- Xymon - Xymon mailman web

Some filesystem graphs not showing in disk page, only in trends
by danyiem＠vcu.edu 07 Mar '19

07 Mar '19

Hi everyone, We are running Xymon 4.3.28-1.el7.terabithia on CentOS 7.6 - Last night we noticed that the graph for the /var directory fs on one of our servers (which was filling up) was not showing up in the disk page. Digging in to the trends for the server it did show up - it looks like tons of /run/user/$uid RRD files are being created for this server, is there a limit to the number of graphs will show on the main disk page vs the trends page? Is there a way to configure this so temporary file systems will be excluded? Thanks, *Eliza Danyi* Operating Systems Analyst VCU Computer Center E-mail: danyiem at vcu.edu *Don't be a phishing victim -- VCU and other reputable organizations will never use email to request that you reply with your password, social security number or confidential personal information. For more details, visit **https://ts.vcu.edu/about-us/information-security/common-questions/what-is-phishing/ <https://ts.vcu.edu/about-us/information-security/common-questions/what-is-p…> *

3 2

XymonPS error log handling
by tlwilliams4＠vcu.edu 04 Mar '19

04 Mar '19

Zak, I know you just worked on the Windows Event log handling. I have a few issues that may need some documentation guidance, or an enhancement. Basically, I'm trying to get Windows Defender log entries. We will be migrating from a commercial anti-virus platform to using the Defender and need to have alerting. Most important to me is that it appears that only the top-level logs listed in EventLogSummary can be parsed (example at end). As a test, I included the Windows PowerShell log in the clientconfig.cfg file. eventlogswanted:Windows PowerShell,system:7500:Warning,Critical,Error It took some experimentation with/without quotes as the code calls "Get-WinEvent -FilterXML $logFilterXML" and the QueryList uses -Path which states in Help file examples to use quotes if log file name has spaces. I found that the query creates double quotes as illustrated in excerpt below. <start Help file> -------------------------- EXAMPLE 11 -------------------------- PS C:\>Get-WinEvent -Path 'c:\ps-test\Windows PowerShell.evtx' This command gets events from a copy of the Windows PowerShell event log file in a test directory. The path is enclosed in quotation marks because the log name includes a space. <end help file> 2019-02-28 11:28:56 Processing event log Windows PowerShell 2019-02-28 11:28:56 Log filter <QueryList> <Query Id="0" Path="Windows PowerShell"> <Select Path="Windows PowerShell">*[System[TimeCreated[timediff(@SystemTime) <= 3600000] and (Level=3 or Level=1 or Level=2)]]</Select> </Query> </QueryList> My 2 issues: "-Path" parameter should be the actual path to log file per Help, but the QueryList appears to be using LogName format with name of log not path, is that correct? And actually, I am trying to get the entries in the Windows Defender log file which is at "%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx" by -Path or "Microsoft-Windows-Windows Defender/Operational" by -LogName. eventlogswanted:Windows PowerShell,system,Microsoft-Windows-Windows Defender/Operational:7500:Warning,Critical,Error I don't think the QueryList can handle the /Operational slash. The entry is ignored and no QueryList appears in log. Xymon can read the log; if I manually edit the $logenries I get the Defender entries in the client file. $logentries = @(get-winevent -logname "Microsoft-Windows-Windows Defender/Operational" -MaxEvents 50) I also have a question about the Max payload value ($maxpayloadlength) and how it is handled. Is that for the total of all the log files together, or per each log? If total, then a chatty log would prevent any entries in the other logs from being reported on? I would rather have most recent from each, and the value be 'per log'. Lastly as an aside, in the client data file there are two Event Log Summary sections that appear to be redundant. Is there a purpose for one vs. the other? We do have the Summary show under msgs column data. [EventlogSummary] Max(K) Retain OverflowAction Entries Log ------ ------ -------------- ------- --- 16,384 0 OverwriteAsNeeded 10,046 Application 20,480 0 OverwriteAsNeeded 0 HardwareEvents 512 7 OverwriteOlder 0 Internet Explorer 20,480 0 OverwriteAsNeeded 0 Key Management Service 15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience 16,384 0 OverwriteAsNeeded 10,183 Security 16,384 0 OverwriteAsNeeded 45,885 System 15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell [msgs:EventlogSummary] Max(K) Retain OverflowAction Entries Log ------ ------ -------------- ------- --- 16,384 0 OverwriteAsNeeded 10,046 Application 20,480 0 OverwriteAsNeeded 0 HardwareEvents 512 7 OverwriteOlder 0 Internet Explorer 20,480 0 OverwriteAsNeeded 0 Key Management Service 15,168 7 OverwriteOlder 2 Microsoft-ServerManagementExperience 16,384 0 OverwriteAsNeeded 10,183 Security 16,384 0 OverwriteAsNeeded 45,885 System 15,360 0 OverwriteAsNeeded 3,421 Windows PowerShell Thanks for your continuing support of a valuable tool! I'll keep playing with it, and post an update if I get a version working. Tim Williams VCU Computer Center

2 3

Need Hobbit client for an HP-UX 10.2 version ( Ancient/vintage software )
by Rick.Hershman＠CenturyLink.com 02 Mar '19

02 Mar '19

Does anyone know where I can locate a depot file or the executables for hobbit for an HP-UX 10.2 server ? Yes, this is like 20 years old..... It's not my fault we have these dinosaurs they want seen in Xymon.... Rick.Hershman at Centurylink.com Cell = 1 720 988 7452 Home = 1 321 802 3619 This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 1

CPU Average for 1 month via CLI
by howe.bill＠gmail.com 01 Mar '19

01 Mar '19

Hello, Is anyone aware of a way to generate reports via the CLI that show, for example, a host's CPU average over the last 30 days? I can get the data in graph form via the xymon web portal's "Metrics Reports" page, but need to gather this data point for a large number of hosts. I also looked at the manpage for 'xymon', and xymondboard appears to gather current stats, but I didn't see a way to gather a date range. Thank you, Bill Howe howe.bill at gmail.com <http://www.linkedin.com/in/whowe>

3 3

Xymondash issues
by john.alexander＠preachain.org 27 Feb '19

27 Feb '19

Hi all, I am having some issues with the Xymondash interface. Everything works fine - it's properly displaying fault conditions, except that it will not acknowledge or disable alerts. I only get a pop-up saying "could not acknowledge test" xymon2json works just fine. I get good json output. xymon-ack gives nothing but a blank screen. Same with xymon-disable Acknowledging from the xymon "Acknowledge Alert" works fine. Here is my config.ini - I'm on CentOS 7 so python3 was installed as an addition. --------------------------------------------------------------- # location of xymon executable in your file system XYMONCLI="/home/xymon/server/bin/xymon" # location of ackinfo.sh executable in your file system XYMONACKINFOSH="/home/xymon/cgi-secure/ackinfo.sh" # absolute URL of Xymon's svcstatus XYMONSVCSTATUSURL="http://xymon.imasneezer.com/xymon-cgi/svcstatus" <--- should this be svcstatus.sh? # location of Xymon's critical.cfg in your file system (if you have one) CRITICAL="/home/xymon/server/etc/critical.cfg" # relative URL of svcstatus.sh on your monitoring server XYMONURL="/xymon-cgi/svcstatus.sh" # relative URL of xymon-ack on your monitoring server XYMONACKURL="/xymondash/cgi/xymon-ack" # relative URL of xymon-disable on your monitoring server XYMONDISURL="/xymondash/cgi/xymon-disable" # relative URL of xymon2json on your monitoring server XYMONJSONURL="/xymondash/cgi/xymon2json" # host name of xymon server XYMONSERVER="xymon.imasneezer.com" # website title TITLE="Oak Street Medical xymon dashboard" # path to python3 interpreter PYTHON3="/usr/bin/env /opt/rh/rh-python36/root/usr/bin/python3" --------------------- Any ideas? John Alexander

2 6

Windows PS xymonclient
by Paul.Root＠CenturyLink.com 27 Feb '19

27 Feb '19

So I only have 6 windows servers that I'm concerned with in my xymon installation. Today, I decided to upgrade the service. So I downloaded the v2.34 ps1 file. And I copied the file in place and restarted via the services window. This worked just fine on 4 machines. But on 2 machines, I get the ports test gone red because I'm looking for RDP, but I'm getting no output at all. Going into who, it is also blank. Processes and SVCS are both fine. So next I started the powershell as an administrator, and did the 'Set-ExecutablePolicy RemoteSigned" and then did a .\xymonclient.ps1 install. Then a stop and start. Still stays the same blank page. Does anyone have any ideas? Paul Root Lead Operations Engineer - IT Managed Services 390 Commerce Dr Woodbury, Mn 55125 651-312-5207 paul.root at centurylink.com This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

5 20

clientlog empty if host offline
by kspringer＠innovateteam.com 22 Feb '19

22 Feb '19

Why does the 'clientlog' data go blank if a host goes offline? If the host is offline shouldn't the last collection of clientlog data still be on the server for viewing? I've needed to look at that data numerous times to see if it contains clues as to why the client went offline, but the file on the server shows blank until the client comes back online and it sends another batch of data to the server. Is there a setting I could change to keep the clientlog data viewable even if the host is offline? -- Thanks, Kris Springer

1 0

[Patch] xymond_rrd crash when parsing Linux ifconfig data
by steve＠opendium.com 22 Feb '19

22 Feb '19

This patch addresses two problems: 1. For Linux clients, do_ifstat_rrd parses the ifconfig output using the regex: ([a-z0-9]+(_[0-9]+)?:*|lo:?)\s pickdata() is called like this: pickdata(bol, ifstat_linux_pcres[0], 1, &ifname) With a network interface name such as "foo1", the regex produces 2 results: 0: "foo1 " 1: "foo1" pickdata() discards result 0 and assigns result 1 ("foo1") to the ifname parameter as expected. With a network interface name such as "foo_1", the regex produces 3 results: 0: "foo_1 " 1: "foo_1" 2: "_1" pickdata() discards result 0, assigns result 1 ("foo_1") to the ifname parameter and then tries to assign result 2 ("_1") to the next parameter in the variable argument list. Since there it no such parameter, this results in a segmentation fault and xymond_rrd crashes. The attached patch adds a "num_args" parameter to pickdata() to tell it how many arguments are in the variable argument list and ensure it never rolls off the end of that list. 2. I have some clients with network interface names in the form "foo.5", "foo_bar" and "foo-bar" ("eth0.5" is especially common when eth0 is carrying an 802.1q trunk, for example). Xymon does not collect statistics on those network interfaces because they don't match the regex. This patch relaxes the regex a bit so that it matches these network interfaces. -- - Steve Hill Technical Director Opendium Online Safety / Web Filtering http://www.opendium.com Enquiries: sales at opendium.com +44-1792-824568 Support: support at opendium.com +44-1792-825748 Opendium Limited is a company registered in England and Wales. Company No. 5465437 Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.

2 1

DS checks that check multiple values in analysis.cfg
by spah＠syntec.co.uk 22 Feb '19

22 Feb '19

Hi, has anyone done DS checks in analysis.cfg that test multiple values from the same rrd file? We have data in ncv format that gets written to an rrd file and I want to be able to check expressions against multiple values at the same time, e.g. in logic, where A, B, C and D are all graphed in the same rrd file : If A + B / C > 33% go red But if C < 10 go green anyway (override the above calculation, as it would not be statistically reliable) And if D > 30 go green anyway The man page doesn't state how rules should be written: http://xymon.sourceforge.net/xymon/help/manpages/man5/analysis.cfg.5.html#l… I've tried to read the code: https://sourceforge.net/p/xymon/code/HEAD/tree/branches/4.3.29/xymond/clien… But I'm not a C programmer so that didn't help me. Can anyone help? Kind regards, SebA

1 0

Windows XymonPSClient v2.37
by zak.beck＠accenture.com 21 Feb '19

21 Feb '19

Hi I have committed v2.37 today, this has a big performance related fix and other fixes - thanks to SebA <spah at syntec.co.uk<mailto:spah at syntec.co.uk>> and Andy abs at shadymint.com<mailto:abs at shadymint.com> for extra work and prompting in this area. Download from SVN<https://sourceforge.net/p/xymon/code/HEAD/tree/sandbox/WinPSClient/> (the documentation has been updated also, including uninstall instructions). The key fixes are: * replaced WMI call to get number of processors with Windows API call The WMI call to get processor information was taking anything from 4-5 seconds on most of my VMs, some experience much longer waits and high CPU usage while this WMI call executed. There have also been instances where the WMI call returns incorrect data or no data. This has been replaced with a call to GetNativeSystemInfo(), which should work on 32-bit and 64-bit platforms and in testing executes in milliseconds. * only supply diskpart data if EnableDiskPart = 1 There is a test in the client which uses 'diskpart' to gather information about clustering every slow scan. This is included in the data sent to Xymon, but it's not generally displayed - you can extract it for reporting if needed. Hardly anyone uses this and for some reason for some people it is causing memory issues in the Microsoft Virtual Disk Service. Therefore by default the test will now not be run, you can enable it with the EnableDiskPart setting in xymonclient_config.xml. * add a dummy, ignored config item in the internal client-local config table so that there is always some configuration present (even if nothing in the server-side client-local for this host) We found that if there is no client-local.cfg for the host and no default client-local.cfg (like [powershell] or [XymonPS]), on some platforms there appears to be a memory leak. The fix ensures there is always something in the internal cache of client-config even if nothing is received from the server. * XymonAcceptUTF8 - default (0) is now to use the original ASCII encoding, added setting for 'pure' ASCII coding which strips/converts diacritic characters Prior to this version, by default, the client uses ASCII encoding to send to the server but also attempts to encode/filter diacritic characters. This was added in v2.20, and for some people it adds a large time overhead when sending data. It's been changed so that the default setting of 0 acts like it did before v2.20 - no diacritic encoding - I'm calling this 'original' ASCII encoding. XymonAcceptUTF8 = 1 is unchanged, uses UTF8. XymonAcceptUTF8 = 2 is the v2.20 setting, use ASCII and encode/filter diacritics - I'm calling this 'pure' ASCII encoding. I don't think this will impact on many people other than saving time/cpu for the default setting. Full changelog: v2.37 * replaced WMI call to get number of processors with Windows API call * fixed servicecheck parentheses * use TLS for uploading data to xymoncgi if using http reporting and URL begins https * add milliseconds to log timestamp * add a dummy, ignored config item in the internal client-local config table so that there is always some configuration present (even if nothing in the server-side client-local for this host) * fix a couple of instances where we were using variables before they are assigned settings changes/additions: * XymonAcceptUTF8 - default (0) is now to use the original ASCII encoding, added setting for 'pure' ASCII coding which strips/converts diacritic characters * only supply diskpart data if EnableDiskPart = 1 Zak ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy. ______________________________________________________________________________________ www.accenture.com

3 7