- Xymon - Xymon mailman web

custom scripts
by balasubramaniann.1＠tcs.com 05 Sep '07

05 Sep '07

Hi all, can anyone guide me how to make a customized scripts in hobbit at present i have made RHEL4 as hobbit server i have not installed from source rather than i installed from rpm provided from razoredge and other client include solairs and hp-ux i had more tha 100 servers the tips and tricks provided in hobbit is not sufficient for me plz tell how to write customized script where to put the script at client side and server side Thanks&Regards Balasubramanian.N Tata Consultancy Services Maker Towers 'E' Block, 11th Floor, Cuffe Parade, Colaba, Mumbai - 400 005,Maharashtra India Cell:- 9967214514 Mailto: balasubramaniann.1 at tcs.com Website: http://www.tcs.com ____________________________________________ Experience certainty. IT Services Business Solutions Outsourcing ____________________________________________ =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

Graphing number of references to iptables chain
by allan＠zandahar.net 05 Sep '07

05 Sep '07

Hi all, Just wondering if anyone has done or has seen a way of being able to graph the number of references to an iptables chain ? We have a script on our mailserver that scans the logs for IP's in DNSBL's or that issue pregreeting commands and then adds them to the firewall and drops the packets. We end up with a 'flt-smtp' chain that lists all the IP addys it found, if they match it then calls another chain 'spammer' which logs the attempt and drops/rejects the packet. This ends up with a few hundred to a few thousand ip's blocked every month with the # being the number of references to the spammer chain. 'iptables -L spammer' returns currently for example # iptables -L spammer Chain spammer (2269 references) target prot opt source destination LOG all -- anywhere anywhere LOG level debug prefix `Spammer: ' DROP all -- anywhere anywhere Unfortunately I have zero skills when it comes to rrd and the like so I'm looking for something similar I can change to suit or for someone to be really generous and help me out. The script I'm using is over at http://www.impsec.org/~jhardin/antispam/spammer-firewall Cheers Allan

5 6

[hobbit] Possible bug in trace with conn=
by spah＠syntec.co.uk 05 Sep '07

05 Sep '07

Sorry - I'm using Hobbit 4.2.0 with hobbitping. -----Original message----- From: "Sebastian Auriol" spah at syntec.co.uk Date: Wed, 05 Sep 2007 10:13:21 +0100 To: hobbit at hswn.dk Subject: [hobbit] Possible bug in trace with conn= > Hello, > > I have a host where I am using conn=worst and trace in bb-hosts. It seems that if one of the IP addresses is down, hobbit is doing a traceroute to the wrong IP address - I expect a traceroute to the IP address that is down... > > In this example, IPAdress4 is unreachable but hobbit does a traceroute to IPAdress1. > Here is the conn page: > > > Mon Sep 3 18:15:31 2007 conn NOT ok > > Service conn on MyRouter is not OK : Host responds to ping on 4 of 5 IP's > > > System unreachable for 3 poll periods (567 seconds) > > green IPAdress1 is alive (43 ms) > green IPAdress2 is alive (22 ms) > green IPAdress3 is alive (44 ms) > red IPAdress4 is unreachable > green IPAdress5 is alive (1 ms) > Traceroute results: > traceroute to IPAdress1 (IPAdress1), 30 hops max, 38 byte packets > 1 x.x.x.x (x.x.x.x) 0.931 ms 0.840 ms 0.820 ms > 2 y.y.y.y (y.y.y.y) 1.661 ms 2.222 ms 1.795 ms > > > bb-hosts: > IPAdress1 MyRouter # testip conn conn=worst,IPAdress2,IPAdress3,IPAdress4,IPAdress5 trace NET:MyBBNET > > Kind regards, > > Sebastian > > To unsubscribe from the hobbit list, send an e-mail to > hobbit-unsubscribe at hswn.dk > >

1 0

Possible bug in trace with conn=
by spah＠syntec.co.uk 05 Sep '07

05 Sep '07

Hello, I have a host where I am using conn=worst and trace in bb-hosts. It seems that if one of the IP addresses is down, hobbit is doing a traceroute to the wrong IP address - I expect a traceroute to the IP address that is down... In this example, IPAdress4 is unreachable but hobbit does a traceroute to IPAdress1. Here is the conn page: Mon Sep 3 18:15:31 2007 conn NOT ok Service conn on MyRouter is not OK : Host responds to ping on 4 of 5 IP's System unreachable for 3 poll periods (567 seconds) green IPAdress1 is alive (43 ms) green IPAdress2 is alive (22 ms) green IPAdress3 is alive (44 ms) red IPAdress4 is unreachable green IPAdress5 is alive (1 ms) Traceroute results: traceroute to IPAdress1 (IPAdress1), 30 hops max, 38 byte packets 1 x.x.x.x (x.x.x.x) 0.931 ms 0.840 ms 0.820 ms 2 y.y.y.y (y.y.y.y) 1.661 ms 2.222 ms 1.795 ms bb-hosts: IPAdress1 MyRouter # testip conn conn=worst,IPAdress2,IPAdress3,IPAdress4,IPAdress5 trace NET:MyBBNET Kind regards, Sebastian

1 0

[hobbit] BBcmd and external reports
by deger＠cobercafe.net 05 Sep '07

05 Sep '07

Hello Group, How do I make the bbcmd stay on all session in the system, I get a good 15minutes and all my external script stop running, because the bbcmd bash dosnt give the script a path to execute. Anyone got a good solution ?

1 0

Hobbit Ping Tests
by mprice＠sgt-inc.com 05 Sep '07

05 Sep '07

Hello, I have been using hobbit now for 2 years now and it works great :-) Thanks to everyone who has contributed... I was wondering how to tune the CONN tests, the ping testing. I know I can change the variable for the BB-Net to test every 1 minute -vs- the default of 5 minutes. But that adjusts all the network tests. I would like to just do it for ping testing. Also, what is a CONN failure and how many packets were sent and failed, for instance. Is 3 packets sent, and if 1 fails it alarms. Or does it have to be all 3. How can I fine tune this??? Thanks, michael Michael A. Price EOS/HST Network Security Engineer SGT, Inc. www.sgt-inc.com

1 0

Possible bug in FILE test
by paul＠moonkhan.org 04 Sep '07

04 Sep '07

I'm using Hobbit to monitor a list of files using the FILE test for size, owner, group and mode. However, if a filename contains a literal # then Hobbit reports <No data> on the CGI page for that file. Also, alerting doesn't work if the file tests fail. client-local.cfg: [testserver.foo.com] file:`find /path/to/files/ -type f` hobbit-clients.cfg: HOST=testserver.foo.com FILE %/path/to/files/.* yellow size<8M owner=daemon group=root mode=664 The CGI page shows all of the files in the directory correctly, including files with a '#' in their names, so I believe the 'find' command is working correctly. I don't know if the problem is with my regex glob of %/path/to/files/.* or if it is in the underlying checks that the hobbit client does on the files themselves. Thanks, -Paul Paul Barton http://www.moonkhan.org paul at moonkhan.org "Black holes are where God divided by zero."

1 0

Monitoring file: Permission denied
by andreas.kuntzagk＠mdc-berlin.de 04 Sep '07

04 Sep '07

Hi, I asked that already before but since I got no answer I will try to rephrase it: I try to monitor existance of a file on clients. I put a file:<path-to-file> entry in client-local.cfg and also FILE <path-to-file> in hobbit-clients.cfg It looks like hobbit is also aware of the need to monitor a file. The file column changed from grey to green. If I click on it, my file is shown as green. But when I click on this green icon, I get [file:/home/BIO/DO_NOT_DELETE] ERROR: No such file or directory When I look at the clients this file is readable by the hobbit user. So what can produce this strange error? Why is the file column still green? Where can I look for additional info about what's going on? I already looked at the help pages, man pages, wiki but probably missed the important part. Andreas

1 0

[hobbit] Disk Usage problems
by Robert-Manocchia＠IDEXX.com 04 Sep '07

04 Sep '07

We use an open source tool called hobbit to monitor file system disk usage among other things. Hobbit takes about 15 minutes to get up and running. The hobbit server is a virtual server located in the Westbrook data center. Please let me know how we can proceed. Robert Manocchia UNIX System Administrator IDEXX Laboratories 207 556-6860 EMail Robert-Manocchia at idexx.com -----Original Message----- From: Joshua Krause [mailto:joshuakrause at triad.rr.com] Sent: Tuesday, September 04, 2007 10:31 AM To: hobbit at hswn.dk Subject: [hobbit] Disk Usage problems I have a some servers grouped together with six other servers. Say I have "Server 1" and "Server 2" and Server 1 has the disks in a storage array mounted via /dev like so: Filesystem Size Used Avail Use% Mounted on /dev/sda2 7.9G 4.8G 2.7G 64% / /dev/sda1 99M 65M 30M 69% /boot /dev/sda3 24G 4.0G 19G 18% /export/home /dev/tr/17s 20G 202M 19G 2% /sys6 /dev/tr/8s 39G 749M 38G 2% /sys3 /dev/tr/11s 39G 878M 38G 3% /sys4 /dev/tr/14s 39G 886M 38G 3% /sys5 /dev/tr/5s 39G 875M 38G 3% /sys2 /dev/tr/2s 39G 837M 38G 3% /sys1 /dev/tr/23s 79G 5.0G 74G 7% /sys8 /dev/tr/20s 79G 4.7G 74G 6% /sys7 /dev/tr/17r 938G 36G 903G 4% /r6 /dev/tr/8r 1.9T 201G 1.7T 11% /r3 /dev/tr/11r 1.9T 225G 1.7T 12% /r4 /dev/tr/14r 1.9T 223G 1.7T 12% /r5 /dev/tr/2r 1.9T 199G 1.7T 11% /r1 /dev/tr/5r 1.9T 217G 1.7T 12% /r2 /dev/tr/20r 3.8T 1.4T 2.5T 36% /r7 /dev/tr/23r 3.8T 1.4T 2.5T 36% /r8 And Server 2 has what are called "vodfs" mounts which it mounts the drive via Server 1's ip like so: Filesystem Size Used Avail Use% Mounted on /dev/sda2 7.9G 4.6G 3.0G 61% / /dev/sda1 99M 34M 60M 37% /boot /dev/sda3 24G 2.8G 20G 13% /export/home 172.31.129.166:/dev/tr/5r 1.9T 217G 1.7T 12% /r2 172.31.129.166:/dev/tr/5s 39G 876M 38G 3% /sys2 172.31.129.166:/dev/tr/8s 39G 750M 38G 2% /sys3 172.31.129.166:/dev/tr/11s 39G 881M 38G 3% /sys4 172.31.129.166:/dev/tr/14r 1.9T 223G 1.7T 12% /r5 172.31.129.166:/dev/tr/14s 39G 887M 38G 3% /sys5 172.31.129.166:/dev/tr/11r 1.9T 225G 1.7T 12% /r4 172.31.129.166:/dev/tr/8r 1.9T 201G 1.7T 11% /r3 172.31.129.166:/dev/tr/2r 1.9T 199G 1.7T 11% /r1 172.31.129.166:/dev/tr/2s 39G 839M 38G 3% /sys1 172.31.129.166:/dev/tr/23r 3.8T 1.4T 2.5T 36% /r8 172.31.129.166:/dev/tr/17s 20G 202M 19G 2% /sys6 172.31.129.166:/dev/tr/23s 79G 5.0G 74G 7% /sys8 172.31.129.166:/dev/tr/17r 938G 36G 903G 4% /r6 172.31.129.166:/dev/tr/20s 79G 4.7G 74G 6% /sys7 172.31.129.166:/dev/tr/20r 3.8T 1.4T 2.5T 36% /r7 Now i need to have both servers monitoring the disk space because Server 2 is a backup to Server 1 and vice versa. So if I loose Server 1 then Server 2 automatically mounts the arrays as a /dev and not with the ip. My problem is that Server two is showing this: red /r2 (172% used) has reached the PANIC level (95%) red /sys2 (172% used) has reached the PANIC level (95%) red /sys3 (172% used) has reached the PANIC level (95%) red /sys4 (172% used) has reached the PANIC level (95%) red /r5 (172% used) has reached the PANIC level (95%) red /sys5 (172% used) has reached the PANIC level (95%) red /r4 (172% used) has reached the PANIC level (95%) red /r3 (172% used) has reached the PANIC level (95%) red /r1 (172% used) has reached the PANIC level (95%) red /sys1 (172% used) has reached the PANIC level (95%) red /r8 (172% used) has reached the PANIC level (95%) red /sys6 (172% used) has reached the PANIC level (95%) red /sys8 (172% used) has reached the PANIC level (95%) red /r6 (172% used) has reached the PANIC level (95%) red /sys7 (172% used) has reached the PANIC level (95%) red /r7 (172% used) has reached the PANIC level (95%) But as you can see from what the df -h command reads out they are no where near 100% let alone 172%. Does anyone have any suggestions? Thanks in advance To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

1 0

Disk Usage problems
by joshuakrause＠triad.rr.com 04 Sep '07

04 Sep '07

I have a some servers grouped together with six other servers. Say I have "Server 1" and "Server 2" and Server 1 has the disks in a storage array mounted via /dev like so: Filesystem Size Used Avail Use% Mounted on /dev/sda2 7.9G 4.8G 2.7G 64% / /dev/sda1 99M 65M 30M 69% /boot /dev/sda3 24G 4.0G 19G 18% /export/home /dev/tr/17s 20G 202M 19G 2% /sys6 /dev/tr/8s 39G 749M 38G 2% /sys3 /dev/tr/11s 39G 878M 38G 3% /sys4 /dev/tr/14s 39G 886M 38G 3% /sys5 /dev/tr/5s 39G 875M 38G 3% /sys2 /dev/tr/2s 39G 837M 38G 3% /sys1 /dev/tr/23s 79G 5.0G 74G 7% /sys8 /dev/tr/20s 79G 4.7G 74G 6% /sys7 /dev/tr/17r 938G 36G 903G 4% /r6 /dev/tr/8r 1.9T 201G 1.7T 11% /r3 /dev/tr/11r 1.9T 225G 1.7T 12% /r4 /dev/tr/14r 1.9T 223G 1.7T 12% /r5 /dev/tr/2r 1.9T 199G 1.7T 11% /r1 /dev/tr/5r 1.9T 217G 1.7T 12% /r2 /dev/tr/20r 3.8T 1.4T 2.5T 36% /r7 /dev/tr/23r 3.8T 1.4T 2.5T 36% /r8 And Server 2 has what are called "vodfs" mounts which it mounts the drive via Server 1's ip like so: Filesystem Size Used Avail Use% Mounted on /dev/sda2 7.9G 4.6G 3.0G 61% / /dev/sda1 99M 34M 60M 37% /boot /dev/sda3 24G 2.8G 20G 13% /export/home 172.31.129.166:/dev/tr/5r 1.9T 217G 1.7T 12% /r2 172.31.129.166:/dev/tr/5s 39G 876M 38G 3% /sys2 172.31.129.166:/dev/tr/8s 39G 750M 38G 2% /sys3 172.31.129.166:/dev/tr/11s 39G 881M 38G 3% /sys4 172.31.129.166:/dev/tr/14r 1.9T 223G 1.7T 12% /r5 172.31.129.166:/dev/tr/14s 39G 887M 38G 3% /sys5 172.31.129.166:/dev/tr/11r 1.9T 225G 1.7T 12% /r4 172.31.129.166:/dev/tr/8r 1.9T 201G 1.7T 11% /r3 172.31.129.166:/dev/tr/2r 1.9T 199G 1.7T 11% /r1 172.31.129.166:/dev/tr/2s 39G 839M 38G 3% /sys1 172.31.129.166:/dev/tr/23r 3.8T 1.4T 2.5T 36% /r8 172.31.129.166:/dev/tr/17s 20G 202M 19G 2% /sys6 172.31.129.166:/dev/tr/23s 79G 5.0G 74G 7% /sys8 172.31.129.166:/dev/tr/17r 938G 36G 903G 4% /r6 172.31.129.166:/dev/tr/20s 79G 4.7G 74G 6% /sys7 172.31.129.166:/dev/tr/20r 3.8T 1.4T 2.5T 36% /r7 Now i need to have both servers monitoring the disk space because Server 2 is a backup to Server 1 and vice versa. So if I loose Server 1 then Server 2 automatically mounts the arrays as a /dev and not with the ip. My problem is that Server two is showing this: red /r2 (172% used) has reached the PANIC level (95%) red /sys2 (172% used) has reached the PANIC level (95%) red /sys3 (172% used) has reached the PANIC level (95%) red /sys4 (172% used) has reached the PANIC level (95%) red /r5 (172% used) has reached the PANIC level (95%) red /sys5 (172% used) has reached the PANIC level (95%) red /r4 (172% used) has reached the PANIC level (95%) red /r3 (172% used) has reached the PANIC level (95%) red /r1 (172% used) has reached the PANIC level (95%) red /sys1 (172% used) has reached the PANIC level (95%) red /r8 (172% used) has reached the PANIC level (95%) red /sys6 (172% used) has reached the PANIC level (95%) red /sys8 (172% used) has reached the PANIC level (95%) red /r6 (172% used) has reached the PANIC level (95%) red /sys7 (172% used) has reached the PANIC level (95%) red /r7 (172% used) has reached the PANIC level (95%) But as you can see from what the df -h command reads out they are no where near 100% let alone 172%. Does anyone have any suggestions? Thanks in advance

1 0