- Xymon - Xymon mailman web

Help with very large log file - not getting the right lines
by betsy.schwartz＠gmail.com 25 Nov '11

25 Nov '11

I've got to monitor some very large log files. They're up to a couple gigs a day and individual lines can be 30800 characters or more , including HTML. (changing the log file format is a project for another day) So my last half hour of one of these files chosen at random is 21,000 lines, 47G. I want to look at all the lines that start with 2011-11-22 4:15:31 ERROR servicename LotsOfText I want to ignore lines that start 2011-11-22 17:13:39 LOG NNNNN servicename LotsOfHTML Ignoring all of those lines would bring it to a manageable size (this particular file is 41 lines, 23k data) I've been playing around with rules in client-local.cfg like: [mmw2.example.com] log:/var/log/mmb1/MMRequest.log:10240 trigger ERROR ignore LOG but I'm just not getting the ERROR lines in the log. Is this file just too large and too full of HTML to parse? Any suggestions? (we can write a custom script, of course, and I'm thinking of bringing in SEC. But it sure would be handy to be able to do this with out of the box xymon)

4 5

FW: http ping in a script
by wesley.knox＠siemens.com 23 Nov '11

23 Nov '11

This worked like a charm. Thank you kind sir. KISS is always the best solution. Thanks for saving me from my own over-thinking! From: Larry Barber [mailto:lebarber at gmail.com] Sent: Wednesday, November 23, 2011 8:49 AM To: Knox, Wesley Subject: Re: [Xymon] http ping in a script It would likely be easier to substitute 'curl -I' for the ping in your script, then process the output from the curl command. Thanks, Larry Barber On Tue, Nov 22, 2011 at 3:58 PM, Knox, Wesley <wesley.knox at siemens.com<mailto:wesley.knox at siemens.com>> wrote: So I have a script which monitors 3 ip's behind an l2l tunnel and I only get a red face if ALL 3 are unreachable. The script looks like so: #!/bin/sh BBHTAG=VPN # What we put in bb-hosts to trigger this test COLUMN=$BBHTAG # Name of the column, often same as tag in bb-hosts $BBHOME/bin/bbhostgrep $BBHTAG | while read L do set $L # To get one line of output from bbhostgrep HOSTIP="$1" MACHINEDOTS="$2" MACHINE=`echo $2 | $SED -e's/\./,/g'` COLOR=green MSG="$BBHTAG status for host $MACHINEDOTS" #... do the test, perhaps modify COLOR and MSG COLOR=green # By default, everything is OK MSG="All is OK" HOSTS="172.200.129.226 172.34.55.66 172.202.94.226" PINGCNT=3 # number of times to ping STATUS="bad" for host in $HOSTS do ping -c $PINGCNT $host if [[ $? == 0 ]] then STATUS="ok" fi done if [ $STATUS != "ok" ];then COLOR="red" MSG="Tunnel is down" fi $BB $BBDISP "status $MACHINE.$COLUMN $COLOR `date` ${MSG} " Done **************************************************************************************************** The script works fine form most of my tunnels, but some clients don't allow ping on the network, and on top of that an even better check would be to hit 3 diff sites that are on those ips for the host for example http://172.66.11.33/hello/imhere.gif. Is there a simple way to motify the script above to use these full http host rather than the singular ip? I see in hobbitlaunch.cfg the bbnet entry which is responsible for the http test looks like this [bbnet] ENVFILE /home/hobbit/server/etc/hobbitserver.cfg NEEDS hobbit CMD bbtest-net --report --ping --checkresponse --timeout=30 LOGFILE $BBSERVERLOGS/bb-network.log INTERVAL 5m Do I need to make mine look somewhat like this so I can use the bbtest-net cmd within my script instead of just ping? I know its kind of a long wordy question and much help to anyone who can offer insight. Wesley Knox Systems Administration BT | Retail & Commercial Systems SIEMENS Industry, Inc. 7004 Bee Caves Road Building Two, Suite 200 Austin, TX 78746 P: 512-306-9400 ext. 255<tel:512-306-9400%20ext.%20255> C: 512-364-3720<tel:512-364-3720> Wesley.knox at siemens.com<mailto:Wesley.knox at siemens.com> usa.siemens.com/rcs<http://usa.siemens.com/rcs> CONFIDENTIALITY NOTICE: This message, together with any attachments, is intended only for the use of the individual or entity to which it addresses and may contain information that is legally privileged, confidential and exempt from disclosure. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this message, or any attachment, is strictly prohibited. If you have received this message in error, please immediately notify the original sender and delete this message, along with any attachments from your computer. _______________________________________________ Xymon mailing list Xymon at xymon.com<mailto:Xymon at xymon.com> http://lists.xymon.com/mailman/listinfo/xymon

1 0

serverside tests using data from multiple clients?
by betsy.schwartz＠gmail.com 23 Nov '11

23 Nov '11

Here's our situation. We've got some things we want to watch multiple servers, that will come through as a name-value pair (once we write the local test) So on server one I might have foo-23 bar-25 and on server two I might have bar- 17 baz 3 We want to to do some tests that would involve adding and correlating all this information. There can be *many* possible names, not just three What's the most xymon-like way to do it? Can I send data through client tests that is *read* by server-side tests ? (I vaguely remember there was a way to do it but searching is not workign for me today). One way to do it is to make a log file for each client, rsync the logs to a common location , and then run a single custom test on that location, but that strikes me as beign a bit "outside the box". I want to work within xymon whenever possible, and having individual client tests and the combo test accessible from the xymon interface would b e nice. thanks for any thoughts or clues

3 2

http ping in a script
by wesley.knox＠siemens.com 22 Nov '11

22 Nov '11

So I have a script which monitors 3 ip's behind an l2l tunnel and I only get a red face if ALL 3 are unreachable. The script looks like so: #!/bin/sh BBHTAG=VPN # What we put in bb-hosts to trigger this test COLUMN=$BBHTAG # Name of the column, often same as tag in bb-hosts $BBHOME/bin/bbhostgrep $BBHTAG | while read L do set $L # To get one line of output from bbhostgrep HOSTIP="$1" MACHINEDOTS="$2" MACHINE=`echo $2 | $SED -e's/\./,/g'` COLOR=green MSG="$BBHTAG status for host $MACHINEDOTS" #... do the test, perhaps modify COLOR and MSG COLOR=green # By default, everything is OK MSG="All is OK" HOSTS="172.200.129.226 172.34.55.66 172.202.94.226" PINGCNT=3 # number of times to ping STATUS="bad" for host in $HOSTS do ping -c $PINGCNT $host if [[ $? == 0 ]] then STATUS="ok" fi done if [ $STATUS != "ok" ];then COLOR="red" MSG="Tunnel is down" fi $BB $BBDISP "status $MACHINE.$COLUMN $COLOR `date` ${MSG} " Done **************************************************************************************************** The script works fine form most of my tunnels, but some clients don't allow ping on the network, and on top of that an even better check would be to hit 3 diff sites that are on those ips for the host for example http://172.66.11.33/hello/imhere.gif. Is there a simple way to motify the script above to use these full http host rather than the singular ip? I see in hobbitlaunch.cfg the bbnet entry which is responsible for the http test looks like this [bbnet] ENVFILE /home/hobbit/server/etc/hobbitserver.cfg NEEDS hobbit CMD bbtest-net --report --ping --checkresponse --timeout=30 LOGFILE $BBSERVERLOGS/bb-network.log INTERVAL 5m Do I need to make mine look somewhat like this so I can use the bbtest-net cmd within my script instead of just ping? I know its kind of a long wordy question and much help to anyone who can offer insight. Wesley Knox Systems Administration BT | Retail & Commercial Systems SIEMENS Industry, Inc. 7004 Bee Caves Road Building Two, Suite 200 Austin, TX 78746 P: 512-306-9400 ext. 255 C: 512-364-3720 Wesley.knox at siemens.com usa.siemens.com/rcs CONFIDENTIALITY NOTICE: This message, together with any attachments, is intended only for the use of the individual or entity to which it addresses and may contain information that is legally privileged, confidential and exempt from disclosure. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this message, or any attachment, is strictly prohibited. If you have received this message in error, please immediately notify the original sender and delete this message, along with any attachments from your computer.

1 0

Trouble shooting alerts
by Barrie.Parker＠uregina.ca 22 Nov '11

22 Nov '11

Folks: I've been working on this problem for the last couple of days and it's likely an easy fix, but I can't see it. I have a Linux test box, ix-test, that I've shut ntpd down on. The status page shows the red "critical" icon for procs. When I drill down into procs, the page is red with ntpd red as I expect. But I never get an email alert. I can manually email out, so postfix is okay on the xymon server. The snippet of code from alerts.cfg looks like: HOST=ix-test SERVICE=ntpd MAIL barrie DOT parker AT uregina DOT ca REPEAT=10 COLOR=RED I've gone through literally hundreds of emails in the archives (there's over 7200 with alerts and troubleshooting in them ;). I've gone through what I've seen in them, but I'm still no closer to a solution. When I do: bin/xymoncmd xymond_alert --dump-config 2011-11-18 09:43:40 Using default environment file /usr/local/xymon/server/etc/xymonserver.cfg <SNIP> 125 HOST=ix-test SERVICE=ntpd MAIL barrie DOT parker AT uregina DOT ca FORMAT=TEXT REPEAT=10 COLOR=red <SNIP> I gather that's what I should see. When I do: bin/xymoncmd xymond_alert --test ix-test ntpd 2011-11-18 09:44:24 Using default environment file /usr/local/xymon/server/etc/xymonserver.cfg 00016177 2011-11-18 09:44:24 send_alert ix-test:ntpd state Paging 00016177 2011-11-18 09:44:24 Matching host:service:dgroup:page 'ix-test:ntpd:Math:' against rule line 122 00016177 2011-11-18 09:44:24 Failed 'HOST=rss03 SERVICE=syslog-ng' (hostname not in include list) 00016177 2011-11-18 09:44:24 Matching host:service:dgroup:page 'ix-test:ntpd:Math:' against rule line 125 00016177 2011-11-18 09:44:24 *** Match with 'HOST=ix-test SERVICE=ntpd' *** 00016177 2011-11-18 09:44:24 Matching host:service:dgroup:page 'ix-test:ntpd:Math:' against rule line 126 00016177 2011-11-18 09:44:24 *** Match with 'MAIL barrie DOT parker AT uregina DOT ca REPEAT=10 COLOR=RED' *** 00016177 2011-11-18 09:44:24 Mail alert with command 'mail -s "Xymon [12345] ix-test:ntpd CRITICAL (RED)" barrie DOT parker AT uregina DOT ca' <SNIP> That would seem to indicate success reading and parsing the alerts file. I've tried to debug with capturing the output of:./bbcmd --env=../etc/xymonserver.cfg xymond_channel --channel=page cat and then using the code between @@page#339/ix-test|1321631963.933541|142.3.156.124|ix-test|procs|142.3.156.124|13 21633763|red|red|1321625351||647263|linux|linux|| and @@ and then feeding it to: bin/xymoncmd 2011-11-18 10:48:43 Using default environment file /usr/local/xymon/server/etc/x ymonserver.cfg rss03:/usr/local/xymon/server> bin/xymond_alert --debug <input.txt 17777 2011-11-18 10:49:04 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbyte s=0, bufleft=266239 17777 2011-11-18 10:49:04 Got 8542 bytes 17777 2011-11-18 10:49:04 xymond_alert: Got message 339 @@page#339/ix-test|13216 31963.933541|142.3.156.124|ix-test|procs|142.3.156.124|1321633763|red|red|132162 5351||647263|linux|linux|| 17777 2011-11-18 10:49:04 startpos 8541, fillpos 8542, endpos -1 17777 2011-11-18 10:49:04 Got page message from ix-test:procs 17777 2011-11-18 10:49:04 Alert status changed from 0 to 1 17777 2011-11-18 10:49:04 Found no first matching rule 17777 2011-11-18 10:49:04 Opening file /usr/local/xymon/server/etc/alerts.cfg 17777 2011-11-18 10:49:04 Opening file /usr/local/xymon/server/etc/holidays.cfg 17777 2011-11-18 10:49:04 Transport setup is: 17777 2011-11-18 10:49:04 xymondportnumber = 1984 17777 2011-11-18 10:49:04 xymonproxyhost = NONE 17777 2011-11-18 10:49:04 xymonproxyport = 0 17777 2011-11-18 10:49:04 Recipient listed as '142.3.156.39' 17777 2011-11-18 10:49:04 Standard protocol on port 1984 17777 2011-11-18 10:49:04 Will connect to address 142.3.156.39 port 1984 17777 2011-11-18 10:49:04 Connect status is 0 17777 2011-11-18 10:49:04 Sent 16 bytes 17777 2011-11-18 10:49:04 Read 1437 bytes 17777 2011-11-18 10:49:04 Closing connection 17777 2011-11-18 10:49:04 Found no first matching rule 17777 2011-11-18 10:49:04 cleanup_alert called for host ix-test, test procs 17777 2011-11-18 10:49:04 0 alerts to go 2011-11-18 10:49:04 Bad data in channel, skipping it 2011-11-18 10:49:04 Buffer sync lost, flushing data 17777 2011-11-18 10:49:04 Want msg 1, startpos 0, fillpos 0, endpos -1, usedbyte s=0, bufleft=266239 17777 2011-11-18 10:49:04 get_xymond_message: Returning NULL due to EOF rss03:/usr/local/xymon/server> I see the line (twice) "Found no first matching rule" but I'm not sure how to interpret this. Oh and xymon is 4.3.5 on the server and it should be 4.3.2 on the monitored host. Thank you. Regards, Barrie.

3 7

.default. report time
by jamison＠newasterisk.com 22 Nov '11

22 Nov '11

A very interesting thing about my current positition is that our uptime is only considered for about 14 hours a day. In order to make Xymon aware of this I have added a line to ~/server/etc/hosts.cfg that looks like this: .default. #REPORTTIME=W:0700:2100 Unless I'm making a mistake here, this should inscruct Xymon to only consider uptime from 7:00am to 8:00pm, however, this does not seem to be the case when looking at the availability report. Is there something I'm missing? Thanks, Jamison Maxwell

1 1

Request - combo.d directory support?
by david.gore＠verizon.com 22 Nov '11

22 Nov '11

I was curious if perhaps in the future we could have combo.d directory support like analysis.d, hosts.d and tasks.d. It might be useful if alerts.cfg support the same mechanism. It just makes it easier to organize things. We are trying to reduce the clutter on the nonongreen page by extensive usage of combo'ing tests. Which could lead to problems with combo tests not firing on yellows, we will see. David Gore (v965-3670) Network Management Systems (NMS) IMPACT Transport Team Lead - SCSA, SCNA Page: 1-800-PAG-eMCI pin 1406090 Vnet: 965-3676

1 0

client start script for XYmon
by bgmilne＠staff.telkomsa.net 22 Nov '11

22 Nov '11

On Friday, 18 November 2011 18:20:37 bb4 at richter-it.net wrote: > Hi fellow xymonians, > > I was asked by colleagues if it would be a good idea to add some check to > the client start script (runclient.sh) to avoid the start of the client as > root. What do you think? You mean like the example scripts provided in the source (e.g. look in rpm/ or debian/)? Or like the init scripts provided and used by packages of Xymon? > I know that I could update all my client scripts but if I update my > installation this change will be gone. This is why one uses software packages (such as rpm or deb) to deploy software. Regards, Buchan

1 0

Microsoft Exchange monitoring
by David.Raymond＠ca.ebarrette.com 21 Nov '11

21 Nov '11

Hi All, Did one of you have something to monitoring Microsoft Exchange server ? I want to monitor queue, email size error (like more than x mb) If someone have an idea, let me know. Regards, David Raymond IT System Administrator

1 0

xymonproxy
by bewhite＠fellowes.com 21 Nov '11

21 Nov '11

On clients you want monitored by your main Xymon server and your new (dmz) Xymon server, add the second server to the BBDISP variable (old config, not sure the field for newer versions). The client will send status messages to both servers. From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of bb4 at richter-it.net Sent: Friday, November 18, 2011 10:27 AM To: xymon at xymon.com Subject: [Xymon] xymonproxy Hi, I've got the request to set up an additional XYmon server in our internet DMZ for external customers. Since all machines that would be displayed there are on our internal network I'd like to forward all statuses from our internal XYmon server to the one in the DMZ and was thinking about xymonproxy. But I saw on the man page and in the config files that I can only use xymonproxy OR xymond. And xymonproxy would forward ALL data not only the data for some specific hosts. Has one of you a solution that he/she wants to share? TIA Torsten Bruce White Senior Enterprise Systems Engineer | Phone: 1-630-671-5169 | Fax: 630-893-1648 | bewhite at fellowes.com | http://www.fellowes.com/ Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Fellowes, Inc.

2 1