- Xymon - Xymon mailman web

ping.jsp is empty, Xymon considers this an error
by nleskiw＠gmail.com 31 Jan '12

31 Jan '12

The applications we're testing use an empty ping.jsp page. Xymon considers no content an error. I tried setting httpstatus;URL;0|2..;3..|4..|5..|999 but that hasn't worked. (Other than adding text to the ping.jsp page) can anyone make any recommendations on how to avoid this and still test the URL? -Nick

3 2

Is there a way to do trend analysis or prediction or anomaly detection with Xymon?
by jddcef＠gmail.com 31 Jan '12

31 Jan '12

Hi there, Is there a plugin or feature of xymon that anyone knows of that allows one to do anomaly detection on the graph data? i.e. if there is nonstandard behavior on the graph that stands out, and you want it to be investigated. Kind regards, David

3 2

[xymon] log parsing on windows
by massimiliano.angei＠akhela.com 27 Jan '12

27 Jan '12

Hi all, Is it possible to monitor log files (not event viewer) under windows machines? For example *.log files containing particular patterns (error strings…) I'm trying Bbwin client but using central mode I'm only capable to parse event log. Maybe someone has an external that affords this feature… thanks in advance! Massimiliano A.

3 2

[XYMON] New sever with Solaris or Linux
by gbegin＠csc.com 27 Jan '12

27 Jan '12

Hello, I'm planning to install a new XYMON server and have to decide which OS to use. I can install Solaris or Linux (RedHat, Suse). What are the pro and con according to you? I'm planning to use about 3 xymonproxies and at least 1000 clients (potentially up to 6000). What about using SAN disks ? Cordialement, Regards,Mit freundlichen Grüßen, Gautier BEGIN Admin and Tools Team CSC Computer Sciences Luxembourg S.A. 12D Impasse Drosbach L-1882 Luxembourg Global Outsourcing Service | p:+352 24 834 276 | m:+352 621 229 172 | gbegin at csc.com | www.csc.com CSC • This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose • CSC Computer Sciences SAS • Registered Office: Immeuble Le Balzac, 10 Place des Vosges, 92072 Paris La Défense Cedex, France • Registered in France: RCS Nanterre B 315 268 664

5 6

Remove An Alert for a Specific Server
by Ed.Stuart＠austinenergy.com 26 Jan '12

26 Jan '12

Hello; we are running Xymon 4.2.0. We have a number of our alerts and triggers set up on a page basis. How can we disable the alert for one category for server on a page without disabling it for all the servers defined on that page? For example, if all the servers were defined to be on page Example and we had a trigger that for all servers on page Example where we are montoring the existence of an ntp process how could we disable the monitor for the ntp process for just one server on that page? Ed There's no place like 127.0.0.1

2 1

Can I monitor how many connections are in TIME_WAIT for a specific port
by Paul.Root＠CenturyLink.com 25 Jan '12

25 Jan '12

Hi, We are monitoring a particular port that we are having issues with. 8022, it's a proxy port for HP NA. Anyway, I have an expect script that goes in and tests the functionality of the port. But when it starts to go bad, this script get stuck in TIME_WAIT, along with the users connecting to the port. So, can I look at the port data before I try connecting, and if there are a bunch of TIME_WAIT connections, just skip the test entirely? I'm running the test from the xymon server, so I was thinking of pulling the data out of xymon directly. Would that by xymoncmd? Thanks, Paul. Paul Root - Engineer III Managed Services Systems - CenturyLink This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

4 8

Log message "Data flooding from"
by hj.beckers＠kreis-steinfurt.de 25 Jan '12

25 Jan '12

What does the above message mean? The client sends oversized packages as well: xymond.log:2012-01-25 08:15:36 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:20:45 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:25:53 Oversize stachg msg from xymond for myclient:msgs truncated (n=523042, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize page/ack/notify msg from xymond for myclient:msgs truncated (n=523073, limit=262144) xymond.log:2012-01-25 08:25:53 Oversize status msg from xymond for myclient:msgs truncated (n=523071, limit=262144) xymond.log:2012-01-25 08:25:54 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:31:03 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:36:13 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:41:22 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:46:33 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 xymond.log:2012-01-25 08:51:42 Data flooding from 1.2.3.4 - 1st line client myclient.bbwin win32 My xymonserver.cfg contains: MASXMSG_STATUS="5000000" MASXMSG_CLIENT="5000000" MASXMSG_DATA="5000000" The status line for the client shows all entries besides "conn" as purple. Any suggestions? Hermann-Josef Beckers

2 2

Problem with TIME qualifier to PORT test
by jlaidman＠rebel-it.com.au 24 Jan '12

24 Jan '12

Oh wise people of the Xymon clan I occasionally have logrotate spawn a post-rotate process that hangs and needs to be manually killed. This is easily detected because the parent process also persists as "/bin/sh /etc/cron.daily/logrotate". I want to detect when logrotate has been running for more than an hour, and as it starts at 1am, I added the following line into my hosts' analysis.cfg file: PROC "%^/bin/sh /etc/cron.daily/logrotate" 0 0 "TEXT=/etc/cron.daily/logrotate" TIME=*:0200:0100 My understanding is that this makes the rule apply only between 2am and 1am, or in other words, forces "green" between 1am and 2am. I added this line yesterday. Alas, 2 out of 6 hosts showed a red "procs" alert at around 10 seconds after 1am (when logrotate runs), for 5 minutes. So it failed for me. Curiously, two servers that have an ongoing problem with a hung logrotate process (which inspired the check I'm trying to implement) showed green for the hour from 1am to 2am, then went back to red. So this indicates that the time qualifier is being handled correctly by those servers. I can't figure out why it went red for the other servers that don't have a hung logrotate process. Any ideas? Perhaps this is due to time lag between the client data delivery and the analysis. I wonder if I should change the timespec to "TIME=*:0200:0055"? Cheers Jeremy

1 0

Configure custom msgs "history" for individual host
by Johan.Sjoberg＠deltamanagement.se 24 Jan '12

24 Jan '12

Hi. By default, the msgs test checks 30 minutes log history. Is it possible to override this for a specific host? /Johan

2 1

NOPROPYELLOW:disk
by Neil.Simmonds＠express-gifts.co.uk 24 Jan '12

24 Jan '12

On our AIX servers we have NOPROPYELLOW:disk in the hosts.cfg however we have now realised that for 1 particular filesystem we do want the yellow to propagate. Is there any way to do this? Thanks, Neil Simmonds Operation Analyst (Operations Support Group) Express Gifts Limited Express House Clayton Business Park Accrington Lancashire BB5 5JY T: 01254 303092 | E: neil.simmonds at Express-Gifts.co.uk Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151. Express Gifts Limited is authorised and regulated by the Financial Services Authority -------------- NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

2 1