- Xymon - Xymon mailman web

Hobbit testing for VMWare ESX system
by rdeal＠jcvi.org 16 Apr '09

16 Apr '09

Has anyone worked up a nice test for VMWare ESX server. I would like to get stats on the physical host. I have been testing and porting a script from deadcat : http://www.deadcat.net/viewfile.php?fileid=1048 I have it putting the memory and disk info into a format that Xymon will graph and it lists the VMs running. But no cpu info is given. Is everyone just using hobbit client locally on the ESX server configured to use esxtop?

4 3

xymon-4.2.2 and rrdtoolrpm problem
by pankaj.dorlikar＠gmail.com 16 Apr '09

16 Apr '09

i am installing xymon-4.2.2 server .while running ./configure,it says fallowing - Checking for RRDtool ... RRDtool include- or library-files not found. These are REQUIRED for hobbitd RRDtool can be found at http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/ If you have RRDtool installed, use the "--rrdinclude DIR" and "--rrdlib DIR" options to configure to specify where they are. but i have rpm 0f rrdtool 1.2.3 installed by using rpm -ivh "rpmname".. rpm -qil gives /usr/bin/rrdcgi /usr/bin/rrdtool /usr/bin/rrdupdate /usr/lib/librrd.so.2 /usr/lib/librrd.so.2.0.10 /usr/lib/librrd_th.so.2 /usr/lib/librrd_th.so.2.0.8 /usr/lib/perl5 /usr/lib/perl5/vendor_perl /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl/5.8.8/RRDp.pm /usr/lib64/perl5 /usr/lib64/perl5/5.8.8 /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl /usr/lib64/perl5/vendor_perl/5.8.8 /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/RRDs.pm /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDp /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDs /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/auto/RRDs/RRDs.so ... help me.. -- Pankaj V. Dorlikar

5 4

More Rhel5 issues
by bcatlin＠gmail.com 16 Apr '09

16 Apr '09

As some may remember from my ldap question (never worked btw - reverted back to htaccess until I can get more time to work on it) I have a RHEL 5.2 server with Xymon 4.3.2 server/client installed. The server has openssh v 4.3p2 (part of the security app, not separate install). The problem is the ssh test - when run - it causes a log entry in /var/log/messages on exit: sshd[#####]: Connection closed by unknown Did some playing around with the services conf and adding --DNS="IP" in the hobbitserver.conf for the bbtest-net call Ran the test strings by hand via telnet FQN 22. Pasted the send string in and it sent back all the encryption it can support As this is testing the ssh, why not specify that the hobbit account should have ssh set up to each client and the server, then test with an actual ssh call: ssh <server> cat <some known file> Or just send an ssh -V and parse the string for what you need. (this is known as an ssh exec in the security world) Seems to me that if a server responds to an ssh request properly, then the sshd is running. You could even send ps -ef | grep sshd to see if its running. To test this way ensures that the protocol is actually usable, not just running. (A really HUGE difference!!!) Lastly, and best of all - this won't create weird error messages. In the meantime - any ideas on how to get rid of this error when running the ssh test? Thanks Brian lurch at inorbit.com

1 0

BBWin Messages | Filter Security
by MFisher＠hra.com 14 Apr '09

14 Apr '09

Hi For the life of me i cant figure out how to block certain 529 windows security failure errors for specific users. In the documentation it states to use the "USER" attribute but this only works if the user is mentioned in the user field of the error log. If it mentions "NT AUTHORITY\SYSTEM", is it not possible to restrict it based on the user? Example: security: failure - 2009/04/13 17:40:55 - Security (529) - NT AUTHORITY\SYSTEM "Logon Failure: Reason: Unknown user name or bad password User Name: John1234 Domain: CONTOSO Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: \\123.45.67.89 Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited The username is "NT AUTHORITY\SYSTEM" but the actualy user is "John1234".. Anybody have and ideas? I dont want to block "NT AUTHORITY\SYSTEM".

1 1

[hobbit] RE: Troubleshooting Alerts -- Having Problems
by jkwade＠futurefrontiers.com 14 Apr '09

14 Apr '09

So, I tried this in hobbit-alerts.cfg MAIL os-primary-pager FORMAT=sms REPEAT=15 COLOR=RED DURATION>5m DURATION<35 RECOVERED The notifications log said it was sent to the phone. (os-primary-pager is in the mail aliases file) However, the phone never received the messages. Prior to putting in the FORMAT=sms, it sent pages fine. Thanks...James

1 0

[hobbit] Troubleshooting Alerts -- Having Problems
by jkwade＠futurefrontiers.com 14 Apr '09

14 Apr '09

Thanks, I'll test out the SMS Format. Can someone give me some pointers on checking the configuration file and also sending out a test alert. I've looked through the man page and tried a few things, but it didn't seem to work. Thanks...James -----Original Message----- From: Rob McBroom [mailto:mailinglist0 at skurfer.com] Sent: Tuesday, April 14, 2009 9:57 AM To: hobbit at hswn.dk Subject: Re: [hobbit] Troubleshooting Alerts -- Having Problems On 2009-Apr-14, at 10:00 AM, James Wade wrote: > Also, We received Cell Phones in place of the pagers, and > now when I send messages to the cell phones, the cell phone > doesn't display it properly. It's to much data for the cell phones > they gave us. They are Nokia 6085's. When I get a text it > says 1 of 10..or .. missing text.. I'm guessing I'm going > to have to filter all my Hobbit alerts now. There is a FORMAT option for alerts. In particular, you probably want "FORMAT=SMS". See the hobbit-alerts.cfg man page and the example in the alerts file itself. -- Rob McBroom <http://www.skurfer.com/> To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

2 2

Troubleshooting Alerts -- Having Problems
by jkwade＠futurefrontiers.com 14 Apr '09

14 Apr '09

Hello, I'm having to modify the hobbit-alerts.cfg file to add additional pagers and remove some old ones. However, I want to make sure that everything is working since this is a live system. How can I test that the configuration files is correct. I didn't receive some of the pages. Also, We received Cell Phones in place of the pagers, and now when I send messages to the cell phones, the cell phone doesn't display it properly. It's to much data for the cell phones they gave us. They are Nokia 6085's. When I get a text it says 1 of 10..or .. missing text.. I'm guessing I'm going to have to filter all my Hobbit alerts now. Has anyone had this problem and have a sms script I can use? Thanks..James

3 2

xymon-4.4.0 - RECOVERED variable always 0
by joe＠tmsusa.com 14 Apr '09

14 Apr '09

I've been working on the snmp trap notification script for xymon servers we are testing, and it's partially working. I've set up the hobbit alerts to send out an email and an snmp trap, for error conditions, and for recovery. So far so good - I am getting the emails, and the snmp traps are being sent out for both the failure and the recovery. However, in troubleshooting the snmp traps, I discovered that the RECOVERED variable, which is to be set to "1" if it's a recovery, is always set to "0", so the trap code is never incremented, thus we see the same trap code for the failure and the recovery, rather than the recovery trap code being incremented 1 over the corresponding failure trap code. Sanity check, anyone? Joe

1 2

Which version? 4.3.0 or 4.4.0?
by Dan.McDonald＠austinenergy.com 13 Apr '09

13 Apr '09

Looking through SVN, it looks like most of the current work is in 4.4.0. I had installed 4.3.0 Beta 1 on a test system, but there are enough things not working quite right, probably due to my patch were I renamed many things from hobbit to xymon, that I'd like to get a clean install of a new version and try again. Is 4.3.0 now an orphan? Should I switch to 4.4.0 SVN? -- Daniel J McDonald, CCIE #2495, CISSP #78281, CNX Austin Energy http://www.austinenergy.com

2 1

Bertrand ORCIBAL/EXT/TLSE/GPA/CHEM/Corp est absent(e).
by bertrand.orcibal＠gpn.fr 12 Apr '09

12 Apr '09

Je serai absent(e) du 11/04/2009 au 15/04/2009. Veuillez contacter : L'Equipe Exploitation http://pac/ ou 135 ou 05.34.50.21.00 Exploit-DSI.Toulouse at gpn.fr

1 0