- Xymon - Xymon mailman web

xymond_rrd program crashed
by tschmidt＠micron.com 07 Aug '19

07 Aug '19

Andreas, I likewise am seeing xymond_rrd program crashing with 4.3.29 but it did not with 4.3.28. If you look at the differences in the xymond/rrd/do_netstat.c between 4.3.28 and 4.3.29 you will see that the code was updated to handle newer Linux systems net-tools format. Your logs also show that it is not recognizing the OS for your "rackstation*" hosts. I do not know what type of OS these systems are, but you may have to update your netstat monitor or the xymond/rrd/do_netstat.c code to recognize their netstat output format. For me, xymond_rrd is crashing when trying to extract RRD data from some of our temperature reports. Some of our older temperature monitors returned data in this format: Device Temp(C) Temp(F) Threshold(C) ------------------------------------------------------ &green System Board Inlet Temp 21 69 ( 42) &green CPU1 Temp 32 89 ( 93) &green CPU2 Temp 31 87 ( 93) ------------------------------------------------------ Xymon 4.3.28 handled this properly by treating the data in the parenthesis as comments. Attached is my patch to fix xymond/rrd/do_temperature.c to handle temperature reports like the above. Most of this code was already in 4.3.28 but I do not know why it was removed. Japheth, Please consider adding this patch for xymond/rrd/do_temperature.c to the next release. It also includes the stripping off of any leading bold and italic HTML tags from sensor names that I submitted earlier. Thanks...Tom [http://collab.micron.com/corp/brand/SiteAssets/Micron.png]<http://www.micron.com/> Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office: +1 (208) 368-4058 Fax: (208)368-2807 Email: tschmidt at micron.com<mailto:tschmidt at micron.com> Website: micron.com<http://www.micron.com/> Micron Technology, Inc., Confidential and Proprietary. From: Xymon <xymon-bounces at xymon.com> On Behalf Of Andreas Kunberger Sent: Monday, August 5, 2019 4:13 AM To: 'Xymon at xymon.com' <Xymon at xymon.com> Subject: [EXT] [Xymon] xymond_rrd program crashed Since we have updated to Xymon 4.3.29-1.el7.terabithia We get the xymond status: xymond_rrd program crashed Fatal signal caught! In the /var/log/messages we have: Aug 4 06:59:33 suse abrt-hook-ccpp[9966]: Process 8736 (xymond_rrd) of user 1000 killed by SIGABRT - dumping core Aug 4 06:59:34 suse abrt-server[9968]: Package 'xymon' isn't signed with proper key Aug 4 06:59:34 suse abrt-server[9968]: 'post-create' on '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' exited with 1 Aug 4 06:59:34 suse abrt-server[9968]: Deleting problem directory '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' and in /var/log/xymon/rrd-status 2019-08-04 06:58:43.164318 net-janus/ntpd.rrd: Bug - duplicate RRD data with same timestamp 1564894723, different data 2019-08-04 06:59:33.750946 Host 'rackstation' reports netstat for an unknown OS 2019-08-04 06:59:34.621163 xymond_channel: Child process 8736 died: Signal 6 2019-08-04 06:59:34.739280 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:34.986178 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:56.727302 Host 'rackstation3' reports netstat for an unknown OS 2019-08-04 06:59:57.603455 xymond_channel: Child process 9971 died: Signal 6 2019-08-04 06:59:58.136009 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:58.136109 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136150 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136192 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136316 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136374 xymond_channel: Peer not up, flushing message queue .... The Server runs on CentOS Linux release 7.6.1810 (Core) Thanks in advance! i.A. Andreas Kunberger -- Andreas Kunberger ZD/IT

2 1

Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)
by tschmidt＠micron.com 06 Aug '19

06 Aug '19

I did not mean for this to get into a debate. The systems I am monitoring with Xymon do not have underscores in their hostnames but many have the hyphen. When I queried my companies DNS server, a few CNAME records have underscores, but no A records have an underscore. Xymon could monitor a system using a CNAME record, so IMHO it should still allow it for the reporting and history features. Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary. -----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of Axel Beckert Sent: Monday, August 5, 2019 3:48 PM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update) Hi, On Mon, Aug 05, 2019 at 05:21:33PM -0400, Richard L. Hamilton wrote: > Seems to me that underscore is mainly a problem with address 0.0.0.0 > in hosts.cfg (name to IP address resolution via host naming services, > esp. if that ends up being DNS). If an IP address in hosts.cfg is > used, and the hostname there isn't used in some other way, I don't > guess it would matter. Hmmm, indeed https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipe… as well as RFC 608, 810 and 952 say that no other characters than letters, digits and hyphens are allowed. I'm though quite sure to already have seen hostnames with underscore and even a slash in the wild. The latter was though about 20 years ago or so where I saw router names of a university with a slash in their hostname. Traces of hostnames with slashes can also be found on the web, e.g. https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fserverfau… And underscore is explicitly mentioned in https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipe… So IMHO while not being standard-compliant hostnames, Xymon should accept at least hostnames with underscore, too. On the other hand, I don't think, it's necessary to also add the slash to the list of valid characters for hostnames as the dot is already in there, too, and hostnames which are allowed to contain "/../" are definitely no good. :-) Kind regards, Axel -- PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Farc.pasp.d… Mail: abe at deuxchevaux.org \ / Say No to HTML in E-Mail and Usenet Mail+Jabber: abe at noone.org X https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faxel.beck… / \ I love long mails: https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Femail.is-… _______________________________________________ Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymo…

2 1

Xymon ssl question
by zak.beck＠accenture.com 05 Aug '19

05 Aug '19

Hi David Thanks ? This sounds like a query about the sslcert test? This is part of the built-in server functionality and you?ll get way better answers from the mailing list than you?ll get from me. If the IPs are externally accessible you could try the Qualys SSL checker (https://www.ssllabs.com/ssltest/) to check for any SSL issues. Zak From: David Hickenbottom <david.hickenbottom at Ingeniousmed.com> Sent: Tuesday, 30 July 2019 19:40 To: Beck, Zak <zak.beck at accenture.com> Subject: [External] Xymon ssl question This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments. ________________________________ Hi Zak, You did a fantastic job of putting together the script to build the xymon client data for windows. Thank you. I had a question that you may be able to give me a bit of direction. I have about 20 webservers. Half of them report the SSL certificate issue properly, the other half do not. They just say SSL error. They do not show any evidence that they even see the SSL certificate. I was wondering if you have ever seen this and if there is a way to turn on logging so I can see it? Thank you for your time. Best regards, David Hickenbottom Technical Operations Manager Ingenious Med (o) 678-486-4241 | (m) 770.335.2596 www.ingeniousmed.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ingeniousmed.com_&d…> ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

2 1

xymond_rrd program crashed
by andreas.kunberger＠ditf.de 05 Aug '19

05 Aug '19

Since we have updated to Xymon 4.3.29-1.el7.terabithia We get the xymond status: xymond_rrd program crashed Fatal signal caught! In the /var/log/messages we have: Aug 4 06:59:33 suse abrt-hook-ccpp[9966]: Process 8736 (xymond_rrd) of user 1000 killed by SIGABRT - dumping core Aug 4 06:59:34 suse abrt-server[9968]: Package 'xymon' isn't signed with proper key Aug 4 06:59:34 suse abrt-server[9968]: 'post-create' on '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' exited with 1 Aug 4 06:59:34 suse abrt-server[9968]: Deleting problem directory '/var/spool/abrt/ccpp-2019-08-04-06:59:33-8736' and in /var/log/xymon/rrd-status 2019-08-04 06:58:43.164318 net-janus/ntpd.rrd: Bug - duplicate RRD data with same timestamp 1564894723, different data 2019-08-04 06:59:33.750946 Host 'rackstation' reports netstat for an unknown OS 2019-08-04 06:59:34.621163 xymond_channel: Child process 8736 died: Signal 6 2019-08-04 06:59:34.739280 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:34.986178 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:56.727302 Host 'rackstation3' reports netstat for an unknown OS 2019-08-04 06:59:57.603455 xymond_channel: Child process 9971 died: Signal 6 2019-08-04 06:59:58.136009 xymond_channel: Peer at 0.0.0.0:0 failed: Broken pipe 2019-08-04 06:59:58.136109 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136150 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136192 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136316 xymond_channel: Peer not up, flushing message queue 2019-08-04 06:59:58.136374 xymond_channel: Peer not up, flushing message queue .... The Server runs on CentOS Linux release 7.6.1810 (Core) Thanks in advance! i.A. Andreas Kunberger -- Andreas Kunberger ZD/IT

1 0

Removing user from alerts
by chrisp＠lightstoneauto.co.za 03 Aug '19

03 Aug '19

Good morning One of our exemployees that left the company keeps on receiving sms alerts from xymon, I already removed all traces of his number / email address from the alerts configs but he still received sms's. Where can look why alerts are still being sent to this user? Regards [cid:image001.png at 01D5490C.EACE1FF0] Chris Pretorius Senior Linux Administrator [Lightstone] chrisp at lightstone.co.za<mailto:chrisp at lightstone.co.za> www.lightstone.co.za<https://www.lightstone.co.za/> 0108228687 Centurion Square, 3rd Floor, cnr Heuwel and Gordon Hood rd, Centurion [cid:image003.png at 01D5490C.EACE1FF0]<https://www.linkedin.com/company/lightstone-pty-ltd/> [cid:image004.png at 01D5490C.EACE1FF0] <https://twitter.com/lightstonetweet> [cid:image005.png at 01D5490C.EACE1FF0] <https://www.facebook.com/lightstone.sa> This communication is subject to Lightstone's email disclaimer<http://www.lightstone.co.za/portal/content/email-disclaimer.aspx>

2 1

rrd data capture and multiple tests with missing data
by mtpins＠nndev.org 03 Aug '19

03 Aug '19

Boldt, David writes: >In a test defined to store 4 values for graphing I am unable to >arrange for the storage of the available information if >information for any variable is missing. >In many runs of the test not all of the variables will have data. >I've tried: > * omitting the variables where there are no values > * listing the variable without data > * setting the value to NaN for missing data > * setting the value to a number below the rrd "--minimum" for the variable >In all of these cases no data is stored for the interval if any of the >variables has no data. (Am using NCV parsing of the status.) >I am able to store and graph the data for all 4 variables if I set missing >values to zero, but this provides unsatisfactory looking graphs and >incorrect averages. >xymon version 4.3.28 on CentOS 7. Use SPLITNCV rather than NCV, then use FNPATTERN in graphs.cfg.

1 0

Frequent purple alerts
by tlwilliams4＠vcu.edu 01 Aug '19

01 Aug '19

In my xymonclient_config.xml file I specify the logs to be generated in C:\Logs <clientlogfile>c:\Logs\xymonclient.log</clientlogfile>. Yours may be in folder with script. Look at the xymonclient.log file which contains the transmission data. Look for the size of the Sent file. If your buffers are set too low on Xymon server, data file gets truncated, usually causing White, not purple. 2019-07-10 12:28:43.087 Sending to server 2019-07-10 12:28:43.087 Using "original" ASCII encoding 2019-07-10 12:28:43.087 Connecting to host 128.172.5.33 2019-07-10 12:28:43.103 Sent 54761 bytes to server 2019-07-10 12:28:43.309 Received 436 bytes from server Tim Williams On Wed, Jul 10, 2019 at 12:23 PM Jaime Kikpole via Xymon <xymon at xymon.com> wrote: > > > > ---------- Forwarded message ---------- > From: Jaime Kikpole <jkikpole at cairodurham.org> > To: "Root, Paul T" <Paul.Root at centurylink.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 10 Jul 2019 12:21:42 -0400 > Subject: Re: Frequent purple alerts > On Wed, Jul 10, 2019 at 11:44 AM Root, Paul T <Paul.Root at centurylink.com> > wrote: > >> This could be the network is too congested. >> > > That seems unlikely. The Xymon server and clients are all on one of two > VM clusters, so there aren't a lot of "hops" and the bandwidth is very high. > > The Xymon client is one of two AD controllers, named dir1 and dir2. The > one with purple alerts is dir2. On dir1, we also have .1x authentication, > but they're otherwise pretty much the same. Their biggest difference is > RAM: 8GB for dir1 and 4GB for dir2. Do you think I should increase the > RAM? Other than leaving Task Manager open at all times and hoping to catch > it as soon as the purple alert occurs, I'm not sure how to check if it's > running out of RAM. > > > >> Or the computer is overloaded. Or even that it is sending messages that >> are too big (a frequent Windows problem in my experience – log files get so >> big). >> >> > Any way to check on the log size? > > > >> Does it go purple for 1 minute, 5 minutes, 30 minutes? >> > > I just looked at the log. The purple alert durations are roughly 40 > minutes each during the last three occasions. > > If it helps, this server is an Active Directory domain controller, but it > is one of two and the other one (a) has more stuff running on it, such as > .1x authentication for our wifi and (b) isn't having this issue. > > Thanks for the advice! > > > > > Jaime Kikpole > > Director of Technology & Innovations > Cairo-Durham Central School District > (518) 622-8543, x59500 > cairodurham.org <http://www.cairodurham.org> > > Technical Support: > help at cairodurham.org > go.cairodurham.org/techtips > > [image: Google Certified Educator, Level 1] [image: Google Certified > Educator, Level 2] > > > > This electronic message and any attachment(s) may contain confidential or > legally privileged information protected by law from further disclosure and > is intended only for the individual or entity identified above as the > addressee. If you are not the addressee (or the employee or agency > responsible to deliver it to the addressee), or if this message has been > addressed to you in error, you are hereby notified that you may not copy, > forward, disclose or use any part of this message or any attachment(s). > Please notify the sender immediately by return email or telephone and > permanently delete this message and attachment(s) from your system. > > > ---------- Forwarded message ---------- > From: Jaime Kikpole via Xymon <xymon at xymon.com> > To: "Root, Paul T" <Paul.Root at centurylink.com> > Cc: "xymon at xymon.com" <xymon at xymon.com> > Bcc: > Date: Wed, 10 Jul 2019 12:21:42 -0400 > Subject: Re: [Xymon] Frequent purple alerts > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

3 3

I need help troubleshooting a xymon issue
by david.hickenbottom＠Ingeniousmed.com 31 Jul '19

31 Jul '19

Hi, First of all Thank You! This is a fantastic product. I have two problems. The first is with regards to SSL monitoring. I have a group of 20 or so webservers. Half monitor the SSL certificate correctly, the others act like they do not see one. [cid:image001.png at 01D54776.1322ABD0] It looks good from every way I can look at it, but Xymon is not happy! Is there a way for me to see what is going on? This second problem, although not a big issue, some of our servers report back an extremely large client file - the active connections list is so long the complete file does not get ingested. I have tried changing the max lines parameter, but that had not made any difference. On some of them I changed to order of the report so the data that is typically after the ports section is ingested and the ports data is dropped off. Losing part of the ports data does not appear to cause a problem and I cannot tell by the current monitors I am even missing data. (it would be interesting to see how many connections - listening, established and waiting - are reported). Best regards, David Hickenbottom

3 4

rrd data capture and multiple tests with missing data
by dboldt＠usgs.gov 30 Jul '19

30 Jul '19

In a test defined to store 4 values for graphing I am unable to arrange for the storage of the available information if information for any variable is missing. In many runs of the test not all of the variables will have data. I've tried: * omitting the variables where there are no values * listing the variable without data * setting the value to NaN for missing data * setting the value to a number below the rrd "--minimum" for the variable In all of these cases no data is stored for the interval if any of the variables has no data. (Am using NCV parsing of the status.) I am able to store and graph the data for all 4 variables if I set missing values to zero, but this provides unsatisfactory looking graphs and incorrect averages. xymon version 4.3.28 on CentOS 7. -- David Boldt <dboldt at usgs.gov> "Anybody can sympathise with the sufferings of a friend, but it requires a very fine nature to sympathise with a friend's success." --Oscar Wilde (1854 - 1900)

1 0

holidays.cfg and "Black Friday"
by robert.herron＠gmail.com 26 Jul '19

26 Jul '19

We have the day after [US] Thanksgiving (aka Black Friday) off. I'm trying to add the day after to the holidays.cfg file but have a problem. Thanksgiving is always the 4th Thursday of the month. The day after varies depending on first day of the month. It's 5th Friday this year but was the 4th Friday last and next years. It's defined as "Day after Thanksgiving:type=+fri month=11 day=23" which works for this year. I haven't tried testing this for last or next years as I don't know how to. Is there a better way to do this? Also, could you please point me in the right direction to testing this. Thanks, --Robert

1 0