In <1291753910.9867.1409147123 at webmail.messagingengine.com> bb at buglecreek.com writes:
- Can the 4.3 (future stable version) easily run our existing BB scripts. I know 4.2.3 can, but was curious about 4.3 and the file name changes. Looking at the latest BB to Xymon doc it seems that it should be ok. Just looking for comfirmation.
The intention certainly is to try not to break BB scripts. So if something breaks I will certainly look at fixing it, unless the script is so heavily dependant on BB stuff that it will be really difficult to support (but in that case it probably wouldn't work with the older Hobbit versions).
So the bottom line is: If it works with 4.2.3, then it should also work with 4.3.0. Only requirement is that you use the upgrade-script to setup all of the symlinks so the old filenames are still available.
- We like that Xymon has a nice way to monitor log files for certain events and unauthorized ports being opened, are there any issues with system performance when monitoring log files for a "lot" of events. I know a lot could mean many things, but has anyone run into performance issues?
The problem I've seen is that log files can be huge, and even though the Xymon client only transfers the last 30 minutes of logentries this can be quite a hefty chunk of data to send across the net every 5 minutes. Not to mention that it is stored in RAM on the Xymon server. This can usually be remedied with some aggressive filtering in the client-local.cfg file.
- Is Devmon still the recommended way to use SNMP with Xymon? Are there plans to incorporate SNMP into future releases? Some here want to use Cacti.
Devmon is a very capably solution for monitoring of SNMP devices. It is the recommended solution for this, and probably will be for quite some time.
- In the test 4.2.3 server system I added some hosts in the hobbits-clients.cfg file with some PROC, PORT (to look for unauthorized listeners), and LOG rules. With only a few hosts, it became apparent that this file will become huge very quickly and somewhat unruly. Is there a better way to handle this? It seems that a site with 100+ or 1000+ hosts all having an entry in the hobbits-clients.cfg on the Xymon server the file will be unmanageable. Maybe I'm not doing this correctly, since I set this test up fairly quickly?
You need to look into the "include" and "directory" statements in hobbit-clients.cfg (now: analysis.cfg). My current setup has about 500 hosts configured in hobbit-clients.cfg, but that file only has a directory /etc/hobbit/clients.d line, and then the actual configuration is kept in a number of files located in that directory. This makes it easy to manage even a large number of files, since you can split the configuration into logical chunks.
The same technique can be used for all of the other Xymon configuration files, by the way.
Regards, Henrik