- Xymon - Xymon mailman web

http alert mail as octet-stream
by dirk.kastens＠uni-osnabrueck.de 12 Oct '13

12 Oct '13

Hi, I'm using xymon 4.3.11 on Scientific Linux 6.4 I discovered a weird phenomenon with the alert mails that xymon is sending. Most mails are coded as text/ascii by my postfix MTA. Only the mails about http alerts are sent base64 encoded, because the content is regarded as an octet-stream. I had no idea why this happened, because the mails look normal as being ascii code. But when I used a script to store the message, I found out, that all lines of the http message are terminated by a ctrl-m character: ------------------------------- BBALPHAMSG=myhost.xyz.de:http red [621842] red Fri Oct 11 09:43:45 2013: Not Found &red http://myhost.xyz.de/myurl - Not Found HTTP/1.1 404 Not Found^M Date: Fri, 11 Oct 2013 07:43:45 GMT^M Server: Apache/2.2.22 (Ubuntu)^M Vary: Accept-Encoding^M Content-Length: 308^M Connection: close^M Content-Type: text/html; charset=iso-8859-1^M Seconds: 0.00 -------------------------------- Where does this happen and how can I change the behaviour? Thanks, Dirk

2 1

Cannot load host configuration error
by kspringer＠innovateteam.com 12 Oct '13

12 Oct '13

My server got a reboot and the public IP got changed. Now whenever I click any colored dot on my Xymon homepage it gives me this error. Cannot load host configuration All the suggestions I've found say that Xymon may not actually be running. There are Start scripts in the /etc/rc#.d folders, and also I can manually start and restart it from the command line with no troubles. What's going on? I suspected a DNS issue but I left it overnight and it still has the same issue this morning. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

4 4

override CLASS(LOG) for one host
by bakgat8＠hotmail.com 11 Oct '13

11 Oct '13

I have this and it is good CLASS=linux PROC ntpd PROC sshd 1 PROC cron FILE /var/log/messages red MODE=644 LOG /var/log/messages %panic|error|Critical LOAD 25.0 35.0 except for the splunk server on that ONE server I don't want above LOG to apply. How can I do that? Gonda

2 1

Can anyone confirm unexpected behavior of DISPLAYGROUP in alerts.cfg ?
by john.thurston＠alaska.gov 11 Oct '13

11 Oct '13

I see inconsistency between the documentation for the DISPLAYGROUP rule in alerts.cfg and the behavior of the rule. In the alerts.cfg.5.html on my server (Updated: Version 4.3.12: 24 Jul 2013) says: > DISPLAYGROUP=groupstring Rule matching an alert by the text of the display-group (text following the group, group-only, group-except heading) in the hosts.cfg file. "groupstring" is the text for the group, stripped of any HTML tags. > . . . . the database servers can be matched with DISPLAYGROUP="Production databases" The first inconsistency is there is no mention of this rule in the xymon-alerts.html file. That's understandable as the xymon-alerts.html is probably an older file. But since this rule offers me significant business advantage, I went ahead and gave it a shot. The real problem is that DISPLAYGROUP does not appear to handle spaces and double quotes as advertised. When I try to use the rule in my alert.cfg, my alert.log contains lines telling me of unknown tokens. From my hosts.cfg > page ETS ETS Enterprise > title Solaris Hosts > subparent ETS SolHostsAll All > group Solaris T3 Servers > 0.0.0.0 argon.example.com # client:argon !ftp From my alerts.cfg > DISPLAYGROUP="Solaris T3 Servers" > MAIL foo at alaska.gov REPEAT=1m SERVICE=ssh Results in alert.log > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'T3' at line 130 > 2013-10-10 16:52:12 Ignored unknown/unexpected token 'Servers"' at line 130 If, however, I change the group name to be the single word "Solaris" (withoug quotes) and change the line in alerts.cfg to be: DISPLAYGROUP=Solaris then it works without complaint. It also works if I leave the original group name and change the line in alerts.cfg to use regex: DISPLAYGROUP=%Solaris[[:space:]]T3[[:space:]]Servers Can anyone confirm this behavior? It appears I can work around it with the regex, but it is going to make my alerts.cfg a lot more difficult to maintain and read. fwiw, I am running my xymon server on Solaris 10 SPARC. -- Do things because you should, not just because you can. John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska

2 2

Anyone doing anything interesting with Xymon and Splunk?
by A.Chervonets＠cominder.eu 11 Oct '13

11 Oct '13

Not yet, but in few months we are going to investigate Splunk features and definitely integrate it with XyMon monitoring. So, we can merge efforts or at least share usefull information. Best regards, Andrey Chervonets ---------------------- SIA CoMinder http://www.cominder.eu/ mobile: +371 26517848 > > ---------------------------------------------------------------------- > Message: 1 > Date: Tue, 8 Oct 2013 09:27:42 -0400 > From: Betsy Schwartz <betsy.schwartz at gmail.com> > To: "xymon at xymon.com" <xymon at xymon.com> > Subject: [Xymon] Anyone doing anything interesting with Xymon and > Splunk? > Message-ID: > <CAAVLHR2XkFQnDcN9Fiqt9uf6qCFv4uFLakgjkLkmNPJy+r-+jw at mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > We're ramping up Splunk in a big way. thinking about how to build xymon > alerts from Splunk events and also how to use xymon to monitor Splunk > performance (in particular, picking up when server logs are not updating in > a timely manner) > > Wondering if anyone here is further down that path >

1 0

Content check question
by SKreien＠la-z-boy.com 11 Oct '13

11 Oct '13

Hey guys, I'm trying to build a content check to one of our internal servers. Here's what I've specified in the content check: cont=http-content;http://192.168.10.110 /Main/login.do\?userName=*****\&userPass=*****\&pcno=***;true I know the URL works, I can do it from the command line: [hobbit at retv6100 bb-hosts-includes]$ curl http://192.168.10.110/Main/login.do\?userName=*****\&userPass=*****\&pcno=*… And it returns: <loginResult loggedin='true' userloginid='1070002' pcid='****' address=******' session='ACAEB9D8C0C6D8D32824F977A1AEB2E3' /> But the test on Xymon returns "No output received from server". I'm stumped how it can be getting no output? Can anyone enlighten me? Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Incorporated 1284 N. Telegraph Rd. | Monroe, MI 48162 | scot.kreienkamp at la-z-boy.com<mailto:scot.kreienkamp at la-z-boy.com> | www.la-z-boy.com<http://www.la-z-boy.com/> This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.

2 3

can't fully clear conn history
by kspringer＠innovateteam.com 10 Oct '13

10 Oct '13

Hi, I've got a list of websites that we host that I put in a nice 'group-compress' list in my hosts file. I have 'noconn' set for each one so xymon doesn't show any ping results on the display page. On one of my sites I had 'noping' set instead of 'noconn' and now it shows a single icon in the 'conn' column that I want to make go away. I've gone in and manually removed all the 'hist', 'histlogs', and 'rrd' data for that site but the lonely icon is still there and won't go away. What am I missing? My goal is to not have a 'conn' column for the sites in that list. Thank you. ------------------------------------------------ *Kris Springer* * * *=======================* * *

3 2

what words to monitor for in /var/log/messages?
by bakgat8＠hotmail.com 10 Oct '13

10 Oct '13

I have moved over the stuff (words) we look for on HP-UX. Mainly for hardware errors. But I don't have anything readily at hand for a Linux server. What sort of stuff should I look for? I found a post on line that said panic and error. Seems fair enough - so I stuffed those in. Bakkies

1 0

Question about "all non-green view" and edit critical systems
by ken.shackelford＠siemens.com 09 Oct '13

09 Oct '13

Hello, I was wondering if there was a way to control which systems were summarized in the "all non-green view" window. I'd like to use this as a sort of front end for our operations staff to monitor and don't need to have them calling about every little thing. Also, I can't seem to find the correct user/pass to use when trying to run the "edit critical systems" or "acknowledge alert" pages. I'm running on Red Hat ES 5.9 and using Firefox for my browser. Keeps saying the password is invalid. I've tried the "xymon" account, "root" and even added a password to the "apache" account, but no success. What is expected here? Thanks, Ken Ken Shackelford Information Technology Siemens Industry Sector Siemens Product Lifecycle Management Software Inc. 2000 Eastman Drive Milford, OH 45150 United States Tel. :+1 (513) 576-2556 Fax :+1 (513) 576-2998 Mobile :+1 (513) 253-5508 ken.shackelford at siemens.com <mailto:ken.shackelford at siemens.com> www.siemens.com/plm

4 3

can one delay alert during specific hours?
by bakgat8＠hotmail.com 09 Oct '13

09 Oct '13

Pardon me if this is answered somewhere. Occasionally we have servers that miss a ping at night - probably due to backups going over production network (there are a few). I want to not get emailed on the first bad ping - be really bad before you wake me up - say between midnight and 6am. But it is not DOWNTIME as in never tell me. Can I do this? Can I say delayed red between specific hours. For now I just delayed the whole thing. Thanks Bakkies

2 1