- Xymon - Xymon mailman web

Custom monitoring
by yyyadvendra＠gmail.com 27 Aug '19

27 Aug '19

Hi There I am looking for a custom monitoring, my script runs on a client and returns a number, I need to add this to the server and the threshold levels Ex- my-test 5 10 any help please?

3 3

powershell client blank service list
by BDale＠kitchengroup.com.au 21 Aug '19

21 Aug '19

I have one 2016 server that is running the 2.42 version of the powershell client and it's intermittently returning nothing for the svcs check, so I get a blank section like below, which causes the service check to fail with no matching services. [svcs] Name StartupType Status DisplayName If I run it manually it works fine each time. It's happening intermittently - anyone had this before and know what to check? I have tried the 2.27 and 2.42 version of the client and it's happening on both. It's likely related to this specific server but I can't see anything wrong and it has been working for a long time and reporting the services ok. Regards, Brandon

2 1

Xymonnet 4.3.29 coredumping
by mschultheiss＠ivytech.edu 19 Aug '19

19 Aug '19

We noticed our dev Xymon box's disk was filling up over the weekend and looking into it, there are hundreds of coredumps in /. Running gdb against them, I see xymonnet is exiting signal 6 and core dumping. We're using the terabithia RPMS on RHEL 7. -- ------------------------------------------------------------- Michael Schultheiss, RHCSA, RHCE OIT Administration Sr. Unix Systems Engineer Ivy Tech Community College schultmc at ivytech.edu

2 1

Xymon 4.3.29 Released - Important Security Update
by cleaver＠terabithia.org 13 Aug '19

13 Aug '19

Hello all, Xymon 4.3.29 has been released to Sourceforge and should be propagating to mirrors as I write this. Along with an assortment of bug fixes and compilation compatibility fixes for recent glibc systems, this version contains several fixes for security vulnerabilities within some CGI parsing. Although some of these overflows are not exploitable, others, including an XSS vulnerability are. Fixes beyond these CVEs have been made throughout the library, web, and network code to help reduce the likelihood of similar issues in other areas. As a result, all users are encouraged to upgrade. The specific CVEs in question are: ? CVE-2019-13451, CVE-2019-13452, CVE-2019-13455, CVE-2019-13473, ? CVE-2019-13474, CVE-2019-13484, CVE-2019-13485, CVE-2019-13486 Henrik and I would like to extend our thanks to the University of Cambridge Computer Security Incident Response Team, which reported the issues and helped validate their resolution. Full release notes and other changes are available with the released tarball at https://sourceforge.net/projects/xymon/files/Xymon/4.3.29/ As always, thank you to everyone who has contributed patches, ideas, code, and feature requests to the project! Sincerely, Japheth "J.C." Cleaver

12 28

Windows XymonPSClient v2.42
by zak.beck＠accenture.com 13 Aug '19

13 Aug '19

Hi v2.42 has been committed - this contains a minor change. Download from SVN<https://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/> (the documentation has been updated also). * added maxloop client-local configuration item - this causes the XymonPSClient Windows service to be restarted periodically (after a set number of data collections) This is useful for a few servers where the memory usage of the client appears to grow over time. We've found and fixed a number of causes of this but it is still occurring on some servers. There are so many variations of Windows version & patch level / .NET version & patch level / Powershell version & patch level and we don't have a great deal of control over when Powershell manages memory. For these problem servers, restarting the Windows service periodically seems to be the best solution. Maxloop is specified in client-local, with the number of collections to restart after (maxloop:288) - by default the client collects data every 5 minutes so there are 12 collections per hour and 288 collections per day. If you do not specify maxloop, the service will not be restarted. Thanks to Andy Smith (abs at shadymint.com<mailto:abs at shadymint.com>) for the initial patch and testing. Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

1 0

Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)
by tschmidt＠micron.com 09 Aug '19

09 Aug '19

I likewise see one more issue with 4.3.29 that I am trying to correct. The xymonnet RPC check is not displaying the RPC test summary correctly at the top of the svcstatus report. It should look like this: Mon Apr 1 10:53:02 2019 rpc ok, green Service rpcbind (ID: 100000) found on port 111 green Service ypbind (ID: 100007) found on port 1013 Command: rpcinfo -p 1.2.3.4 2>&1 Instead, it is getting truncated like this: Thu Aug 8 10:42:07 2019 rpc ok, green S Command: rpcinfo -p 1.2.3.4 2>&1 The truncation is causing any red/yellow/green RPC checks to not show properly at the top of the svcstatus report. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Horne Sent: Thursday, August 8, 2019 10:16 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update) On Mon, 2019-08-05 at 13:26 -0700, Japheth Cleaver wrote: > Thanks, this does indeed fix the issue. I've added in underscores > (which have been valid for hostnames in xymon, though not in reality) > to match the checks elsewhere. Would appreciate if others could confirm on this. > > Fix/patch is committed in > https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsour > ceforge.net%2Fp%2Fxymon%2Fcode%2F8072%2F&data=02%7C01%7Ctschmidt%4 > 0micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11ba > c1d563c806f%7C0%7C0%7C637008778033157428&sdata=L9XY5CBlGUlIFZDQpaO > kV0nffOL4RDS0uIN%2F6uJELFc%3D&reserved=0 ; > 4.3.30 with this to come shortly. > Sorry - stealing the subject - could I ask to hold fire with 4.3.30 for a little while. There still seems to be a problem with graph titles when using 'exec:'. I'm just trying to track it down now (looks like an extra double-quote has crept in somewhere). Thanks. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymou…]<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymou…> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form. _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

1 1

Mail pipelining
by scarville＠lereta.com 09 Aug '19

09 Aug '19

How does XYMon send mail? I am seeing several of these kinds of messages in /var/log/maillog on the mail server (scamail01) but no corresponding errors in /var/log/maillog on the xymon (rcaxymon01) server. This doesn't seem right. Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: connect from rcaxymon01.lereta.net[10.212.2.27] Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: improper command pipelining after EHLO from rcaxymon01.lereta.net[10.212.2.27] Aug 9 07:21:41 scamail01 postfix/smtpd[32480]: disconnect from rcaxymon01.lereta.net[10.212.2.27] I could turn off reject_unauth_pipelining but I'd prefer not to. XYMon version: 4.3.29 (built from source) Platform: CentOS Linux release 7.6.1810 Postfix version: 2.10.1 -- Stephen

1 1

RPMs 4.3.29 - showgraph bug - PATCH
by john.horne＠plymouth.ac.uk 09 Aug '19

09 Aug '19

Hi, Attached is a unified diff patch to the 'web/showgraph.c' file for the Terabithia RPMs based on version 4.3.29. So if the file hasn't changed in the 4.3.30 branch then it should be okay to just apply it directly. The patch is only 2 (non-contiguous) lines long. The first line just removes some redundant maths. Both lines cater for the fact that 'snprintf' is now used in the code. That function has the unfortunate habit of returning the string length (say 10 characters), but the provided buffer must be large enough to hold the string *and* the terminating null character (so 11 characters). In testing it was found that the string was being truncated by one character because the terminating null was being forced onto the end. When used with 'exec:' in graph titles, this caused the title to not appear at all. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

1 0

preventing new columns
by rcohen55＠gmail.com 09 Aug '19

09 Aug '19

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20190809/bc8a38d7/attach…>

1 0

Xymon 4.3.29 Released - Important Security Update
by tschmidt＠micron.com 08 Aug '19

08 Aug '19

I looked at the source code of 4.3.29 for more instances where dashes in the hostname was not being accepted. I found that the web/reportlog.c file also needed patched to allow dashes and underscores in hostnames and service names for the "Availability Report" feature. Attached is the patch file for it as well. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Tom Schmidt (tschmidt) Sent: Monday, August 5, 2019 11:03 AM To: Richard L. Hamilton <rlhamil2 at gmail.com>; xymon at xymon.com Subject: RE: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update I likewise see that history button issue for hostnames with dashes or underscores. Attached is a context diff patch file to fix the issue. Are there other alphanumerics in hostnames that should be added to line 608 of the web/history.c file? Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Richard L. Hamilton Sent: Monday, August 5, 2019 10:53 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Xymon 4.3.29 Released - Important Security Update Yes, I'm seeing the dash problem too. Some of my VMs have dashes in the name (since they don't migrate, it makes it easier to remember which host they're on); most don't run all the time ("dialup" if you will), but one (actually a Solaris zone) does. All the ones with dashes in the name get "Cannot open history file". Please fix!!! > On Aug 5, 2019, at 11:51, John Horne <john.horne at plymouth.ac.uk> wrote: > > On Mon, 2019-08-05 at 07:52 -0700, Japheth Cleaver wrote: >> On 8/5/2019 6:19 AM, Dirk Kastens wrote: >>> Hi, >>> >>> I just upgraded our xymon server on Scientific Linux release 6.10 >>> frpm xymon 4.3.28 to 4.3.29. >>> >>> Two things are not working any longer: >>> >>> http authentication: I defined the login information in the file >>> /etc/xymon/netrc, which worked before the upgrade. Now the http test >>> are red with the message "Authorization Required". >>> >>> history files cannot be opened any more. When I click on the history >>> button of a test, I get an empty page with the message "Cannot open >>> history file" >> >> Thanks, >> > ... > >> >> For history file checking, can you verify that hosts with dashes in >> the name show this symptom while those with just alphanumerics (and >> periods) don't? I believe this may actually be the bug cause here. >> > Interesting. Can confirm that our clients without a hyphen/dash in the > name work fine with history. The hosts with a hyphen/dash do not - > they get a "Cannot open history file" error. > > > > John. > > -- > John Horne | Senior Operations Analyst | Technology and Information > Services University of Plymouth | Drake Circus | Plymouth | Devon | > PL4 8AA | UK ________________________________ > [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww. > plymouth.ac.uk%2Fimages%2Femail_footer.gif&data=02%7C01%7Ctschmidt > %40micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11 > bac1d563c806f%7C0%7C0%7C637006207919043258&sdata=PU9uQpCzE4ncJnmC9 > GDVRFV7n9silwy1FQP3IyCYMNk%3D&reserved=0]<https://nam01.safelinks. > protection.outlook.com/?url=http%3A%2F%2Fwww.plymouth.ac.uk%2Fworldcla > ss&data=02%7C01%7Ctschmidt%40micron.com%7Cad7b0f57ffe848cc8adf08d7 > 19c564d8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C6370062079190432 > 58&sdata=%2BkT7Ki%2FfHy2o96Tf2Z483xvGh2UUxEauM%2BJHcv5uK0k%3D& > reserved=0> > > This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form. > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists > .xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40 > micron.com%7Cad7b0f57ffe848cc8adf08d719c564d8%7Cf38a5ecd28134862b11bac > 1d563c806f%7C0%7C0%7C637006207919043258&sdata=0jIe1wKKWphh7%2FFhir > dYAB8Z8A4Qwbr%2BKIKcOdV5kMA%3D&reserved=0 _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

7 7