- Xymon - Xymon mailman web

Defining CLIENTOS on RPM and Debian distributions
by Andy.Farrior＠victoriacollege.edu 09 Jan '20

09 Jan '20

Greetings, I'm looking through the Debian and RPM Xymon-client distributions and I can't seem to find the best place to define CONFIGCLASS to match up with "[class=<expression>]" in client-local.cfg on the Xymon server. Or is it preferred to define CLASS:Classname in the hosts.cfg file? Both distributions set: CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles However with both distributions, clients show up as "fubar.linux linux" in clientlog on Xymon. I'm trying to figure out the best way to manage the client-local.cfg file for those distributions since the default log files are different: Debian/Ubuntu: $ egrep -v "^#|^$" /etc/rsyslog.d/50-default.conf auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog kern.* -/var/log/kern.log mail.* -/var/log/mail.log mail.err /var/log/mail.err *.emerg :omusrmsg:* RPM/RedHat: $ egrep -v "^#|^$" /etc/rsyslog.conf *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log local0,local1.* /var/log/localmessages local2,local3.* /var/log/localmessages local4,local5.* /var/log/localmessages local6,local7.* /var/log/localmessages I'm guessing it should go in: Debian: /etc/sysconfig/xymon-client RPM:/etc/sysconfig/xymon-client Here's where I've looked: Debian/Ubuntu: /etc/init.d/xymon-client:# Include xymon-client defaults if available /etc/init.d/xymon-client:if [ -f /etc/default/xymon-client ] ; then /etc/init.d/xymon-client: . /etc/default/xymon-client /etc/init.d/xymon-client:export XYMONSERVERS XYMONCLIENTHOME CLIENTHOSTNAME MACHINE MACHINEDOTS CLIENTOS ##### /etc/sysconfig/xymon-client does not have a reference to $SERVEROSTYPE. Only XYMONSERVERS,CLIENTHOSTNAME,CLIENTOS ##### /etc/xymon/xymonclient.cfg:include /etc/default/xymon-client /etc/xymon/xymonclient.cfg:include /var/run/xymon/bbdisp-runtime.cfg /etc/xymon/xymonclient.cfg:CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles /usr/lib/xymon/client/bin/xymonclient.sh:echo "client $MACHINE.$SERVEROSTYPE $CONFIGCLASS" >> $MSGTMPFILE RPM/RedHat: /usr/lib/systemd/system/xymonlaunch.service:EnvironmentFile=-/etc/default/xymonlaunch /usr/lib/systemd/system/xymonlaunch.service:EnvironmentFile=-/etc/sysconfig/xymonlaunch /usr/lib/systemd/system/xymonlaunch.service:ExecStart=/usr/bin/xymoncmd /usr/sbin/xymonlaunch --no-daemon $XYMONLAUNCHOPTS ##### /etc/sysconfig/xymon-client does not have a reference to $SERVEROSTYPE. Only XYMONSERVERS,CLIENTHOSTNAME,CLIENTOS ##### /etc/xymon-client/xymonclient.cfg:include /etc/sysconfig/xymon-client /etc/xymon-client/xymonclient.cfg:CONFIGCLASS="$SERVEROSTYPE" # Default configuration class for logfiles Thx, Andy Andy Farrior Director of Technology Services Victoria College 2200 E Red River St Victoria, TX 77901-4494 e-mail: andy.farrior at victoriacollege.edu o) 361-582-2547

1 0

Monitoring if a remote IP is connected to particular local port
by jeremy＠laidman.org 09 Jan '20

09 Jan '20

Paul On Thu, 9 Jan 2020 at 08:04, Root, Paul T via Xymon <xymon at xymon.com> wrote: > > Hi, > > I?ve got an application that has a specific port open > 11001, that multiple connections, most looped back on itself. > > > > However, we have another server (that is another groups > machine, and isn?t monitored by Xymon), that connects to this port. > An interesting use case. > Reading the analysis.cfg man page, it looks like criteria > is either local or remote, not both. > I'm not sure I read it the same way. The format is "PORT criteria [MIN=mincount] ...etc" and what you're wanting to do is specify "criteria". The example in the man page for usage of "TEXT=" shows: PORT LOCAL=%[.:]22$ STATE=LISTEN "TEXT=SSH listener" So this is giving two criteria: LOCAL and STATE. This implies that the format is really "PORT criteria [...criteria] [MIN=mincount] ...etc" and thus you can chain multiple criteria. In your use case I would expect you to be able to use something like: PORT LOCAL=%[.:]10001 REMOTE=172.28.104.66:* STATE=ESTABLISHED Not sure if the wildcard is valid for REMOTE port number; perhaps use a regex here as well: PORT LOCAL=%[.:]10001 REMOTE=%172\.28\.104\.66:.* STATE=ESTABLISHED The analysis.cfg file distributed with the source code specifies this format: PORT [LOCAL=addr] [EXLOCAL=addr] [REMOTE=addr] [EXREMOTE=addr] [STATE=state] [EXSTATE=state] [MIN=mincount] [MAX=maxcount] [COLOR=color] [TRACK=id] [TEXT=displaytext] So I can see no problem specifying a local port *and *a remote IP address as you seem to require. > > > > Is there a way to monitor this situation? > > > > # netstat -ant |grep 11001 > > tcp 0 0 0.0.0.0:11001 0.0.0.0:* > LISTEN > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37852 ESTABLISHED > > > tcp 0 0 192.168.30.15:37852 192.168.30.15:11001 ESTABLISHED > > > tcp 0 0 192.168.30.15:37864 192.168.30.15:11001 ESTABLISHED > > > tcp 0 0 192.168.30.15:37856 192.168.30.15:11001 ESTABLISHED > > > *tcp 0 0 192.168.30.15:11001 > <http://192.168.30.15:11001> 172.28.104.66:39904 > <http://172.28.104.66:39904> ESTABLISHED* > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37862 ESTABLISHED > > > tcp 81 0 192.168.30.15:11001 204.155.140.230:53680 ESTABLISHED > > > *tcp 486 0 192.168.30.15:11001 > <http://192.168.30.15:11001> 172.28.104.66:39910 > <http://172.28.104.66:39910> ESTABLISHED* > > tcp 0 0 192.168.30.15:11001 204.155.140.230:53682 ESTABLISHED > > > tcp 0 0 192.168.30.15:11001 204.155.140.230:53679 ESTABLISHED > > > tcp 0 0 192.168.30.15:37862 192.168.30.15:11001 ESTABLISHED > > > tcp 34 0 192.168.30.15:11001 192.168.30.15:37864 ESTABLISHED > > > tcp 0 0 192.168.30.15:11001 192.168.30.15:37856 > ESTABLISHED > > > > > > Paul Root > > Lead Operations Engineer - IT Managed Services > > 390 Commerce Dr > > Woodbury, Mn 55125 > > 651-312-5207 paul.root at centurylink.com > > > This communication is the property of CenturyLink and may contain > confidential or privileged information. Unauthorized use of this > communication is strictly prohibited and may be unlawful. If you have > received this communication in error, please immediately notify the sender > by reply e-mail and destroy all copies of the communication and any > attachments. > > >

2 1

Monitoring if a remote IP is connected to particular local port
by Paul.Root＠CenturyLink.com 08 Jan '20

08 Jan '20

Hi, I've got an application that has a specific port open 11001, that multiple connections, most looped back on itself. However, we have another server (that is another groups machine, and isn't monitored by Xymon), that connects to this port. Reading the analysis.cfg man page, it looks like criteria is either local or remote, not both. Is there a way to monitor this situation? # netstat -ant |grep 11001 tcp 0 0 0.0.0.0:11001 0.0.0.0:* LISTEN tcp 0 0 192.168.30.15:11001 192.168.30.15:37852 ESTABLISHED tcp 0 0 192.168.30.15:37852 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:37864 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:37856 192.168.30.15:11001 ESTABLISHED tcp 0 0 192.168.30.15:11001 172.28.104.66:39904 ESTABLISHED tcp 0 0 192.168.30.15:11001 192.168.30.15:37862 ESTABLISHED tcp 81 0 192.168.30.15:11001 204.155.140.230:53680 ESTABLISHED tcp 486 0 192.168.30.15:11001 172.28.104.66:39910 ESTABLISHED tcp 0 0 192.168.30.15:11001 204.155.140.230:53682 ESTABLISHED tcp 0 0 192.168.30.15:11001 204.155.140.230:53679 ESTABLISHED tcp 0 0 192.168.30.15:37862 192.168.30.15:11001 ESTABLISHED tcp 34 0 192.168.30.15:11001 192.168.30.15:37864 ESTABLISHED tcp 0 0 192.168.30.15:11001 192.168.30.15:37856 ESTABLISHED Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

how to get ifstat graphs as a column button
by kspringer＠innovateteam.com 03 Jan '20

03 Jan '20

I'd like to get the 'ifstat' graphs to be a column button that I can click to go right to those graphs.? I tried adding 'ifstat' into my group column list in my hosts.cfg file but no column appeared.? I realize that it's not a default column, but if I could get it working it would save me a lot of clicks and scrolling. -- Kris Springer

2 1

graph Windows disk I/O
by kspringer＠innovateteam.com 30 Dec '19

30 Dec '19

I use the XymonPS client and I was wondering if it has a way to graph Windows client disk I/O -- Kris Springer

1 0

PROC monitoring on timed non existence
by josh＠imaginenetworksllc.com 30 Dec '19

30 Dec '19

I have a ps that comes up every 5 minutes and runs. Is there a way to monitor this? I'm wondering if there is a way to have Xymon go yellow if the ps is not seen for 60 minutes, based on the assumption that the client will generate at least one output per hour if it is running as expected. Josh Luthman Office: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

1 0

Devmon template for Cisco ISR4000
by colin.coe＠gmail.com 19 Dec '19

19 Dec '19

Hi Just wondering if anyone already has a Devmon template for the ISR4000 series that they'd be willing to share? Thanks

4 5

Scripts/commands to update files in server/www
by raanan.elefant＠gmail.com 16 Dec '19

16 Dec '19

Hello :) I'm trying to get a good understanding of how xymon works and was wondering, where/what are the scripts/commands for updating server/www files? -- --- Raanan Elefant

1 0

Config for msgs column - how to play with client-local.cfg and analysis.cfg? How to play with default and specific entries?
by christian.becker＠rhein-zeitung.net 16 Dec '19

16 Dec '19

Hello everybody, i?m writing this to the list because I?m screwed up with my thoughts, probably because I?ve done too much config tests for today?.. Hope I can describe my situation good enough. I?ve configured nearly 120 linux machines (servers) in our Xymon environment, most of them running Ubuntu 14.04/16.04/18.04 LTS or CentOS 6/7. Xymon server is on 4.3.29, clients are on different releases starting at 4.3.17. All of them are configured to write their system logs to /var/log/messages ? that?s working. What I want to achieve: 1. For ALL of them, I want to have the ?msgs? column filled with the data coming from /var/log/messages, so that I can configure alerting, if some keywords occur in /var/log/messages. 2. In addition to that, for SOME of these servers, I want to have application specific logfiles monitored in the ?msgs? column, and I want to monitor those application specific logfiles for keywords too. 3. In further addition to the above, I want to have EACH ?files? column filled with the files that are monitored in the ?msgs? column per server. Actually I?m struggling with config files on my Xymon server, client-local.cfg and analysis.cfg, and there with class-entries, default section and server specific rules. That makes my crazy. My thought was to have a class configured in client-local.cfg which is: [linux] file:/var/log/messages file:/var/log/ntp log:/var/log/messages:10240 ignore MARK For those servers where I want to have additional, application specific logfiles, I have server based entries like this in client-local.cfg (hoping that this ?over-controls? the class entry from above?.): [dvst-1] file:/var/log/messages file:/var/log/ntp file:/data/monitor/checkppi.log log:/data/monitor/checkppi.log:10240 log:/var/log/messages:10240 ignore MARK This section is BELOW the class [linux] section, if that matters? Everytime I did a config change on client-local.cfg I did a restart of Xymon on my xymon server and I had to wait minutes over minutes to see the result. To make the thing complete and to have more confusion, I have these entries in analysis.cfg: Example of a server specific entry: HOST=dvst-1 DISK /data 97 98 PROC "mysqld " PROC "mysqld_safe" PROC "httpd2-prefork" 1 PROC "smbd? PROC "caagentd" LOG /data/monitor/checkppi.log OutOfMemory COLOR=red Finally a DEFAULT section (at the end of the file): DEFAULT # These are the built-in defaults. DISK * 90 95 MEMSWAP 80 90 MEMACT 90 97 FILE /var/log/ntp SIZE>0 FILE /var/log/messages LOG /var/log/messages %(I/O|read).error IGNORE=%(fd0|smbd|read_fd_with_timeout|Connection.reset.by.peer|error\.txt) COLOR=red LOG /var/log/messages %Remounting.filesystem.read-only COLOR=red LOG /var/log/messages There.are.errors.in.the.filesystem COLOR=red The problem is, that I cannot see data from the configured logfiles in the affected ?msgs? columns. For some logfile entries I get parse errors and I don?t know exactly the reason behind this. All of the configured logfiles are present on the affected servers, there they are readable and filled with data. Does anybody have a real good description of the best way to get the ?msgs? column populated with data? Of the ?playing together? and the right order of entries in the config-files? Hope anybody can follow my thoughts ? Regards Christian

1 1

disable 'uptime' alerts
by kspringer＠innovateteam.com 12 Dec '19

12 Dec '19

I have a computer lab that I monitor.? I've got 'noconn' and 'dialup' configured in the hosts.cfg file, but I still get the 'uptime warning' emails that inform me when those machines are rebooted.? How can I disable that specific alert?? I don't care when they're rebooted. -- Kris Springer

2 3