html] Saving to: `Default.aspx.3' 100%[====================================================================================================================>] 8,619 --.-K/s in 0s 2013-10-23 13:03:58 (1007 MB/s) - `Default.aspx.3' saved [8619/8619] ------------------- this is output from: User-Agent: Wget/1.12 (linux-gnu) output from host with older ssl and wget is the same (except User-Agent: Wget/1.11.4 Red Hat modified) From: Andrey Chervonets/Cominder/LV To: henrik at hswn.dk, Cc: xymon at xymon.com Date: 31.07.2013 18:15 Subject: Re: XyMon 4.3.12 - what about HTTPS problems repoirted for 4.3.11 ? Yes, there may be some specific or expired certificate, but workaround not working anyway, Tested, using http3 does not help for CentOS and OpenSUSE 12.3 tested with URL: https://epak.pmlp.gov.lv/NYX.Nyx002.WebSite/Default.aspx and some others. Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/ From: henrik at hswn.dk To: Andrey Chervonets <a.chervonets at cominder.eu>, Cc: <xymon at xymon.com> Date: 25.07.2013 13:07 Subject: Re: XyMon 4.3.12 - what about HTTPS problems repoirted for 4.3.11 ? Hi, all indications are that this is an OpenSSL library problem (present in OpenSSL 1.x, but not in the older 0.9.x versions). Debian has this bug report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702635 SuSE has this: http://lists.opensuse.org/opensuse-bugs/2013-05/msg01048.html It appears that the problem only shows up when testing sites with specific SSL implementations; e.g. I've seen it when connecting to some IIS versions. Apparently, a work-around is to force the use of SSLv3 instead of TLSv1; you can do that by changing the URL in hosts.cfg so it has "https3" instead of just "https". Regards, Henrik Den 25.07.2013 07:54, Andrey Chervonets skrev: > Good day! > > I still not received any reply for my previous messages about https > tests problems in 4.3.11 or due openssl-1.0.nnnn. > Does 4.3.12 have fixes for that? > > Or what should be the steps to find root cause and fix? > Just tell me in which direction should I go, I am not going to tale > much of Your time. > > P.S. Really, I am surprised nobody else reported similar problems. I > fill I have done something wrong. :( >

4 7

Untidy e-Mails
by Nick＠Pettefar.com 25 Oct '13

25 Oct '13

We just use crummy Outlook. It's set to text only. Can the e-mail generator of Xymon put a CR/LF in front of each colour? That would improve things enormously. Regards, Nick Pettefar On 22 October 2013 23:49, Ford, Alan <Alan.FORD at stanwell.com> wrote: > Hi, > Can your email readers handle HTML (eg most smartphones) > -----Original Message----- > From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Nick Pettefar > Sent: Wednesday, 23 October 2013 2:14 AM > To: xymon > Subject: [Xymon] Untidy e-Mails > > Hi, we have various alert e-mails which look something like this: > > yellow Tue Oct 22 17:05:54 IST 2013 - Ports NOT ok &green PUCA (found 2, req. 2 or more) &green ITouch (found 0, req. none) &green Ericsson (found 2, req. 2 or more) &green TMI (found 2, req. 2 or more) &green Revenue (found 2, req. 2 or more) &green OpenSky (found 1, req. 1 or > more) &green OpenMarket (found 1, req. 1 or more) &green XIAM (found 1, req. 1 or more) &green Zamano (found 2, req. 2 or more) &green Tango (found 0, req. none) &green Opera (found 0, req. none) &green BT (found 0, req. none) &yellow Modeva (found 0, req. 1 or more) &green Gemalto (found 2, req. none) &green Biogiorno (found 0, req. none) &green Phonovation (found 3, req. 2 or more) &green Phonovation1 (found 1, req. 1 or more) &green Conductor_acnsvr1 (found 7, req. 1 or > more) &green Conductor_aaxsvr1 (found 8, req. 1 or more) > > Is there a way to tidy them up so that the individual coloured alerts can easily be discerned? > > Regards, > > Nick Pettefar > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon > > This email is to be read subject to the email disclaimer located at http://www.stanwell.com/email-disclaimer.aspx

4 5

Untidy e-Mails
by Nick＠Pettefar.com 22 Oct '13

22 Oct '13

Hi, we have various alert e-mails which look something like this: yellow Tue Oct 22 17:05:54 IST 2013 - Ports NOT ok &green PUCA (found 2, req. 2 or more) &green ITouch (found 0, req. none) &green Ericsson (found 2, req. 2 or more) &green TMI (found 2, req. 2 or more) &green Revenue (found 2, req. 2 or more) &green OpenSky (found 1, req. 1 or more) &green OpenMarket (found 1, req. 1 or more) &green XIAM (found 1, req. 1 or more) &green Zamano (found 2, req. 2 or more) &green Tango (found 0, req. none) &green Opera (found 0, req. none) &green BT (found 0, req. none) &yellow Modeva (found 0, req. 1 or more) &green Gemalto (found 2, req. none) &green Biogiorno (found 0, req. none) &green Phonovation (found 3, req. 2 or more) &green Phonovation1 (found 1, req. 1 or more) &green Conductor_acnsvr1 (found 7, req. 1 or more) &green Conductor_aaxsvr1 (found 8, req. 1 or more) Is there a way to tidy them up so that the individual coloured alerts can easily be discerned? Regards, Nick Pettefar

1 0

Graphs
by Neil.Simmonds＠express-gifts.co.uk 22 Oct '13

22 Oct '13

Hi all, I've got a test running which is collecting firewall connections for various web sites. I have values of "current connections" and "High Water Mark". These are both being successfully collected into an RRD database but I've got an issue with graphing. What I'd like to be able to do is have 2 graphs showing on the same page, 1 showing the "current connections" and 1 showing the "High Water Mark". I've successfully had them on the same graph but that gives me issues with the scale as it flattens the "current connections" graph too much. At the moment, the only way I can think of to get round this is to have the external script send the same data to 2 different columns so I can define the different graphs to the different columns but I'd really like to be able to do this on 1 page. Has anyone any idea of how I might do this? Regards, Neil Simmonds Senior Operations Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk<mailto:neil.simmonds at Express-Gifts.co.uk> Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

3 3

[xymon] combostatus --quiet bug?
by david.gore＠verizon.com 15 Oct '13

15 Oct '13

Hi, It would appear that when you add the --quiet option to combostatus like such: [combostatus] ENVFILE /home/xymon/server/etc/xymonserver.cfg NEEDS xymond CMD $XYMONHOME/bin/combostatus --quiet LOGFILE $XYMONSERVERLOGS/combostatus.log INTERVAL 5m It removes all the combostatus information from the alert page, to include all the colored status gifs and resultant lines of host.service? I was expecting it to just remove the Boolean expression at the top of the page under the timestamp? Perhaps I am not reading the man page correctly? --quiet Normally, the test status sent by combostatus includes information about the underlying test results used to determine the current value of the combined test. "--quiet" eliminates this information from the test status page. Running the latest version of Xymon 4.3.12 on RHEL 6.4. If you get something other than what I have described please let me know? Perhaps I am doing something wrong? ~David

1 0

Does maint-senders work as advertised?
by john.thurston＠alaska.gov 14 Oct '13

14 Oct '13

In xymond.8.html is written: > --maint-senders=IP[/MASK][,IP/MASK] > Controls which hosts may send maintenance commands to xymond. Maintenance commands are the "enable", "disable", "ack" and "notes" commands. Format of this option is as for the --status-senders option. It is strongly recommended that you use this to restrict access to these commands, so that monitoring of a host cannot be disabled by a rogue user - e.g. to hide a system compromise from the monitoring system. I am able to make '--status-senders' work as advertised, but I am unable to make '--maint-senders' work the way I think it should. The xmond segment of my tasks.cfg is: >CMD xymond --pidfile=$XYMONSERVERLOGS/xymond.pid \ > --restart=$XYMONTMP/xymond.chk --checkpoint-file=$XYMONTMP/xymond.chk --checkpoint-interval=600 \ > --log=$XYMONSERVERLOGS/xymond.log \ > --maint-senders=$XYMONSERVERIP \ > --no-download \ > --store-clientlogs=!msgs but I can still send disable-messages for an arbitrary hosts-test combination from an arbitrary windows machine with: BBWinCmd.exe xymon.example.com disable foo.example.com ssh 10 Text When I change the tasks.cfg to contain an arbitrary ip address (of a non-existent host): > --maint-senders=10.10.10.10 \ I am still able to send disable-messages from arbitrary machines. But, my log file then shows errors for attempts by the xymon server to handle alerts: > 2013-10-14 12:34:27 Refused message from 10.200.10.24: notify foo,example,com.ssh So I see --maint-senders being evaluated by the alert-handling process, but ignored by the client-listener. Does anyone else have --main-senders working correctly? -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

1 0

Status not avalable
by Lucas.Wang＠ehealth-china.com 14 Oct '13

14 Oct '13

Hi, I am encountering this problem "Status not avalable" when I click on green icon like http,cpu etc. What's the issue please? I got error info in file cgierror.log: 2013-10-14 05:58:38 hobbit-nkview Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice *** attempt to put segment in horiz list twice 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout 2013-10-14 06:08:20 hobbitsvc Whoops ! bb failed to send message - timeout *** attempt to put segment in horiz list twice Best regards, Lucas Wang Sr. Unix Administrator Xiamen IT Operations 24x7 Siteops Hotline: +86 13616020670 eHealth | 9F, Chuangxin Building, Software Park, Xiamen, Fujian, P.R. China 361005 (SP) T 650.210.3511 | M 189.0592.1566 | Lucas.Wang at ehealth-china.com<mailto:Henk.Wang at ehealth-china.com> | www.ehealth-china.com<http://www.ehealth-china.com/> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information or may otherwise be protected by law. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0