- Xymon - Xymon mailman web

Alerting - I'm not doing it right...
by Carl.Inglis＠rakon.com 15 Dec '11

15 Dec '11

Hi folks, I'm sure this is going to be something really silly that I've missed - but I've been pulling my hair out over this one for a couple of days now. alerts.cfg $EMAIL_ALERT=carl.inglis at rakon.com $LIN_WINDOWS_PROBLEMS=$EMAIL_ALERT HOST=%lin(.*) SERVICE=%win(.*) MAIL $LIN_WINDOWS_PROBLEMS REPEAT=24h DURATION>1d RECOVERED STOP HOST=* EXPAGE=printers MAIL $EMAIL_ALERT REPEAT=1h RECOVERED UNMATCHED STOP When the host "lin-apps-01" has a yellow alert on it's "winUpdates" services, I expect it to shout about it once every 24h. It is, however, shouting about it once every hour. It's clear that the first HOST line is being ignored - I suspect my regex is incorrect in some way. Any thoughts or pointers would be appreciated. Regards, Carl [Rakon Logo] Carl Inglis Systems Administrator Rakon UK Limited Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 (0)1522 812630 | Fax:+44 (0) 1522 812664 | Mob: +44 (0) 7786 552915 Carl.Inglis at rakon.com | www.rakon.com [Winner of the NZ Hi-Tech Awards 2011 - Hi-Tech Company of the Decade] Winner of the 2010 Lincolnshire Business of the Year Award This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments. Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090. Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content.

3 3

alerts
by Nelandran.Moodley＠standardbank.co.za 15 Dec '11

15 Dec '11

Hi I've configured a test alert as per xymon sample alert. HOST=jones MAIL nelan1 at ananzi.co.za SERVICE=http REPEAT=1h MAIL nelan1 at ananzi.co.za SERVICE=cpu,disk,memory When I run the test I get the following error in bold: ./bin/xymoncmd xymond_alert --test jones disk 2011-12-15 08:35:14 Using default environment file /export/home/xymon/server/etc/xymonserver.cfg 00001236 2011-12-15 08:35:14 send_alert jones:disk state Paging 00001236 2011-12-15 08:35:14 Matching host:service:dgroup:page 'jones:disk:NONE:' against rule line 119 00001236 2011-12-15 08:35:14 *** Match with 'HOST=jones' *** 00001236 2011-12-15 08:35:14 Matching host:service:dgroup:page 'jones:disk:NONE:' against rule line 120 00001236 2011-12-15 08:35:14 Failed 'MAIL nelan1 at ananzi.co.za SERVICE=http REPEAT=1h' (service not in include list) 00001236 2011-12-15 08:35:14 Matching host:service:dgroup:page 'jones:disk:NONE:' against rule line 121 00001236 2011-12-15 08:35:14 *** Match with 'MAIL nelan1 at ananzi.co.za SERVICE=cpu,disk,memory' *** 00001236 2011-12-15 08:35:14 Mail alert with command 'mailx -s "Xymon [12345] jones:disk CRITICAL (RED)" nelan1 at ananzi.co.za<mailto:nelan1 at ananzi.co.za>' What include list is the error referring to? Thanks Nelandran Moodley | Unix Systems Engineer | Group Technology Infrastructure | Standard Bank of South Africa | 44 Borrowdale Road | RiverClub | Sandton | RSA [cid:image001.png at 01CCBB0B.DA2E3F00] nelandran.moodley at standardbank.co.za<mailto:Bongane.mabasa at standardbank.co.za> Office: +27 11 700 1542 Mobile: +27 82 7792059 Standard Bank email disclaimer and confidentiality note Please go to http://www.standardbank.co.za/site/homepage/emaildisclaimer.html to read our email disclaimer and confidentiality note. Kindly email disclaimer at standardbank.co.za (no content or subject line necessary) if you cannot view that page and we will email our email disclaimer and confidentiality note to you.

2 1

Alerting - I'm not doing it right...
by Carl.Inglis＠rakon.com 15 Dec '11

15 Dec '11

Hi, You may have a point on the delay criteria. I'll try taking that out. Thanks! Carl [Rakon Logo] Carl Inglis Systems Administrator Rakon UK Limited Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 (0)1522 812630 | Fax:+44 (0) 1522 812664 | Mob: +44 (0) 7786 552915 Carl.Inglis at rakon.com | www.rakon.com Winner of the 2010 Lincolnshire Business of the Year Award This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments. From: Johan Sjöberg [mailto:Johan.Sjoberg at deltamanagement.se] Sent: 15 December 2011 11:15 To: Carl Inglis Subject: RE: Alerting - I'm not doing it right... Hi. Maybe it doesn't count as received if the delay of the first line hasn't been exceeded yet? I have to admit I haven't even seen this UNMATCHED feature before, so I thought all matching lines would generate an alert. /Johan From: Carl Inglis [mailto:Carl.Inglis at rakon.com] Sent: den 15 december 2011 12:12 To: Johan Sjöberg Subject: RE: Alerting - I'm not doing it right... Hi Johan, The relevant section of the Info page looks like this: winUpdates carl.inglis at rakon.com<mailto:carl.inglis at rakon.com> (R,S) 1d - 1d - purple,yellow,red carl.inglis at rakon.com<mailto:carl.inglis at rakon.com> (R,S,U) - - 1h - purple,yellow,red It would seem that I have misunderstood the UNMATCHED entry then. The man page says "The alert is sent to this recipient ONLY if no other recipients received an alert for this event. " I thought that it meant that for any given pass through alerts.cfg ("this event") the UNMATCHED recipient would only be emailed if the event hadn't triggered any other recipient. Regards, Carl From: xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com> [mailto:xymon-bounces at xymon.com]<mailto:[mailto:xymon-bounces at xymon.com]> On Behalf Of Johan Sjöberg Sent: 15 December 2011 10:31 To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: Re: [Xymon] Alerting - I'm not doing it right... Hi. How does it look in the "Info" page for that server? Both alert lines would match that server, thus giving you an alert every hour, with an extra e-mail once per day, after a day, unless the server is in the printers page. If you don't want the second alert line to match that server/test, you need to exclude it. /Johan From: xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com> [mailto:xymon-bounces at xymon.com] On Behalf Of Carl Inglis Sent: den 15 december 2011 11:03 To: xymon at xymon.com<mailto:xymon at xymon.com> Subject: [Xymon] Alerting - I'm not doing it right... Hi folks, I'm sure this is going to be something really silly that I've missed - but I've been pulling my hair out over this one for a couple of days now. alerts.cfg $EMAIL_ALERT=carl.inglis at rakon.com<mailto:$EMAIL_ALERT=carl.inglis at rakon.com> $LIN_WINDOWS_PROBLEMS=$EMAIL_ALERT HOST=%lin(.*) SERVICE=%win(.*) MAIL $LIN_WINDOWS_PROBLEMS REPEAT=24h DURATION>1d RECOVERED STOP HOST=* EXPAGE=printers MAIL $EMAIL_ALERT REPEAT=1h RECOVERED UNMATCHED STOP When the host "lin-apps-01" has a yellow alert on it's "winUpdates" services, I expect it to shout about it once every 24h. It is, however, shouting about it once every hour. It's clear that the first HOST line is being ignored - I suspect my regex is incorrect in some way. Any thoughts or pointers would be appreciated. Regards, Carl [Winner of the NZ Hi-Tech Awards 2011 - Hi-Tech Company of the Decade] Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090. Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content.

1 0

RFE: Oracle tests
by colin.coe＠gmail.com 14 Dec '11

14 Dec '11

Hi Henrik Would it be possible to move the Oracle tests into Xymon instead of it being an addon? This would save people from having to look around for the oracle tests and wonder if it is: (a) trustworthy and (b) the latest version. I know there is currently a tnslistener test, just hoping for a bit more. TIA CC -- RHCE#805007969328369

1 0

Current Critical Systems
by mogabr＠hotmail.com 14 Dec '11

14 Dec '11

Hello i need help from all xymon experts how i can make Current Critical Systems acknowledge alerts stored to file or directory ? i want keep this data in flat file to import after that into db table please note i am asking about acknowledge alerts from Current Critical Systems page NOT normal acks alerts please help regards

1 0

delayred and delayyellow do not appear in info page
by spah＠syntec.co.uk 14 Dec '11

14 Dec '11

delayred and delayyellow do not appear in the info column status page (svcstatus.sh?HOST=<hostname>&SERVICE=info). I would expect them to appear perhaps under Other tags, or perhaps at the top of alerting before the table of alerts. This is on 4.3.7. 192.168.4.56 Db1 # delayred=special:10 delayyellow=special:5 Or does delayred and delayyellow not apply to custom tests? (If so, the docs do not mention this.) Kind regards, SebA

2 1

DISPLAYGROUP on alert.cfg
by jchen.nygh＠gmail.com 14 Dec '11

14 Dec '11

Thanks Henrik. Yes I meant "Not functioning". In my hosts.cfg, I have spaces on the group description, i.e.: group group 1 In alert.cfg, it works if I use: DISPLAYGROUP=%group.1 However, it fails if I use: DISPLAYGROUP="group 1" What is the best way to put a string (with space in it) in DISPLAYGROUP? John Chen ========= On 14-12-2011 17:02, John Chen wrote: >* I am using xmon-4.3.7 and xymon-4.3.5.*>* It seems the DISPLAYGROUP on alter.cfg is now functioning.* Assume you meant "NOT functioning" ... >* Can somebody share some examples for using "DISPLAYGROUP" on alert.cfg?* See www.xymon.com, the "External sites" page and "www.sslug.dk": http://www.xymon.com/xymon-cgi/svcstatus.sh?HOST=www.sslug.dk&SERVICE=info You can see the alert.cfg file on http://www.xymon.com/xymon-cgi/viewconf.sh?alert Regards, Henrik

2 1

uninstall Xymon
by Nelandran.Moodley＠standardbank.co.za 14 Dec '11

14 Dec '11

Hi How do I uninstall Xymon. Newbie Thanks Nelandran Moodley | Unix Systems Engineer | Group Technology Infrastructure | Standard Bank of South Africa | 44 Borrowdale Road | RiverClub | Sandton | RSA [cid:image001.png at 01CCBA4F.5132D3D0] nelandran.moodley at standardbank.co.za<mailto:Bongane.mabasa at standardbank.co.za> Office: +27 11 700 1542 Mobile: +27 82 7792059 Standard Bank email disclaimer and confidentiality note Please go to http://www.standardbank.co.za/site/homepage/emaildisclaimer.html to read our email disclaimer and confidentiality note. Kindly email disclaimer at standardbank.co.za (no content or subject line necessary) if you cannot view that page and we will email our email disclaimer and confidentiality note to you.

4 4

DISPLAYGROUP on alert.cfg
by jchen.nygh＠gmail.com 14 Dec '11

14 Dec '11

Hi All, I am using xmon-4.3.7 and xymon-4.3.5. It seems the DISPLAYGROUP on alter.cfg is now functioning. I have hosts.cfg as: ---------------------- page page1 page1-desc group group 1 xxx.xxx.xxx.xxx host1 # tests xxx.xxx.xxx.xxx host2 # tests group group 2 .... --------------------- And in "alert.cfg" I have: ----------------------- DISPLAYGROUP="group 1" COLOR=red RECOVERED MAIL alert at mail.local DURATION>5m REPEAT=24h ----------------------- Restart/Relod the xymon daemon, and then check the "info" on host1 and host2, I got: Alerting: No alerts defined Can somebody share some examples for using "DISPLAYGROUP" on alert.cfg? Thanks, John Chen =========

2 1

Xymon 4.3.7 released
by henrik＠hswn.dk 14 Dec '11

14 Dec '11

Hi, after a week of intensive bug-hunting - thanks to everyone who chimed in with new reports! - I have released Xymon 4.3.7. This simply has fixes for all the bugs found in the past week and reported on the mailing list: * Fix acknowledge CGI (broken in 4.3.6) * Fix broken uptime calculation for systems reporting "1 day" * Workaround Solaris breakage in the LFS-support detection * Fix/add links to the HTML man-page index. * Fix "Stop after" value not being shown on the "info" page. * Fix broken alert texts when using FORMAT=SMS * Fix wrong description of xymondboard CRITERIA in xymon(1) * Fix missing columnname in analysis.cfg(5) DS example * Fix missing space in output from disk IGNORE rules in xymond_client --dump-config * Fix overwrite of xymon-apache.conf when upgrading * Fix installation so it does not remove include/directory lines from configuration files. * Add client/local/ directory for custom client script It is available from the Sourceforge mirrors now. I have also uploaded a VMware image with a pre-installed Debian 6 plus Xymon 4.3.7. Regards, Henrik

4 3