- Xymon - Xymon mailman web

disabled fqdn not working
by kspringer＠innovateteam.com 04 Sep '18

04 Sep '18

An HTML attachment was scrubbed... URL: <http://lists.xymon.com/pipermail/xymon/attachments/20180901/4a97d7ce/attach…>

3 2

create an alert for all linux servers
by didds3＠yahoo.co.uk 31 Aug '18

31 Aug '18

OK - sorted :-) Somebody mentioned using "CLASS=" - success :-) HOST=* SERVICE=msgs CLASS=linux TIME=w:0800:1830 COLOR=red many thanks all for all your help. didds

1 0

create an alert for all linux servers
by didds3＠yahoo.co.uk 31 Aug '18

31 Aug '18

Ive an alert for msgs (var/log/messages entries) that I desire to have paged in office hours only Thing is its only linux clients that need this check., not windows clients. So if I set a stadard style alerts.cfg entry HOST=* SERVICE=msgs TIME=w:0800:1830 COLOR=red MAIL monitor at us.com of course if any windows msgs go red (constantly... zzzz) then they will page also, which is not the required outcome. There is the option I see of something like alerts.cfg: GROUP=SSSD_MSGS TIME=w:0800:1830 COLOR=red MAIL monitor at us.com analysis.cfgdefault section LOG %/var/log/messages "%TEST" COLOR=red GROUP=SSSD_MSGS [ search string here of course being TEST ] but that does exactly the same thing. So - aside from adding that LOG line to umpteen individual analysis.cfg entries for each linux server, or a single section listing all the linux servers ... is there a way to curtail this check to only linux servers (or more likely a bunch of hostnames of course). Somewhere it seems we'd have to manulayy maintain the correct "list" of hostnames to be caught - Im just trying to minimise the overhead. I had considered using a yellow alert to alert the LOG check... but other "things" also issue yellow alerts and we don;t want to trigger them either. I can;t see a way out of this? didds

3 3

How to install in windows?
by jgsuareza1984＠gmail.com 30 Aug '18

30 Aug '18

Hi greetings Please help with information on how to install XYMON in a Windows operating system, using BWIN *Gabriel *

2 1

powershell client data file excessive Port info enhancement request
by tlwilliams4＠vcu.edu 30 Aug '18

30 Aug '18

We are in the process of migrating 300+ servers from BBWin client to powershell client. All works well, except our anti-virus servers create a huge data file that gets truncated, causing FILES, SVCS, WHO to go Purple. We have set the MAXMSG_STATUS AND MAXMSG_CLIENT Xymon server parameters to 1024, but the AV servers still blow past that. The PORTS function reports all of the TCP ESTABLISHED and TIME_WAIT connections for every AV client on servers and desktops. We only need to know that the AV server is proper LISTENING. Using Slimmode and excluding the Ports section doesn't work as we do need to know the listening ports. I have modified the Xymonclient.ps1 script as follows to limit the data in the function XymonPorts "[ports]" netstat -an to: "[ports]" netstat -an | findstr LISTENING Rather than manually editing each new version of script released, I would rather have a client-local.cfg entry that would turn this on per group similar to what you have for IFSTAT. Less desirable would be a statement in Xymonclient_config.XML, or as a mode in Slimmode. Does this sound like a doable enhancement? *Timothy L. Williams* *Operating Systems Analyst* Virginia Commonwealth University Computer Center

3 3

Ignoring Portable Disks
by cdm46＠ast.cam.ac.uk 24 Aug '18

24 Aug '18

Hi all, I've got my clients setup for local config and am having problems with some commands in the localclient.cfg files. I am trying to ignore certain filesystems and have the line "DISK %^/media.*/ IGNORE" setup to ignore any portable hardware. This is identical to the example given in Xymon's man pages, except "oracle" has been changed to "media". However, this doesn't seem to do anything at all, it's as if Xymon is ignoring this configuration option. Other configuration options set in my client's localclient.cfg do work as expected, so it can't be a problem with xymon reading the localclient.cfg file. Anything to help me figure out what on earth is going on would be greatly appreciated. Cheers, Calum

3 3

CGI Security
by john＠executech.com 23 Aug '18

23 Aug '18

I was able to get CGI security working with the PAGE parameter but was unable to get it working with any SUBPAGE or SUBGROUP parameter. Is this an option or will I have to explicitly add each individual HOST? I have all of the servers and access in a SQL table and use PHP security to limit access to all other pages. Has anyone successfully configured XYMON to look to a database for CGI security based on SUBPAGE? This is in reference to: https://www.xymon.com/help/manpages/man5/xymonwebaccess.5.html Thanks, John

1 1

Setting thresholds in analysis.cfg
by chris.seip＠hpe.com 21 Aug '18

21 Aug '18

I could a hand getting the basics of analysis.cfg worked out, please. Here's mine: # egrep -v '^#' analysis.cfg HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK /disk/data 50 55 DISK * 90 95 MEMSWAP 80 90 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK /disk/data 92 96 DISK * 90 95 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 DISK /BACKUP 98 99 DISK * 90 95 DEFAULT # Ignore some usually uninteresting tmpfs mounts. DISK /dev IGNORE DISK /dev/shm IGNORE DISK /lib/init/rw IGNORE DISK /run IGNORE # These are the built-in defaults. You should only modify these # lines, not add new ones (no PROC, DISK, LOG ... lines). UP 1h LOAD 5.0 10.0 DISK * 90 95 INODE * 70 90 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97 Three issues with this: 1. Swap consumption in the first host, swnfs06, has been steady at 74%, so I was trying to hush the alerts with the MEMSWAP line. This change hasn't had any effect; I am still getting a memory low yellow-warning for swap/page usage on swnfs06. 2. On the same swnfs06 host, its /disk/data partition is 56% full, so my "DISK..50 60" line was an attempt to trigger a yellow alert. I was testing my understanding of the analysis.cfg file, but the filesystems test remains green. 3. And my 96% full /BACKUP drive on hpnsvr18 is issuing a red alert for being over the panic level of 95%, where I was trying to set the panic level at 99%. After wrestling with the man page and many experiments, I'm tossing this to the group for help. Seems very basic, but it's just not working for me. What'm I missing? I tried switching to the "threshold hostname" format, like this: # egrep -v '^#' analysis.cfg | head -11 DISK /disk/data 50 55 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK * 90 95 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 MEMSWAP 80 90 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 DISK /disk/data 92 96 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK * 90 95 HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 DISK /BACKUP 98 99 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 DISK * 90 95 HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 This produced no change in behavior. I am stopping and starting the Xymon server software and waiting for new html pages to generate after every change in the analysis.cfg. In my configuration report, I can see that every server configured for local memory tests has acquired the 80%/90% threshold setting, not just swnfs06. And my "DISK /disk/data 50 55" is having no effect at all on any host: The strings "50%" or "60%" appear nowhere in my configuration report. # egrep 'swnfs0[67]' hosts.cfg 16.93.247.204 swnfs06.rose.rdlabs.hpecorp.net # rpc=mount,nlockmgr,nfs,ypbind ssh 16.93.247.205 swnfs07.rose.rdlabs.hpecorp.net # NOCOLUMNS=files rpc=mount,nlockmgr,nfs,ypbind ssh 16.93.247.204 swnfs06.rose.rdlabs.hpecorp.net # xymoncmd xymond_client --dump-config DISK /disk/data 50% 55% 0 -1 red HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 351) DISK * 90% 95% 0 -1 red HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 352) MEMSWAP 80 90 HOST=%swnfs06.rose.rdlabs.hpecorp.net,%swnfs06 (line: 353) DISK /disk/data 92% 96% 0 -1 red HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 (line: 355) DISK * 90% 95% 0 -1 red HOST=%swnfs07.rose.rdlabs.hpecorp.net,%swnfs07 (line: 356) DISK /BACKUP 98% 99% 0 -1 red HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 (line: 360) DISK * 90% 95% 0 -1 red HOST=%hpnsvr18.rose.rdlabs.hpecorp.net,%hpnsvr18 (line: 361) DISK /dev IGNORE (line: 371) DISK /dev/shm IGNORE (line: 372) DISK /lib/init/rw IGNORE (line: 373) DISK /run IGNORE (line: 374) UP 3600 -1 (line: 377) LOAD 5.00 10.00 (line: 378) DISK * 90% 95% 0 -1 red (line: 379) INODE * 70% 90% 0 -1 red (line: 380) MEMREAL 100 101 (line: 381) MEMSWAP 50 80 (line: 382) MEMACT 90 97 (line: 383) Thanks for any insights you can provide. Feels like I'm making a wrong assumption about how analysis.cfg works. Best thing I can figure to do would be to switch to local configuration of my Xymon clients, but I'd rather manage custom thresholds centrally. - Chris

2 2

Ghost-busting... how to locate a ghost client
by glauber.ribeiro＠experian.com 21 Aug '18

21 Aug '18

And it worked! Thank you. g From: Ribeiro, Glauber Sent: Tuesday, August 21, 2018 08:18 To: Root, Paul T <Paul.Root at CenturyLink.com> Subject: RE: Ghost-busting... how to locate a ghost client That is an excellent idea, thanks! g From: Root, Paul T [mailto:Paul.Root at CenturyLink.com] Sent: Monday, August 20, 2018 16:58 To: Ribeiro, Glauber <glauber.ribeiro at experian.com<mailto:glauber.ribeiro at experian.com>>; xymon >> xymon at xymon.com<mailto:xymon at xymon.com> <xymon at xymon.com<mailto:xymon at xymon.com>> Subject: RE: Ghost-busting... how to locate a ghost client So that would be the server is performing a test on the non-existent machine. Look in tasks.cfg or tasks.d. Or maybe it’s a crontab. The other thing you can do is put the non-existent machine into hosts.cfg and then eventually you will get the test to show up, so you know what it is that is running on that machine. From: Xymon <xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>> On Behalf Of Ribeiro, Glauber Sent: Monday, August 20, 2018 4:28 PM To: xymon >> xymon at xymon.com<mailto:xymon at xymon.com> <xymon at xymon.com<mailto:xymon at xymon.com>> Subject: [Xymon] Ghost-busting... how to locate a ghost client I have a non-existent server which shows constantly in my “Ghost clients” report. I think there must be a test somewhere that’s reporting the wrong host name. Is there anything I can do to find out where that message is coming from? The Ghost clients report tells me the sender is “127.0.0.1” (of course). Thanks, glauber -- glauber.ribeiro at experian.com<mailto:glauber.ribeiro at experian.com> This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

1 0

xymon patches
by xymon＠nndev.org 21 Aug '18

21 Aug '18

Is there a proper place to send patches? I have a couple: One fixes xymon so it compiles on Fedora 28, plus some type mismatch cleanup The other fixes do_temperature.c so it actually works correctly I also have a re-written temperature.sh script that works on Solaris, FreeBSD, and Linux. I can stick them on my website, but I'd rather get them actually incorporated into the codebase.

2 1