- Xymon - Xymon mailman web

Xymon Digest, Vol 23, Issue 13
by s.watkins＠nhm.ac.uk 14 Dec '12

14 Dec '12

> Message: 1 > Date: Thu, 13 Dec 2012 14:58:06 +0000 > From: K?rfer, Thomas <t.koerfer at gevasys.de> > To: 'Claessens Jurgen' <Jurgen.Claessens at cegeka.be>, > "'xymon at xymon.com'" <xymon at xymon.com> > Subject: Re: [Xymon] multiple content checks in one column > Message-ID: > <6CFF4C170D04D1449B04463D52476E0E794E46 at exchange2010.gevas > ys.intern> > Content-Type: text/plain; charset="iso-8859-1" > > The combo test is not realy what I need. > My problem is, that there are round about 20 content tests on one service > and up to 5 services on one host, what results in an output of 100 columns for > tests of this one host. > The host page looks realy strange with a host of hundreds of columns. > > That's why I would like to combine the service based content tests to one > group / column with an output like a multiple http test - if this is possible. > > b.r. > TK Sorry if I haven't picked up on all the details here, I haven't had the time to keep track of what's happening on list all that closely. The interactives dept here have a requirement to check multiple independent local web resources but they want it all to be under one test, with one set of warnings. They want the actual webpages/resources to be tested rather than a blanket "is the webserver up?" type test. The end result is a script that picks up the list of URLs to test and then runs a HTTP::Request (from the Perl module) to determine whether the actual URI is valid and available. It collates all the individual results into an array and as each result comes in, it is checked to see if it is an alert state or not. If it is an alert state, then a status global is set to 'RED'. This output is collected together and wrapped up in HTML. The first line of output gives the status global which is what the server picks up on to determine whether the test is red/green. At the end of the tests, the script then calls the server/bin/bb binary with the details of the Xymon server and dumps the prettified test output to the server. This is held on the server and included in the test's page on Hobbit. The following is the format/output section of the script (forgive the kludgeyness of it, it's meant to be more functional than pretty): ------- @TestResults = (); $MainResult='GREEN'; # Go through the list of URLs, one at a time, putting the chosen URL into $wpage foreach $wpage (@pages) { ... put the various webserver/remote system tests and checks in here # If the result is a '200 OK' or a '302 Found' then the webpage is 'present' if (($results =~ /200/) || ($results =~ /302/)) { $Outline="&green $wpage Success\r\n"; push(@TestResults,$Outline); } # If result != [200|302] then unhappy webpage! :( else { $Outline="&red $wpage Fail[$results]\r\n"; push(@TestResults,$Outline); $MainResult='RED'; } } # At this point we have an array @TestResults containing all the results of # the webpage checks. We now need to pass that info up to the xymon system # Get the current date/time $testdate=`date`; chomp($testdate); # Now format the report line that goes back to the xymon system. $LineOut="'status webcheck.webcheck $MainResult $testdate - webcheck $MainResult\n\n"; # Add the results of the webpage tests foreach $Line1 (@TestResults) { $LineOut = $LineOut . $Line1."\n"; } # Now make up the commandline and execute it $Args=("/usr/local/hobbit/server/bin/bb $XymonServerIPAddr "."$LineOut"); system($Args); ------- It's not elegant but it is functional. It's installed on and is driven by the xymon server which causes the results pages to properly map into each other. So basically you're running your own tests, collecting and formatting the output of which the first line is the important "status handshake" with the Xymon server and then using Xymon's own utilities (server/bin/bb) to transfer that output back to the server. By doing this I currently have about 40 individual webpages and resources being checked but only one status (webcheck.webcheck) and one Xymon page gets changed. Apologies if I've not understood your request correctly. You're welcome to use part or all of the code above in your own projects if you choose. Regards, Steff Watkins ----- Steff Watkins Natural History Museum, Cromwell Road, London,SW75BD Systems programmer Email: s.watkins at nhm.ac.uk Systems Team Phone: +44 (0)20 7942 6000 opt 2 ======== "Many were increasingly of the opinion that they'd all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans." - HHGTTG

1 0

Possible bug - bogus pages occasionally on "UNMATCHED"
by betsy.schwartz＠gmail.com 14 Dec '12

14 Dec '12

I think I'm getting bogus, occasional pages from an UNMATCHED rule that should not be matching. (xymon 4.3.10) I set up a default UNMATCHED rule as the last rule in alerts.cfg: (just recently added the DURATION) HOST=* SERVICE=* SCRIPT /usr/local/scripts/mailunmatched betsy UNMATCHED DURATION>10 FORMAT=TEXT However, painfully, I am getting pages *occasionally* and incorrectly. They all seem to be coming from this rule set: HOST=* EXHOST=%($NOPAGE|$VIP) SERVICE=$TECHOPS_TESTS include techops.escalation.cfg where techops.escalation.cfg is MAIL techopsmail repeat=8h COLOR=yellow FORMAT=TEXT MAIL techopsmail repeat=5m COLOR=red FORMAT=TEXT MAIL alert1 REPEAT=10 COLOR=red FORMAT=SMS MAIL alert2 DURATION>20 REPEAT=10 COLOR=red FORMAT=SMS MAIL alert3 DURATION>40 REPEAT=10 COLOR=red FORMAT=SMS MAIL alert4 DURATION>60 REPEAT=10 COLOR=red FORMAT=SMS MAIL alert5 DURATION>80 REPEAT=10 COLOR=red FORMAT=SMS It's only happening *occasionally*. When I test the rules, ie /usr/local/xymon/server/bin/xymond_alert --test bm1-08.example.com disk --color=yellow they don't hit the unmatched rule. For example, today, bm1-08 which hits the above rules has had a busy disk day: Thu Dec 13 20:22:25 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 15:50:00 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 13:48:54 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 13:28:44 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 13:13:45 2012 bm1-08.example.com disk red From -> To yellow Thu Dec 13 12:58:45 2012 bm1-08.example.com disk yellow From -> To red Thu Dec 13 12:48:44 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 10:28:11 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 10:18:06 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 09:57:54 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 09:42:46 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 08:22:12 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 07:36:56 2012 bm1-08.example.com disk green From -> To yellow Thu Dec 13 05:41:37 2012 bm1-08.example.com disk yellow From -> To green Thu Dec 13 05:21:35 2012 bm1-08.example.com disk green From -> To yellow and I was paged, erroneously, **ONCE** Thu Dec 13 05:22:36 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355394156 100 Thu Dec 13 07:37:23 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355402243 100 Thu Dec 13 09:42:46 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355409766 100 Thu Dec 13 10:18:35 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355411915 100 Thu Dec 13 12:48:44 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355420924 100 Thu Dec 13 12:58:45 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[253] 1355421525 100 Thu Dec 13 12:58:45 2012 bm1-08.example.com.disk (10.101.251.108) alert1[254] 1355421525 100 Thu Dec 13 13:03:45 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[253] 1355421825 100 Thu Dec 13 13:48:55 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355424534 100 Thu Dec 13 20:22:25 2012 bm1-08.example.com.disk (10.101.251.108) techopsmail[252] 1355448145 100 Thu Dec 13 20:32:32 2012 bm1-08.example.com.disk (10.101.251.108) betsy 1355448752 100 This feels like a bug. Anyone else experiencing anything like this? Or am I doing something wrong?

1 0

multiple content checks in one column
by t.koerfer＠gevasys.de 14 Dec '12

14 Dec '12

Is it possible to get multiple content checks in one column? Background: - I have a IIS-Webserver with some DOT.NET WebServices - Each WebService has multiple test I want to check Example: cont=Service1;http://webserver/Service1/test1;true cont=Service1;http://webserver/Service1/test2;true cont=Service1;http://webserver/Service1/test3;true cont=Service2;http://webserver/Service2/test1;true cont=Service2;http://webserver/Service2/test2;true cont=Service2;http://webserver/Service2/test3;true If I only define the content checks, I got 6 columns but I want a combination for each Service (like in the HTTP test). My example above does not work because only one test was shown on the side... Any Suggestions? Google finds the same problem since 2006 but there seems to be no solution?!? b.r. TK

3 3

Xymon HTTP 404 not found - Please help
by ashwingrwl＠gmail.com 13 Dec '12

13 Dec '12

Hi, We installed xymon on Linux box. And when we launch the url http://servername/xymon we are getting message " HTTP 404 not found". When we run http://servername/ it is working but http://servername/xymon is not working. Could someone please help what could be the issue and how we need to fix it. Thanks for your time and help. Best Regards, Ashwin.

2 1

Simple Network Tests not displaying
by Michael.Beatty＠sherwin.com 13 Dec '12

13 Dec '12

I'm not getting any data about my clients on any simple network tests, such as, ssh, telnet, etc. The only column that is showing up that is listed in the hosts.cfg man page is "bbd" I'm using the default protocols.cfg and tasks.cfg. xymonnet.log file is small, doesn't have any data in it since June. The xymonnet column for my server is showing data and statistics. Any help would be appreciated. -- Michael Beatty

2 3

Xymon 4.3.10 and "multi-source status" errors
by novosirj＠umdnj.edu 13 Dec '12

13 Dec '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My xymond test is often yellow, and near as I can tell, the reason is often that I have so-called "multi-source statuses." However, the "second" source is the Xymon server, and this appears to happen most often when tests are disabled (as the blue status comes from the Xymon server). Should I be ignoring this? Is there a misconfiguration somewhere that has this server not properly identifying messages from itself? Thanks for your help. - -- - ---- _ _ _ _ ___ _ _ _ |Y#| | | |\/| | \ |\ | | |Ryan Novosielski - Sr. Systems Programmer |$&| |__| | | |__/ | \| _| |novosirj at umdnj.edu - 973/972.0922 (2-0922) \__/ Univ. of Med. and Dent.|IST/EI-Academic Svcs. - ADMC 450, Newark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iEYEARECAAYFAlDHc6YACgkQmb+gadEcsb6IRACfTH2APBg6vkSYdAd2FPfMKmUJ aygAoL6HVCab1U2X+eIb/GSNYqZNcmCN =754I -----END PGP SIGNATURE-----

3 4

Alerts based on rrd graphs
by kc6ovd＠gmail.com 13 Dec '12

13 Dec '12

Anyone doing any alerting on graphed rrd data? Just looking for some sample of what you might be doing. -Kevin

2 1

Technical questions regarding message flow
by Michael.Beatty＠sherwin.com 13 Dec '12

13 Dec '12

I have some technical questions in regard to how the actual message flow between server / clients take place. The first questions relate to network traffic. My intent is to monitor a large number of clients (getting close to 9,000) so this is going to be a question I need to fully understand before I go too far. What does the message look like and how big is it (excluding message text) ? Is it XML? How is the connection made between the client and host? Are sockets made? How does the server handle large volumes of connections. One thing I have read is that any bottle necks will be more likely with disk I/O than network traffic, is this fair? Secondly, what is the process of message flow between client and server? I understand how the xymonclient is configured to run at a defined interval (configured in clientlaunch.cfg), it gathers data from its logs and sends the data to the server. The server saves this in its /data/hist path along with any rrd data. The server uses this data to display its web pages. The next part I'm not sure I understand correctly.... The sever then sends a response to the client that contains data that instructs the client what information it wants next time (this is taken from hosts.cfg?) The client then uses this response to determine which information to collect and send the next time the client is launched. So, aside from the server's ping test, all traffic is initiated by the client? Thank you for any help. -- Michael Beatty

2 1

Connecting the "history" file dots...
by David.Mills＠ngc.com 12 Dec '12

12 Dec '12

Hi, All! In poking around my data directory, I see a listing like this for the "cpu" test data for one of my hosts: $ ls -rt /export/xymon/data/histlogs/pwmu002/cpu/ total 61 drwxr-xr-x 22 hobbit monitor 22 Dec 30 2010 ../ -rw-r--r-- 1 hobbit monitor 1.9K Feb 17 2012 Fri_Feb_17_00:30:59_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 17 2012 Fri_Feb_17_01:51:10_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 25 2012 Sat_Feb_25_09:41:40_2012 -rw-r--r-- 1 hobbit monitor 1.9K Feb 25 2012 Sat_Feb_25_12:52:12_2012 -rw-r--r-- 1 hobbit monitor 1.9K Jun 24 10:21 Sun_Jun_24_10:21:19_2012 -rw-r--r-- 1 hobbit monitor 1.8K Jun 24 11:19 Sun_Jun_24_11:19:10_2012 -rw-r--r-- 1 hobbit monitor 1.8K Jun 24 11:54 Sun_Jun_24_11:54:21_2012 -rw-r--r-- 1 hobbit monitor 1.9K Nov 5 12:41 Mon_Nov_5_12:40:58_2012 -rw-r--r-- 1 hobbit monitor 1.9K Nov 5 13:30 Mon_Nov_5_13:30:54_2012 -rw-r--r-- 1 hobbit monitor 1.9K Dec 2 13:37 Sun_Dec_2_13:37:24_2012 -rw-r--r-- 1 hobbit monitor 1.9K Dec 2 14:07 Sun_Dec_2_14:07:31_2012 Each of these files is some sort of snapshot of the data displayed when you click on the "cpu" icon for the indicated host in Xymon. Why then, is the most recent data file a couple weeks old but the data displayed for the "cpu" icon is current on the screen? Thanks! david ~~~~~~~~~~~~~~~~~~~ David Mills Systems Administrator Northrop Grumman 512-595-1238 david.mills at ngc.com

3 3

Nesting include files hosts.cfg
by Michael.Beatty＠sherwin.com 12 Dec '12

12 Dec '12

It looks like the answer is no, but I'm going to try anyway. I've tested it and it doesn't appear to work, but maybe I'm doing it wrong. I have a large number of hosts to monitor. Is there a way to nest the tags for the hosts into a list of hosts to include into the hosts.cfg file? For Example: If I have a: group-only test1|test2|test3 host1 # test1 test2 test3 host2 # test1 test2 test3 host3 # test1 test2 test3 Is there a way I could do something along the lines of: having a file - tests.dat test1 test2 test3 and including it into a file hosts.dat host1 # include tests.dat host2 # include tests.dat host3 # include tests.dat and then putting in into the hosts.cfg file group-old test1|test2|test3 include hosts.dat Thank you. -- Michael Beatty

2 1