- Xymon - Xymon mailman web

generate eventlog report from shell ?
by bakgat8＠hotmail.com 21 Aug '18

21 Aug '18

Is there a way to generate an event log report from the shell? I want to email a monthly report of change in status for column X . One of those things where one failure is not alert-worthy, but if the problem keep re-occurring, somebody need to look. Bakkies

2 1

Ghost-busting... how to locate a ghost client
by glauber.ribeiro＠experian.com 20 Aug '18

20 Aug '18

I have a non-existent server which shows constantly in my “Ghost clients” report. I think there must be a test somewhere that’s reporting the wrong host name. Is there anything I can do to find out where that message is coming from? The Ghost clients report tells me the sender is “127.0.0.1” (of course). Thanks, glauber -- glauber.ribeiro at experian.com

2 1

NTP requirement for Terabithia xymon RPM - RHEL/CentOS 7?
by mburger＠bubbanfriends.org 18 Aug '18

18 Aug '18

Good morning, I'm installing Xymon on an Amazon Linux 2 instance (RHEL/CentOS 7 equivalent) and noticed that, although Chrony is installed on the instance, the ntp and ntpdate packages were installed as pre-reqs for the JC's xymon package. I was just wondering: * Why is ntp/ntpdate a requirement for the Xymon package? * Does Chrony not have equivalent functionality? Thanks. -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

2 1

monitoring contents of a logfile with a daily changing filename
by EDSchminke＠Hormel.com 17 Aug '18

17 Aug '18

Hang on. Thats not entirely correct. Xymon does not look at "the last SIZE bytes of the log file". Through a coincidence, it might.. but that's what it does. The rules that govern what gets returned is a little more complicated, but important to understand to avoid tearing out all your hair while troubleshooting. The SIZE component of the LOG entry only specifies the maximum amount of data to send back to the server. The logfetch program on the client side will take the last 30 minutes (kinda) of the file into consideration for what it sends back. An IGNORE rule removes lines from consideration (will not be sent, will not count against the max SIZE). Then, TRIGGER rules will send all matched lines even if it exceeds max SIZE. If what was found by any TRIGGER rules is less than max SIZE, it will include the difference from any remaining lines, up to the max SIZE. Still, only the last 30 minutes (kinda) are considered. I say kinda, because the logfetch program works like this. Every time the logfetch program checks a log file, it takes note of the current size of the log file. It keeps track of this in the STATUSFILE. (See logfetch manpage). Each line of the STATUSFILE lists the log files it's watching followed by a "queue" of numbers. Those numbers represent the size of the log file at the last 6 times it was checked. Every time logfetch runs, it unshifts the current size of the log file onto the front of the queue and pops the last number off the end of the queue. Then, logfetch opens the log file, seeks to the byte number that it popped off the queue, and reads to the end of file. So, log fetch returns the last "6 * check interval" minutes worth of entries in the log. Check interval is USUALLY 5 minutes, hence the 30 minutes. If it's not returning what you're expecting to get back from the logs, it's most likely due to how logfetch only concerns itself with that "last 6 checks" worth of the log. Erik D. Schminke | Associate Systems Programmer Hormel Foods Corporation | One Hormel Place | Austin, MN 55912 Phone: (507) 434-6817 edschminke at hormel.com | www.hormelfoods.com

2 1

analysis.cfg - match a sentence not a single word
by mburger＠bubbanfriends.org 16 Aug '18

16 Aug '18

In my implementation, we've got % at the front of our text regex: LOG %/var/log/messages.*.log "%Failed to initialize credentials using keytab" COLOR=yellow You might give that a try. On 2018-08-16 11:53, Ian Diddams via Xymon wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

2 1

analysis.cfg - match a sentence not a single word
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

Follwoing on from my rpevious queries and thanks to all that helped, Ive now got everything working but matching a single word ("DIDDS"). however - what I actually need to match is a sentence eg "Failed to initialize credentials using keyta" I can try this LOG %/var/log/messages.*.log "Failed to initialize credentials using keytab" COLOR=yellow but the GUI flags the contents of the file as containing that but it doesn;t alert for it. all the man page suggests is single word pattern matching is available - any other suggestions? cheers

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

I realised the solution came about via direct emails with Andy so here is the solution for posterity: Now the LOG config in analysis.cfg is simply :LOG %/var/log/messages.*.log "XXXX" COLOR=yellow And the accompanying client-local.cfg entry is :[linux]log:/var/log/messages:10240log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240000000 The requirement was the regex wildcar .* not the glob of just *. Next question... I now see if I place the trigger word DIDDS in an appropriate logfile xymon does spot it and alert on it, and the GUI page shows the contents of the logfile as <CURRENT> DIDDS But after 10 minutes... it drops the alert and the gui page no longer also lists those contents - in fact it shows nothing as the contents. Anybody any ideas as to why this behaviour is seen. These tests are at the moment using dummy logfilesd which have no other info in them. It is literally only the line "DIDDS" which remains there. If I add another line DIDDS once again it spots it and then alerts and shows it as <CURRENT> DIDDS. For ten minutes - then it all drops again... any ideas why this is occurring? didds

1 0

monitoring contents of a logfile with a daily changing filename
by mburger＠bubbanfriends.org 16 Aug '18

16 Aug '18

Hello, Ian. Please note that it's only monitoring the most recent 10240 bytes of the logs in question. This means that unless the text you're looking for is in the last 10240 bytes of the log, it will not flag. On 2018-08-16 10:40, Ian Diddams via Xymon wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

Sorry Andy - I'm not with you? "Convert your rule in analysis.cfg from a glob to a regex :- LOG %/var/log/messages.*.log "DIDDS"| COLOR=yellow" The file name is messages-YYMMDD.log - what you have above seems to be mesages.<something>.log ? and the pipe ie "|" ? sorry to be so thick ! didds

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

further to the below... form the analysis.cfg man page: LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern] [OPTIONAL] ... "logfilename" is the name of the logfile. Only logentries from this filename will be matched against this rule. Note that "logfilename" can be a regular expression (if prefixed with a '%' character). as below the entry for the client in analysis.cfg on the server is LOG %/var/log/messages*.log "DIDDS" COLOR=yellow so IS prefixed by a % and the proof thyat this isn;t picking up the contents of the requisite log file is because the GUI page line Full log /var/log/messages-20180816.log does not have <...CURRENT...>DIDDS below it - as my test for plain /var/log/messages does. didds On Thursday, 16 August 2018, 15:40:44 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: Ok - another angle. I feel I am SO close. so I have a cleint with message logs with filename format /var/log/messages-YYYYMMDD.log It contains a trigger word DIDDS client-local.cfg on the xymon SERVER contains [linux]log:/var/log/messages:10240log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240log:/var/log/maillog:10240 log:/var/log/secure:10240ignore MARK The client's msgs GUI page shows No entries in /var/log/messagesNo entries in /var/log/messages-20180816.log No entries in /var/log/maillog No entries in /var/log/secure Full log /var/log/messagesFull log /var/log/messages-20180816.log Full log /var/log/maillog Full log /var/log/secure ie it can find/knows about that respective messages file. However... in analysis.cfg, for the respective client this line LOG %/var/log/messages*.log "DIDDS" COLOR=yellow doesn't flag anything - even if the string DIDDS is in that messages-20180816.log file .. hence the line in the GUI No entries in /var/log/messages-20180816.log SO CLOSE. what am I missing here? Because if I merely use LOG %/var/log/messages "DIDDS" COLOR=yellow with DIDDS within /var/log/messages it goes yellow almost immediately. ??? didds _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 1