- Xymon - Xymon mailman web

protocols.cfg smtp chat
by Hauke Fath 10 Dec '24

10 Dec '24

Hi, I am trying to monitor the health of a couple of smtp servers (sendmail) with a xymon instance. As part of spam prophylaxis, these servers delay the initial response to contact by a few seconds, and drop any rogue clients that forego the handshake and just start pipelining their payload. Unfortunately, xymonnet(?) does the same, gets shown the door, and sulks with "Service smtp on $server is not OK : Unexpected service response". I tried to play with the smtp chat in protocols.cfg [smtp] expect "220" send "ehlo xymonnet.localdomain\r\n" expect "250" send "quit\r\n" expect "221" options banner port 25 without success. tcpdump(8)ing the communication, I was quite surprised to find that whatever I entered for the smtp chat, I always see xymon sending a 'quit', and sendmail returning a "220" banner. This is confirmed by the xymon banner output. My questions: o Is it even possible for the xymon client to first wait for the server's "220" greeting before shooting off its mouth? o Where in the code does the smtp client communication happen? o What could have gone wrong for xymon to ignore the configuration in protocols.cfg without any trace in the logs? Cheerio, Hauke -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

3 2

RRD updates for hours, then stops updating for hours
by oliver＠placeq.com 06 Nov '24

06 Nov '24

Hopefully I can explain this properly because I don't really understand what's going on. I'm running 4.3.30 (Terabithia RPMs) on Centos 6.10 I have an external server that reports the number of files waiting to be processed by our internal app. We want this number to be 1 (0 means a problem, more than 1 means a queue is building) but for testing purposes I'm overriding the number using FILE_COUNT="$(( ( RANDOM % 31 ) ))" to give me any number between 0 and 30 I see this reflected correctly in my XYMONSRV status page. Every 5 minutes it reflects the new value and changes colour accordingly but I don't always see the associated RRD get updated. Here's what I see if I tcpdump on the client (and grep for TTlogs.) It is sent every 5 minutes without fail. .status myserver.TTlogs red The count is too high. Data corruption may occur if this reaches 30. [ fileCount:20 ] However, my associated RRD file hasn't updated in nearly 3 hours: $ date Wed Nov 6 18:30:04 GMT 2024 $ ls -l TTlogs.rrd -rw-r--r-- 1 xymon xymon 217352 Nov 6 15:49 TTlogs.rrd My troubleshooting of RRD is weak but maybe this will help. The timestamp that 'rrdtool lastupdate' shows is 15:39 which corresponds with the timestamp on the file $ rrdtool lastupdate TTlogs.rrd fileCount 1730905160: 1 Fetching the LAST readings gives (with comments by me): $ rrdtool fetch TTlogs.rrd LAST fileCount 1730831700: -nan (time is November 5, 2024, at 20:15:00) ...same reading at 300 intervals until... 1730844300: -nan 1730844600: 1.0000000000e+00 (time is November 6, 2024, at 00:10:00) ... same at 300 intervals... 1730904900: 1.0000000000e+00 (time is November 6, 2024, at 15:35:00) 1730905200: -nan (time is November 6, 2024, at 15:40:00) ... same at 300 intervals... 1730918100: -nan (time is November 6, 2024, at 19:15:00 - in the future?) So it was updating with 1 (the real reading) from 00:10:00 to 15:35:00 and then went back to -nan and it refuses to update even when I'm changing the reading every 5 minutes TTlogs.rrd was generated automatically so it should be set up with whatever the Xymon defaults are. My xymon config for TTlogs is an external file in xymonserver.cfg.d with: TEST2RRD+=",TTlogs=ncv" GRAPHS+=",TTlogs" NCV_TTlogs="fileCount:GAUGE" I'm not exactly sure what this, if anything, tells me but maybe it helps <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE rrd SYSTEM "http://oss.oetiker.ch/rrdtool/rrdtool.dtd">  <rrd> <version>0003</version> <step>300</step>  <lastupdate>1730905160</lastupdate>  <ds> <name> fileCount </name> <type> GAUGE </type> <minimal_heartbeat>600</minimal_heartbeat> <min>NaN</min> <max>NaN</max>  <last_ds>1</last_ds> <value>2.6000000000e+02</value> <unknown_sec> 0 </unknown_sec> </ds>  I'm kind of lost on what is going on. Any ideas of how to troubleshoot further? Any help or advice would be gratefully received.

1 1

RRDtool
by Kim Scarborough 02 Nov '24

02 Nov '24

Hi folks, Trying to set up a Xymon 4,4 server and I'm getting these errors when it tries to detect the latest RRDtool: Checking for RRDtool ... Not RRDtool 1.0.x, checking for 1.4.x test-rrd.c: In function 'main': test-rrd.c:28:42: error: passing argument 2 of 'rrd_flushcached' from incompatible pointer type [-Wincompatible-pointer-types] 28 | result = rrd_flushcached(pcount, rrdargs); printf("%d", result); | ^~~~~~~ | | | char ** In file included from test-rrd.c:3: /usr/include/rrd.h:242:18: note: expected 'const char **' but argument is of type 'char **' 242 | const char **argv); | ~~~~~~~~~~~~~^~~~ test-rrd.c:32:36: error: passing argument 2 of 'rrd_graph' from incompatible pointer type [-Wincompatible-pointer-types] 32 | result = rrd_graph(pcount, rrdargs, &calcpr, &xsize, &ysize, NULL, &ymin, &ymax); printf("%d", result); | ^~~~~~~ | | | char ** /usr/include/rrd.h:185:5: note: expected 'const char **' but argument is of type 'char **' 185 | const char **, | ^~~~~~~~~~~~~ make: *** [Makefile.test-rrd:4: test-compile] Error 1 Not RRDtool 1.0.x or 1.4.x, checking for 1.2.x test-rrd.c: In function 'main': test-rrd.c:32:36: error: passing argument 2 of 'rrd_graph' from incompatible pointer type [-Wincompatible-pointer-types] 32 | result = rrd_graph(pcount, rrdargs, &calcpr, &xsize, &ysize, NULL, &ymin, &ymax); printf("%d", result); | ^~~~~~~ | | | char ** In file included from test-rrd.c:3: /usr/include/rrd.h:185:5: note: expected 'const char **' but argument is of type 'char **' 185 | const char **, | ^~~~~~~~~~~~~ make: *** [Makefile.test-rrd:4: test-compile] Error 1 ERROR: Cannot compile with RRDtool. ERROR: Linking with RRDtool fails RRDtool include- or library-files not found. Any thoughts or fixes? -- Kim Scarborough

4 4

Re: RRDtool
by Kim Scarborough 02 Nov '24

02 Nov '24

On 11/1/24 6:45 PM, Ralph M wrote: > You need the rrdtool and rrdtool development packages. What they're > called will depend on which version of Linux you're installing on. I > have an old Centos 7 with these packages installed: > rrdtool-devel-1.5.5-1.1.el7.x86_64 > rrdtool-1.5.5-1.1.el7.x86_64 I do have rrdtool installed. It's just that it's 1.9, the current version. I wouldn't have gotten those errors if it hadn't been installed at all. -- Kim Scarborough

1 0

Need help with NOEXIST for a directory
by Grant Taylor 01 Nov '24

01 Nov '24

Hi, I need some help getting NOEXIST to work for a directory. I want to make sure that the /run/log/journal directory doesn't exist. I see the NOEXIST option, but it seems to be for a FILE and I'm not sure what FILE semantics also apply to DIR. Thus far I've not been able to get it to work correctly. -- Grant. . . . unix || die

4 7

Serious issue with Xymon hanging
by Neil Simmonds 30 Oct '24

30 Oct '24

Hi all, This morning our Xymon system (Xymon 4.3.30-1.el8.terabithia on RHEL 8.6) was showing the main screens but when clicking on any status to see the data I was getting "no such host". I restarted Xymon and it all came back but all pages completely reloaded. We're missing RRD data for almost 24 hours. at 08:30 yesterday we started getting the following in xymongen.log which carried on every minute until I restarted it at 08:25 this morning. 2024-10-27 08:30:30.501407 xymond status-board not available, code 0 2024-10-27 08:30:30.501489 Failed to load current Xymon status, aborting page-update There's nothing in xymonlaunch.log or xymonnet.log but at that time we got the following in xymond.log (actual servernames have been changed to "servername" 2024-10-27 08:30:13.048311 WARNING: Cannot open directory /etc/xymon/hosts.d 2024-10-27 08:30:13.048338 WARNING: Cannot open directory /etc/xymon/v9hosts.d 2024-10-27 08:30:13.048344 WARNING: Cannot open directory /etc/xymon/dynamicHosts.d 2024-10-27 08:30:13 Flushing filecache 2024-10-27 08:30:13 Rescanning host tree 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername 2024-10-27 08:30:13 Sending dropstate (from xymond) with servername etc, etc ..... Then we repeatedly got 2024-10-27 08:35:13 Reloading hostnames 2024-10-27 08:35:13 Flushing filecache 2024-10-27 08:35:13 Reloading client config 2024-10-27 08:35:58.233008 Bogus message from 10.105.3.100: Invalid new hostname 'servername' 2024-10-27 08:35:58.233102 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:36:00 Saving checkpoint file 2024-10-27 08:36:38 Generating stats 2024-10-27 08:36:38.074722 xymond servername MACHINE='ukawsmon01' not listed in hosts.cfg, dropping xymond status 2024-10-27 08:36:57.044131 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:36:57.044237 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:37:56.564893 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:37:56.564989 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:39:02.010103 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:39:02.010177 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:40:00.879305 Bogus message from 10.105.3.100: Invalid new hostname ' servername' 2024-10-27 08:40:00.879360 Bogus message from 10.105.3.100: Invalid new hostname ' servername' Has anyone ever seen this before? Kind regards, Neil. Neil Simmonds Senior Platform & Middleware Engineer (Unix) [cid:fgfs_e04c0205-c635-4f54-817e-d1a70ae03721.jpg] PHONE 0344 245 9200 ADDRESS Unit A Brook Park East, NG20 8RY Credit is provided by Frasers Group Financial Services Limited (Registered Company no. 00718151), which is authorised and regulated by the Financial Conduct Authority (FRN 311908) for consumer credit and general insurance and a member of the Finance and Leasing Association. Frasers Group Financial Services Limited is registered in England and its registered office is: Express House, Petre Road, Clayton Business Park, Accrington, Lancashire, BB5 5JB. Studio is a trading name used by both Frasers Group Financial Services Limited and Studio Retail Trading Limited. For regulated payment services, Frasers Group Financial Services Limited is a payment agent of Transact Payments Limited, a company authorised and regulated by the Gibraltar Financial Services Commission as an electronic money institution. Transact Payments Limited, a company incorporated in Gibraltar (No 108217). Registered address 6.20 World Trade Center, 6 Bayside Road, Gibraltar, GX11 1AA. Disclaimer | Frasers Group<https://frasers.group/legal/disclaimer>

2 3

xymon package for Ubuntu 24.04.1 LTS
by Bruce Ferrell 27 Oct '24

27 Oct '24

The distribution package this distro seems to be failing for various of the binaries; ghostlist.sh is failing with buffer overflow crashes. Any suggestions on doing a correct build on this?

2 2

RDP TLS cert monitoring
by Grant Taylor 25 Oct '24

25 Oct '24

Hi, How do I have Xymon monitor the TLS cert used by RDP? I can easily get the cert using the following commands: openssl s_client -connect <IP>:3389 < /dev/null |& openssl x509 -noout -startdate -enddate I'd like to apply the same type of logic to RDP that the HTTPS tests use for certificate expiration warning / critical. I skimmed the hosts.cfg manual and didn't find a way to monitor TLS for arbitrary ports. I also don't think that the static [rdp] entry in protocols.cfg can be extended to monitor dynamic TLS information. Any guidance would be appreciated. -- Grant. . . . unix || die

3 5

Yellow for HTTP content tests?
by Jeremy Laidman 26 Sep '24

26 Sep '24

Hi I have an http content test that goes red if the webpage doesn't contain the string "Status: OK". The hosts.cfg entry is like so: 10.11.12.13 myhost.example.com cont;http://10.11.12.13:80/;Status:.OK I can manually take a server out of the pool (eg for patching), by changing the webpage content to contain "manually disabled". When this happens, the http test goes red, but I want the status to instead change to yellow. Is there a way to set the colour of the http test depending on the content? The doco doesn't mention anything like this. I'm guessing that this is not supported, and I'll need to knock up a script for this. Cheers Jeremy

1 0

Xymon on Ubuntu 24.04
by Chris Pretorius 24 Sep '24

24 Sep '24

Good day I please need guidance to configure xymon on Ubuntu 24.04 I installed xymon from the default apt repository. It's a VM running in Azure and installed using the repo that was setup for a Ubuntu vem on azure. Also changed the repo to the default mirrors.kernel.org and installed xymon from there. # apt-cache policy xymon xymon: Installed: 4.3.30-2build3 Candidate: 4.3.30-2build3 Version table: *** 4.3.30-2build3 500 500 https://mirrors.kernel.org/ubuntu noble/universe amd64 Packages 100 /var/lib/dpkg/status Xymon does start and generates the pages which I can view but is missing the client tests (disk, cpu, memory etc..), and the rrd graphs Confirm port 1984 is listening I see a bug was also recently reported here https://bugs.launchpad.net/ubuntu/+source/xymon/+bug/2078638 I see similar entries in the xymon {clientdata.log, rrd-status.log alert.log } files, repeating. **** snip **** 2024-09-13 14:50:52.967847 Peer not up, flushing message queue *** buffer overflow detected ***: terminated 2024-09-13 14:50:53.187820 Child process 5496 died: Signal 6 2024-09-13 14:51:52.977025 Peer at 0.0.0.0:0 failed: Broken pipe **** snip **** This is a fresh install and the only change I made in xymonserver.cfg are: XYMONSERVERIP="server ip" Firewall disabled Apparmor disabled Thank you. ChrisP

6 17