- Xymon - Xymon mailman web

how does delayyellow work?
by troy＠athabascau.ca 22 Jan '13

22 Jan '13

My Xymon 4.3.10 server has a host configured as follows: XXX.XXX.XXX.XXX smtp # sm ~smtp ~smtps DOWNTIME=smtp,smtps:*:0500:0510:restart delayyellow=smtp:3,smtps:3,sm:6 The "sm" service has been yellow but only for less than 3 minutes. I didn't expect the status page to show yellow until after 6 minutes because of the " delayyellow" directive. What am I missing? cheers, Troy -- This communication is intended for the use of the recipient to whom it is addressed, and may contain confidential, personal, and or privileged information. Please contact us immediately if you are not the intended recipient of this communication, and do not copy, distribute, or take action relying on it. Any communications received in error, or subsequent reply, should be deleted or destroyed. ---

2 2

NCV RRD graphing for JSON values
by spah＠syntec.co.uk 22 Jan '13

22 Jan '13

I was hoping that Xymon's NCV parsing would understand JSON as the tutorial @ http://www.xymon.com/xymon/help/howtograph.html does not specify that the NCVs need to be on seperate lines (although I subsequently found that "man xymond_rrd" does). It's a shame because a lot of data is presented as JSON these days. For example, I have this test, which returns this: http://URLremoved/ - Testing URL <http://192.168.4.135:8080/tracker/co.do> yields: { u:1391595, rc:3517, asc:1628, usc:2154} I am using SPLITNCV and it just creates a testname,_u.rrd file. I doubt it would involve a huge diff to get /xymond/rrd/do_ncv.c to understand this format. I also doubt that it is currently within my level of C programming proficiency though unfortunately. Kind regards, SebA

2 3

Log/file monitoring based on occurrence?
by mburger＠bubbanfriends.org 22 Jan '13

22 Jan '13

I've got a situation at work where we're being tasked with monitoring failed logins. We've got logging and audit file creation in place...what I'm looking for is whether or not there's a way to have Xymon monitor those logs/files to look for X entries/occurrences within Y amount of time. The requirement is to try to do as much as this programatically as possible without having to resort to scripting or other measures that may be easily countered by a system admin. Thanks. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

6 9

xymonnet is slow to notify alert _and_ xymonnetagain log is missing
by vadud3＠gmail.com 21 Jan '13

21 Jan '13

According to traceroute xymonnet ping to host.example.com failed at 19:11:15, but the notification was sent at 19:20:37. The alert is configured to send notification immediately. Also, xymonnetagain should start doing ping test immediately as it is configured with interval 1m. But the next green status was not until 19:25:49. Where should I see the log for xymonnetagain did ping test ~ 5 times during this gap? xymonnet is default to interval 5m I am using xymon 4.3.10 on linux. Here are the relevant excerpts from various log files root at xymon { ~ }$ grep host.example.com /var/log/xymon/notifications.log.1 Sat Jan 19 19:20:37 2013 host.examplecom.conn (192.168.128.203) support at example.com[215] 1358641237 500 root at xymon { ~ }$ cat histlogs/host_example_com/conn/Sat_Jan_19_19\:20\:25_2013 red  Sat Jan 19 19:11:15 2013 conn NOT ok Service conn on host.example.com is not OK : Host does not respond to ping System unreachable for 1 poll periods (0 seconds) &red 192.168.128.203 is unreachable Traceroute results: traceroute to 192.168.128.203 (192.168.128.203), 30 hops max, 60 byte packets 1 svcs-01.example.com (192.168.7.67) 0.510 ms 0.592 ms 0.697 ms 2 192.168.13.106 (192.168.13.106) 0.320 ms 0.341 ms 0.378 ms 3 core-02.example.com (192.168.13.101) 1.104 ms 1.092 ms 1.072 ms 4 * * * 5 * * * 6 * * * ..... 30 * * * Status unchanged in 0.00 minutes Message received from 192.168.0.53 root at xymon { ~ }$ cat histlogs/host_example_com/conn/Sat_Jan_19_19\:25\:49_2013 green  Sat Jan 19 19:25:49 2013 conn ok Service conn on host.example.com is OK (up) &green 192.168.128.203 is alive (35.3 ms) Status unchanged in 0.00 minutes Message received from 192.168.0.53 -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

1 0

Starting Xymon via init script no environment variables
by a.chervonets＠cominder.eu 18 Jan '13

18 Jan '13

I see there is " /usr/bin/sudo -u xymon /home/xymon/client/runclient.sh start" Try, instead, to use jus "su - ": # /usr/bin/su - xymon -c "/home/xymon/client/runclient.sh start" # su - username - starts the new session under user account with required user variables. auto-start script is run with root anyway - so You need to use sudo. Best regards, Andrey Chervonets ---------------------- CoMinder Ltd. http://www.cominder.eu/ Mobile: +371 26517848 Fax: +371 66066346 On 17.01.2013 13:00, xymon-request at xymon.com wrote: > /usr/bin/sudo -u

1 0

Alerts list of confreport.cgi
by rower.master＠gmail.com 18 Jan '13

18 Jan '13

Hello All, Is there a way to generate the information below as we see into the info column and confreport.cgi with a command line? Alerts ServiceRecipient1st DelayStop afterRepeatTime of DayColors http EU at email.com (R)6m -2h -red EU2 at email.com (R) (R)6m -2h -red Thanks in advance. Regards, Mario.

1 0

Combo test questions
by Paul.Root＠CenturyLink.com 17 Jan '13

17 Jan '13

We are thinking of implementing a few combo tests for our network elements (cisco routers with devmon). We're wondering about what happens if the primary goes down, and things failover successfully to the secondary. Then if we blue out the primary failure, would the combo test still work if the secondary goes down? We'd be bluing out the primaries test, not the combo test. Or would we need to do a more complex test that takes that into account? Thanks, Paul.

2 2

does this mean it crashed on NULL hostname?
by sean.clark＠twcable.com 17 Jan '13

17 Jan '13

Core file from 4.3.10 version [root at hostname tmp]# gdb ../bin/xymond core.19353 Program terminated with signal 6, Aborted. #0 0x00bf9410 in __kernel_vsyscall () (gdb) where #0 0x00bf9410 in __kernel_vsyscall () #1 0x00589df0 in raise () from /lib/libc.so.6 #2 0x0058b701 in abort () from /lib/libc.so.6 #3 0x0805ec83 in sigsegv_handler (signum=11) at sig.c:57 #4 <signal handler called> #5 0x005d2759 in strcasecmp () from /lib/libc.so.6 #6 0x080621a5 in binsearch (mytree=0x85aecb0, key=0x0) at tree.c:47 #7 0x08062220 in xtreeFind (treehandle=0x85aecb0, key=0x0) at tree.c:97 #8 0x08065743 in hostinfo (hostname=0x0) at loadhosts.c:438 #9 0x0805834e in main (argc=9, argv=0x1) at xymond.c:5127 ________________________________ This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

2 1

fping error code 4 [Resolved]
by everett.vernon＠gmail.com 17 Jan '13

17 Jan '13

Hi all Well, it's been 48 hours now, without an incident. Seems that not all fpings are created equal. I did install the OpenCSW fping when I installed Xymon. The the install script defaults to using the last instance of fping it finds, and looks for the OpenCSW fping last. >From build/fping.sh echo "Checking for fping ..." for DIR in / /usr /usr/local /opt /usr/pkg /opt/csw do if test "$DIR" = "/"; then DIR=""; fi if test -x $DIR/bin/fping then FPING=$DIR/bin/fping elif test -x $DIR/sbin/fping then FPING=$DIR/sbin/fping fi done I would have expected this to default to the OpenCSW version of fping. So what went wrong? My recollection of the install is poor, but It is possible that I ran the configure script as Xymon user, and had only set the suid bit on /usr/local/sbin/fping, meaning that test -x $DIR/bin/fping would have failed for the OpenCSW version, defaulting to the fping in /usr/local. Of course, the script would have reported no errors, because it would have met all requirements. An executable fping. *Solution *: Make sure that Xymon is using the OpenCSW fping, as defined by the FPING= variable in ~/server/etc/xymonserver.cfg *Prevention 1 *: When running configure at install time, use the --fping option to explicitly define which fping to use. *Prevention 2* : Make sure you set the suid bit on ALL instances of fping. Regards Vernon On 15 January 2013 08:27, Vernon Everett <everett.vernon at gmail.com> wrote: > Hi all > > "TIME SPENT" is showing the odd spike now and then, but the highest I have > seen is 9.8 seconds. > And these peaks do not coincide with the fping issues. > > I did a little more research, and discovered 2 instances of fping. > # /opt/csw/sbin/fping -v > /opt/csw/sbin/fping: Version 2.4b2_to $Date: 2002/01/16 00:33:42 $ > /opt/csw/sbin/fping: comments to david at remote.net > > # /usr/local/sbin/fping -v > /usr/local/sbin/fping: Version 3.0 > /usr/local/sbin/fping: comments to david at schweikert.ch > > /opt/csw/sbin/fping is the one I installed recently using OpenCSW's > pkgutil, but the Xymon config was pointing to /usr/local/sbin/fping > I have switched the FPING= definition in ~/server/etc/xymonserver.cfg to > point to the OpenCSW version. > Let's see if this improves matters. > > Regards > Vernon > > > > > On 11 January 2013 08:16, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote: > >> I think the key here is the "select". To me, this suggests that the >> select() system call (which is used to read data on STDIN from xymonnet) is >> trying to get data from a closed socket, or a similar problem. I wonder if >> fping, which is run from xymonnet, is sometimes taking so long to run, and >> eventually xymonlaunch is killing xymonnet. >> >> By default, xymonlaunch (in tasks.cfg) kills xymonnet after 5 minutes, >> but xymonnetagain is killed off after only 1 minute. So if you have a lot >> of hosts that are uncontactable, or have long ping times, then this might >> add up to a minute. >> >> To confirm this, check out the "xymonnet" dot on your Xymon server, and >> look at the "TIME SPENT" table for ping test duration. >> >> J >> >> >> >> On 10 January 2013 17:12, Vernon Everett <everett.vernon at gmail.com>wrote: >> >>> Hi all >>> >>> Anybody seen something like this? >>> >>> Execution of '/usr/local/sbin/fping -Ae' failed with error-code 4 >>> >>> >>> >>> /usr/local/sbin/fping: select : Invalid argument >>> >>> Error I see when xymonnet page goes red. >>> At the same time, all conn tests go white. >>> Happens briefly every few hours. No obvious pattern, but at least once a >>> day, sometimes twice. >>> >>> This is a new installation of Xymon 4.3.10, on a relatively old Solaris >>> 10 Sparc server. >>> >>> Regards >>> Vernon >>> >>> -- >>> "Accept the challenges so that you can feel the exhilaration of victory" >>> - General George Patton >>> >>> _______________________________________________ >>> Xymon mailing list >>> Xymon at xymon.com >>> http://lists.xymon.com/mailman/listinfo/xymon >>> >>> >> > > > -- > "Accept the challenges so that you can feel the exhilaration of victory" > - General George Patton > -- "Accept the challenges so that you can feel the exhilaration of victory" - General George Patton

1 0

wildcard /regex for PROC in analysis.cfg file?
by Paul.Root＠CenturyLink.com 16 Jan '13

16 Jan '13

Can I do something like: HOST=foo PROC "/path/to/perl .* MyPerlScript.pl" 1 1 red ? Basically, I've got a command run by a custom version of perl, and the command line has a bunch of -I arguments put in by the wrapper of the software packages. I can't not have them, it's the way the vendor built the system. But I also don't want to get a red alarm if someone is grep/vi/more/lessing the file. Or is there another way? Paul.

1 1