- Xymon - Xymon mailman web

bbd going intermittently red on a busy Xymon system
by arunas.bendikas＠gmail.com 02 May '12

02 May '12

Hi all, I've got a few problems with my busy Xymon system (v4.2.3) on Solaris 10 and any help or ideas would be much appreciated. The bbd monitor intermittently goes red. To investigate it, I've tried getting a response from my proxy port (1984) every second for few hours using netcat. Strangely, noted that Xymon proxy does not respond sometimes for 10-30 seconds to the network probe requests. I assume the Xymon client packets queue up while the proxy doesn't respond and are not lost. BBgen reports we have 750 hosts and 8293 status messages, but the hardware resources are used only at 25% and the network doesn't seem to struggle at all. Also, it reports the average queue time is 0.725. Could anyone tell me more about bbd process, what config changes I can make to stop it going red? If you need more details or config output please let me know. Thanks, Arunas

1 0

Xymond and xymonnet quirks
by poppy.ben＠marshfieldclinic.org 02 May '12

02 May '12

After getting the latest Xymon 4.3.4 finally working on CentOS 6 64-bit, I'm seeing a few quirks that I'd appreciate some input on. First, under Xymonnet tests, it's alerting Yellow because the time spent is too long (over 300). The culprit is DNS tests executed taking over 340 itself.. Can anyone shed some light on this? I know I saw some other threads about putting in a --no-ares but I wanted to see if there was something else I might be missing before I change the functionality of the tests.. Next, under Xymond, I'm getting a ton of multiple statuses reports for CONN tests. I can't seem to find a clear archive of what would cause that other than having both IP's listed when you have 2 display servers.. Both servers reference each other as a client and in xymonserver.cfg.. Thanks for any help, -Ben ______________________________________________________________________ The contents of this message may contain private, protected and/or privileged information. If you received this message in error, you should destroy the e-mail message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained within. Please contact the sender and advise of the erroneous delivery by return e-mail or telephone. Thank you for your cooperation.

4 14

Windows service monitoring
by Neil.Simmonds＠express-gifts.co.uk 01 May '12

01 May '12

Hi all, We are monitoring various Windows services using BBWin 0.12 in central mode reporting to a Xymon 4.3.4 server. In the analysis.cfg file for a number of servers we have the following type of entry, SVC SQLSERVERAGENT status=started startup=automatic As far as I can see from the analysis.cfg help that is exactly the correct format, however when this flags red, we get the following message, SQLSERVERAGENT is started/automatic - want started/automatic When I look down the list of processes SQLSERVERAGENT is clearly shown as stopped, SQLSERVERAGENT automatic stopped SQLSERVERAGENT Does anyone have any idea why the message is incorrect and if there is a way to fix it? Regards, Neil Simmonds Operation Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 2

cipher list in sslcert column
by ralphmitchell＠gmail.com 01 May '12

01 May '12

I was looking at the list of available ciphers in the sslcert column, and I'm wondering exactly what that's showing? Even when the server is running mod_nss with FIPS-140 turned on, the ciphers list still includes 40-bit & 56-bit ciphers, which are definitely not supposed to be available. So, would I be right in thinking that "Available Ciphers" means "Ciphers available on the Xymon server", rather than "Ciphers that the remote system will accept"?? I was hoping that it was showing the list of ciphers the remote server would accept, because that would tie-in with the "sslbits" option specifying a minimum encryption level. As it is, if I set sslbits=256 for my FIPS-140 server, xymon alerts because it thinks the minimum available bits is 40. I'm going to try sslscan (http://sourceforge.net/projects/sslscan/) tomorrow and see what it says. From what I've read this evening, it may be necessary to hit the remote server with a request for every available encryption, and see what it will accept. That's how sslscan does it. So, does anybody know for sure if the cipher list is local to the xymon server, or is it somehow gathered from the remote server?? Ralph Mitchell

3 3

recovered mails with attachment
by daniel＠wolfimnetz.de 30 Apr '12

30 Apr '12

Hi Henrik, yes, the source of the mails is different. The 'good' or plain text mails have: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit and the 'bad' ones have: Content-Type: application/octet-stream Content-Transfer-Encoding: base64 but this happens on the xymon server. I see from /var/log/maillog Apr 30 13:07:40 xymon64 sSMTP[16315]: 354 Start mail input; end with <CRLF>.<CRLF> Apr 30 13:07:40 xymon64 sSMTP[16315]: Received: by xymon64.domain.com (sSMTP sendmail emulation); Mon, 30 Apr 2012 13:07:40 +0200 Apr 30 13:07:40 xymon64 sSMTP[16315]: From: "xymon Monitor" <xymon at xymon64.domain.com> Apr 30 13:07:40 xymon64 sSMTP[16315]: Date: Mon, 30 Apr 2012 13:07:40 +0200 Apr 30 13:07:40 xymon64 sSMTP[16315]: To: daniel at domain.com Apr 30 13:07:40 xymon64 sSMTP[16315]: Subject: Xymon server.domain.com:http recovered Apr 30 13:07:40 xymon64 sSMTP[16315]: User-Agent: Heirloom mailx 12.4 7/29/08 Apr 30 13:07:40 xymon64 sSMTP[16315]: MIME-Version: 1.0 Apr 30 13:07:40 xymon64 sSMTP[16315]: Content-Type: application/octet-stream Apr 30 13:07:40 xymon64 sSMTP[16315]: Content-Transfer-Encoding: base64 KR Daniel

2 1

Host:Service recovered Mail with attachment
by Wolf_Daniel＠gmx.net 30 Apr '12

30 Apr '12

Hi all, I migrated last week from version 4.0.2 (32bit) to 4.3.7 (64bit). Everything was very easy and smooth. But one thing leaves me puzzled. While the 'host:service critical' mails I receive are in plain text, the 'host:service recovered' mails have no text, but an attachment called 'Mail-Attachment' which contains the message. Thx in advance for any hint Daniel -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

2 1

Broken custom graphs on trends page
by jlaidman＠rebel-it.com.au 30 Apr '12

30 Apr '12

Xymonsters I'm looking for a way forward on the "broken multiple graphs" problem that I'm experiencing. Excuse the long post; it's part brainstorming, and part context-setting. For a while there have been some discussion on the list about how custom graphs can get displayed incorrectly as if they're multi-graph when they're not. (I think I'm using the correct term "multi-graph" here.) Xymon works out that there are enough RRD files to fill more than one graph, and shows several graphs, each with a different "first" parameter. For me, in many cases all of the lines fit on one graph, and so the other graphs show as a broken image icon. A work-around seems to be to explicitly show "<!-- linecount=N>" to define how many lines should be expected on a set of graphs. I've done this in my devmon templates to prevent the broken graphs. However, this work-around is only available for custom graphs that create their own status webpage using HTML (in which the "<!-- linecount=N>" tag can be included) and send them to Xymon using a "status" message. I have some collectors that send their data to Xymon using "data" messages, because I don't want to grow my Xymon display too wide, with a bunch of dots that can only ever be green. So my graphs show up in the trends column, which is exactly where I want them. But because I can't add a "linecount" anywhere, I get broken graphs. I really don't think I'm doing anything out of the ordinary here, and certainly not deviating from the documentation. I've scoured doco, mailing list, and even code to find out what can be done to work around this problem. Finally, I've come to the conclusion that the Xymon code is simply unable to work out how many graphs to show in all situations, and its heuristics are not working sometimes. This is the only bit of my Xymon installation that is tarnishing its reputation here, meaning that it doesn't compare favourably with other products, so I'd really like to get this fixed somehow. But I'm not sure what to do about it. If I'm simply doing something wrong, then please let me know, and ignore the rest of this post. So, what am I asking for? There might be a way to get Xymon to work out the graph linecount more universally, perhaps at the expense of more code complexity, compatibility, CPU cycles or disk I/O (I think the some code comments describe an intent to avoid scanning the directory). But even so, I think what I'd like to have is a way of overriding the heuristics other than the "linecount" hack. But what's the best way to do this? I'm willing to cut code to get this fixed, but my effort should be inline with the future of Xymon, as well as having maximal usefulness to others. It also needs to not break the existing heuristics used for the standard graphs (disk, inode, if_load, etc). One idea is that I could add a "LINECOUNT" keyword into the graphs.cfg file, something like this: [bindstats] TITLE DNS Queries and Responses YAXIS per second LINECOUNT 6 ... This would help with both data and status messages that are falling victim to this problem. It also occurs to me that the multi-graph code doesn't seem (to me) to make sense for graph definitions that don't have @RRDIDX@ type indexed filename lookups. So perhaps the simplest thing would be to assume linecount is zero if FNPATTERN is not specified in the corresponding graph definition. Other ideas? Cheers Jeremy

2 4

mounted disk character limitation?
by malcolm.hunter＠gmx.com 28 Apr '12

28 Apr '12

> ----- Original Message ----- > From: Henrik Størner > Sent: 04/28/12 07:16 AM > To: xymon at xymon.com > Subject: Re: [Xymon] mounted disk character limitation? > > On 27-04-2012 20:37, Nordquist, Daniel wrote: > > I have several windows servers that have disk mounts that have no drive > > letter. The disks show up in Xymon with the volume name displayed, but > > anything past 7 characters gets truncated and the hobbit page displays > > duplicate names due the first 7 characters being common across the volumes. > > > > Because of this only one of each of the duplicate (named) disks gets a > > graph and determining which disk is which is a royal pain. > > > > Is there a limitation in Xymon? Where is the volume name getting > > truncated? Is there a setting I can change to allow longer names? > > The Xymon server doesn't have any limitation (Unix filesystems report > the mount point, which is often much longer than 7-8 characters). I > would suspect that this happens on the client side - so what client are > you using ? > > Perhaps the BBWin people can shed some light on this. What version of BBWin? This has been addressed in version 0.13. Regards, Malcolm -- BBWin Development - The Windows client for Big Brother and Xymon http://bbwin.sourceforge.net http://xymon.sourceforge.net

3 2

recovered mails with attachment
by daniel＠wolfimnetz.de 28 Apr '12

28 Apr '12

Hi all, yesterday I started migrating from xymon 4.0.2 to 4.3.7. Everything went easy, except of one thing. Notification mails for service failure / critical I receive as 'normal' mail. Notification mails for service recovered I receive a blank mail, with message in a file called 'Mail-Attachment'. Thx in advance for any hint Daniel

2 1

mounted disk character limitation?
by Daniel.Nordquist＠orlandohealth.com 28 Apr '12

28 Apr '12

Hey all, I have several windows servers that have disk mounts that have no drive letter. The disks show up in Xymon with the volume name displayed, but anything past 7 characters gets truncated and the hobbit page displays duplicate names due the first 7 characters being common across the volumes. Because of this only one of each of the duplicate (named) disks gets a graph and determining which disk is which is a royal pain. Is there a limitation in Xymon? Where is the volume name getting truncated? Is there a setting I can change to allow longer names? Thank you! Dan Nordquist IS Systems Support Orlando Health orlandohealth.com<http://www.orlandohealth.com/> facebook.com/orlandohealth<http://www.facebook.com/orlandohealth> youtube.com/orlandohealth @orlandohealth on twitter 1414 Kuhl Ave., MP 56 Orlando, FL 32806 tel: 321.841.3113 ________________________________ This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited. This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com . If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.

3 2