- Xymon - Xymon mailman web

how to avoid yellow alert in msgs if logfile is not readable
by norkrie＠gmail.com 12 Dec '19

12 Dec '19

experts, xymon 4.3.28 on redhat I defined a rule for logfile monitoring in client-local.cfg with wildcards like this: log:`ls /path/to/AppServer/profiles/*/logs/*/SystemErr.log 2>/dev/null`:10240 This rule is active for hundreds of servers (all [linux] section) Everything works as expected, all logs are found and evaluated. But if for some reason the log is not readable for the xymon user, the msgs column becomes yellow with "Logfile not accessible". Is there a way to suppress this alert? (and no, there is no way that the xymon user can get permission to read the log) Sometimes I would prefer to have the msgs column clear in those cases (like "no info avail"), but keep the access info under msgs. Any suggestions? Norbert

1 0

FILE type=symlink
by mike.williams＠sectigo.com 11 Dec '19

11 Dec '19

Hi, I've come across two threads regarding Xymon checking that FILE is type=symlink. Both talked about an untested patch, which has been included for "some time". However, it doesn't work. I'd get the same "File is a file - should be symlink" ( https://xymon.xymon.narkive.com/Fn4s9A2v/checking-for-symlinks) So I fixed it, I think. Patch attached. In case the attachment doesn't come through, the only code change is this; Index: xymond/client_config.c =================================================================== --- xymond/client_config.c (revision 8119) +++ xymond/client_config.c (working copy) @@ -2665,13 +2665,13 @@ tstr = strchr(boln, '('); if (tstr) { - if (strncmp(tstr, "(file", 5) == 0) ftype = S_IFREG; + if (strncmp(tstr, "(file)", 6) == 0) ftype = S_IFREG; else if (strncmp(tstr, "(directory", 10) == 0) ftype = S_IFDIR; else if (strncmp(tstr, "(char-device", 12) == 0) ftype = S_IFCHR; else if (strncmp(tstr, "(block-device", 13) == 0) ftype = S_IFBLK; else if (strncmp(tstr, "(FIFO", 5) == 0) ftype = S_IFIFO; else if (strncmp(tstr, "(socket", 7) == 0) ftype = S_IFSOCK; - else if (strstr(tstr, ", symlink -> ") == 0) islink = 1; + else if (strncmp(tstr, "(file, symlink -> ", 18) == 0) ftype = S_IFLNK, islink = 1; } } else if (strncmp(boln, "mode:", 5) == 0) { The rest is just changing the references to "Triggers warning if the file is not of the specified type" to include "symlink". I'm not convinced by changing the S_IFREG match to '"(file)", 6', maybe there are other types of file I don't know about. Possibly putting the revised S_IFLNK match before an unmodified S_IFREG match is best. Also I haven't checked that setting 'ftype = S_IFLNK' is necessary. -- Mike Williams

1 0

Force HTTPS test to use specific IP address
by sjcarr＠gmail.com 08 Dec '19

08 Dec '19

Hi guys, We're implementing a new web cluster fronted by a load-balancer, and I want to monitor the web service on each server in the cluster. If I have the config line as below, do I just need to add the command 'testip' so that the HTTPS request will be sent to 1.2.3.4? instead of attempting to resolve secure-website.com which would lead to the load-balancer IP being returned. 1.2.3.4 web-server1 # https://secure-website.com sni Thanks Steve

2 1

xymond_alert errors when hosts.cfg uses directory includes
by john.r.rothlisberger＠accenture.com 04 Dec '19

04 Dec '19

A valid option for hosts.cfg is to use a directory tag which includes all files in that directory and sub directories. It works as far as the webpage is concerned and monitoring in general - but, when it comes to xymond_alert it is not happy that the client is not in the hosts.cfg file itself. xymon at tc3mon:~/xymon-4.3.30/xymond$ xymond_alert --test client test 2019-12-04 14:44:50.906606 Host not found in hosts.cfg - assuming it is on the top page 00095241 2019-12-04 14:44:50 send_alert client:test state Paging Checking criteria for host 'client', which is not yet defined; some alerts may not immediately fire 00095241 2019-12-04 14:44:50 Matching host:service:dgroup:page 'client:test:(NULL):' against rule line 11 ... 00095241 2019-12-04 14:44:50 *** Match with 'SERVICE=test COLOR=red EXPAGE=%.*PAGE1' *** 00095241 2019-12-04 14:44:50 Script alert with command '/home/xymon/server/ext/pg/exalert_SSLHEADERS' and recipient headers_alert It does eventually match the rule for the service but the errors generated end up polluting xymonlaunch.log and it grows at a crazy pace. In xymond_alert.c - the client is only searched for in the hosts.cfg file and does not include any valid include directories or files. Xymond_alert.c: load_hostnames(xgetenv("HOSTSCFG"), NULL, get_fqdn()); hinfo = hostinfo(testhost); if (hinfo) { testpage = strdup(xmh_item(hinfo, XMH_ALLPAGEPATHS)); } else { errprintf("Host not found in hosts.cfg - assuming it is on the top page\n"); testpage = ""; } Any chance of getting this fixed in the next version? Thanks, John Upcoming PTO: _____________________________________________________________________ John Rothlisberger IT Strategy, Infrastructure & Security - Technology Growth Platform TGP for Business Process Outsourcing Accenture 312.693.3136 office _____________________________________________________________________ ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

Terabithia xymon 4.3.30 ports reporting issue
by Paul.Root＠CenturyLink.com 04 Dec '19

04 Dec '19

Hi, I have some redhat servers that I just upgraded from a home built 4.3.28 to the Terabithia build 4.3.30 OS: Red Hat Enterprise Linux Server release 6.10 (Santiago) Linux nsmdenvp186.corp.intranet 2.6.32-754.23.1.el6.x86_64 x86_64 Client S/W: Xymon version 4.3.30-1.el6 The ports test seems to be double displaying the ports. 4.3.28 did not exhibit this issue. red Tue Dec 3 21:40:01 MST 2019 - Ports NOT ok red Postgres (found 128, req. between 11 and 100) green SSHD (found 2, req. between 1 and 100) Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:7738 0.0.0.0:* LISTEN tcp 0 0 192.168.9.186:5435 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:5435 0.0.0.0:* LISTEN tcp 0 0 192.168.9.186:5435 192.168.9.187:57908 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53158 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51718 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53168 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53206 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57916 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53142 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57892 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51708 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54068 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51716 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:52116 ESTABLISHED tcp 0 23 192.168.9.186:5435 192.168.9.185:53350 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53353 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53162 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57912 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53143 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41676 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54140 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57893 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53178 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53093 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41691 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53116 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57919 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54142 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53092 ESTABLISHED tcp 0 0 192.168.9.186:22 10.139.63.13:53252 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57914 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53192 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53179 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57924 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53164 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53208 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53160 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57922 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57895 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41678 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41692 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:44090 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53193 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:52118 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53114 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53166 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53146 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51702 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53118 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57910 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57918 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41680 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53352 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57894 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54070 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57896 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51714 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53194 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41565 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54072 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53094 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:36718 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57926 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:44094 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41690 ESTABLISHED udp 0 0 127.0.0.1:323 0.0.0.0:* udp 0 0 0.0.0.0:123 0.0.0.0:* udp 0 0 192.168.9.186:41374 10.10.21.164:123 ESTABLISHED udp 0 0 127.0.0.1:32807 127.0.0.1:32807 ESTABLISHED udp 0 0 ::1:323 :::* Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:7738 0.0.0.0:* LISTEN tcp 0 0 192.168.9.186:5435 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:5435 0.0.0.0:* LISTEN tcp 0 0 192.168.9.186:5435 192.168.9.187:57908 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53158 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51718 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53168 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53206 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57916 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53142 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57892 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51708 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54068 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51716 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:52116 ESTABLISHED tcp 0 23 192.168.9.186:5435 192.168.9.185:53350 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53353 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53162 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57912 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53143 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41676 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54140 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57893 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53178 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53093 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41691 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53116 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57919 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54142 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53092 ESTABLISHED tcp 0 0 192.168.9.186:22 10.139.63.13:53252 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57914 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53192 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53179 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57924 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53164 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53208 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53160 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57922 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57895 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41678 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41692 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:44090 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53193 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:52118 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53114 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53166 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53146 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51702 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53118 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57910 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57918 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41680 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53352 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57894 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54070 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57896 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:51714 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53194 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41565 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:54072 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:53094 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:36718 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.187:57926 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:44094 ESTABLISHED tcp 0 0 192.168.9.186:5435 192.168.9.185:41690 ESTABLISHED udp 0 0 127.0.0.1:323 0.0.0.0:* udp 0 0 0.0.0.0:123 0.0.0.0:* udp 0 0 192.168.9.186:41374 10.10.21.164:123 ESTABLISHED udp 0 0 127.0.0.1:32807 127.0.0.1:32807 ESTABLISHED udp 0 0 ::1:323 :::* Is this a known issue? Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

log lines not displaying after 20 min
by kspringer＠innovateteam.com 26 Nov '19

26 Nov '19

Hi, I'm monitoring a hosts' text file for a specific key word using the analysis.cfg LOG options in Xymon.? It's working fine except that if the status stays unchanged for 20 minutes or more the log output no longer displays on the Server's webpage.? The log file is only ever a single line of output which includes a date/time that changes every minute, so the file is changing, but it only displays on the Server's webpage if the red/green status changes.? How can I force it to display the contents of the log file all the time so I can see it on the Server's webpage even if the status is unchanged for long periods of time? -- Kris Springer

1 0

IMAPS & POP3S tests
by damien＠makelofine.org 25 Nov '19

25 Nov '19

Hi, Since I upgraded a system to Debian 10 running Xymon client 4.3.28, my Xymon server (running version 4.3.28 on Debian 10) reports errors for IMAPS & POP3S tests. This is weird, because I have another server, running Xymon 4.3.28 too, that is not reporting any issue. My IMAPS & POPS3S daemon is dovecot 2.3.4.1-5+deb10u1 It is quiet complicated to find the logs for this test, so I don't know what is going wrong. Sometimes, the test goes green for few minutes. I tried configuring fail2ban to whitelist my Xymon server IP, and set dovecot to allow a large amount of connections, but this did not change anything. Any help to investigate or locate IMAPS test logs would be appreciated.

4 5

SSL problems with xymon
by lso＠ufm.dk 22 Nov '19

22 Nov '19

Recently I got an error with a perfectly valid certificate in xymon. Xymon reports red Fri Nov 22 09:50:20 2019: SSL error red https://www.su.dk/ - SSL error Seconds: 0.261158000 Trying to access the site using firefox from Xymon server doesn?t report any error: [cid:image001.png at 01D5A11B.2B073820] Testing the certificate using openssl doesn't look right: echo| openssl s_client -connect www.su.dk:443<http://www.su.dk:443> CONNECTED(00000003) write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 289 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574412455 Timeout : 300 (sec) Verify return code: 0 (ok) Testing other sites using the same method works fine for other sites. What can I do to solve this problem? How do I proceed? If I'm missing some information - pease let med know. Med venlig hilsen/Kind Regards Leif Sommerdal

2 2

Windows Powershell client v.2.42
by lso＠ufm.dk 21 Nov '19

21 Nov '19

Hi Zak I'm having problems with the powershell client leaking memory on Win2012R2. Thus I have installed version 2.42 to utilize the maxloop option. I was under the impression that I could add the maxloop under [win32] section to control it centrally - but it doesn't seem to work. When making entries for each host it wotks like a dream. Is this a flaw in the design or is it working as designed? Med venlig hilsen/Kind Regards Leif Sommerdal IT Konsulent Uddanelses- og Forskningsministeriet/Ministry for Higher Educationn Styrelsen for Institutioner og Uddannelsesst?tte Bredgade 43 DK-1260 K?benhavn K Telefon: +45 7231 7800 E-mail: siu at ufm.dk<mailto:siu at ufm.dk> www.ufm.dk<http://www.ufm.dk>

2 2

open one page in main view to public
by schritte＠ub.uni-frankfurt.de 20 Nov '19

20 Nov '19

hi to all, our xymon is secured by IP and password. Now we want to open one page in the main view to public (not world wide but a broader public). If I do this using apache all graphics, header und footer is missing, only the "ALT" text is presented. Any way to change this without giving access to other pages in xymon? Thanks for help Rolf -- Mit freundlichen Gr??en Rolf Schrittenlocher Lokales Bibliothekssystem Frankfurt Bockenheimer Landstr. 134-138, 60325 Frankfurt Tel LBS: (49) 69 - 798 28830 Tel pers?nlich: (49) 69 - 798 28908 LBS: lbs-it at ub.uni-frankfurt.de Pers?nlich: schritte at ub.uni-frankfurt.de

3 3