I guess the next thing is to check your mail logs on the server, and see if it's mentioned there at that time and date.

Where would your xymon server send undeliverables?

Regards,

Carl

From: Kris Springer [mailto:kspringer at innovateteam.com] Sent: 10 November 2013 01:36 To: Carl Inglis Cc: Xymon MailingList Subject: Re: [Xymon] not receiving alerts

Here's the output from the --test.

root at ip:/xymon/bin# ./bbcmd xymond_alert --test VM-Firewall proc

2013-11-09 17:31:40 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg 00011942 2013-11-09 17:31:40 send_alert VM-Firewall:proc state Paging 00011942 2013-11-09 17:31:40 Matching host:service:dgroup:page 'VM-Firewall:proc:Innovate Servers:' against rule line 1 00011942 2013-11-09 17:31:40 *** Match with 'HOST=*' *** 00011942 2013-11-09 17:31:40 Matching host:service:dgroup:page 'VM-Firewall:proc:Innovate Servers:' against rule line 2 00011942 2013-11-09 17:31:40 *** Match with 'MAIL support at innovateteam.com<mailto:support at innovateteam.com> COLOR=red' *** 00011942 2013-11-09 17:31:40 Mail alert with command 'mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com<mailto:support at innovateteam.com>'

Thank you.

Kris Springer

=======================

On Sat, Nov 9, 2013 at 3:32 PM, Carl Inglis <Carl.Inglis at rakon.com<mailto:Carl.Inglis at rakon.com>> wrote: Hi Kris,

Searching the Archives I found this:

http://lists.xymon.com/archive/2008-June/019952.html

It includes an example of the "-test" option which will allow you to ensure that your tests are firing correctly.

Hope that helps.

Carl

From: Xymon [mailto:xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>] On Behalf Of Kris Springer Sent: 09 November 2013 22:45 To: Henrik Størner; Xymon MailingList Subject: Re: [Xymon] not receiving alerts

I've attached a screen shot of the 'info' page of the host that's red.

Strangely enough the notifications.log file suddenly has some data in it now that I stripped some options out of the alerts.cfg file.

Here's some of the notifications.log data. I X'd out the IP that was showing.

Sat Nov 9 11:50:47 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384026647 722 Sat Nov 9 12:12:48 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384027968 722 Sat Nov 9 12:20:57 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384028457 722 Sat Nov 9 12:35:59 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384029359 722 Sat Nov 9 14:31:55 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384036315 722

Thank you.

Kris Springer

On Sat, Nov 9, 2013 at 1:02 PM, Henrik Størner <henrik at hswn.dk<mailto:henrik at hswn.dk>> wrote: On 09-11-2013 19:49, Kris Springer wrote: Here's my new alerts.cfg file. It didn't change anything though. I'm still not receiving alerts. To force a trouble situation I've got a line in my hosts file that's checking for ssh on a machine that has it turned off so it will cause a red alert.

HOST=* MAIL support at innovateteam.com<mailto:support at innovateteam.com> <mailto:support at innovateteam.com<mailto:support at innovateteam.com>> COLOR=red RECOVERED NOTICE

First, check the "info" status column for that host: The alert must be shown there, or your configuration is not being picked up.

Second, check the notifications.log logfile to see if the alerts are being sent. If they are, then you need to look into the mail logs.

Third, try running xymond_alert with the "--test HOSTNAME SERVICE" option to see what rules get picked up; see the man-page.

Regards, Henrik

Carl Inglis Systems Administrator

Rakon UK Limited Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 1522 812630 | Fax: +44 1522 812664 | Mob: +44 7786 552915 Carl.Inglis at rakon.com | www.rakon.com

[The Queens Awards for Enterprise 2012]

[Rakon Logo]

This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments.

Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090.

Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content.

When that particular host is green nothing happens. When I make it red and I run that command I receive an email with the info that's defined in the command.

I think we're making progress tracking this down. It appears that things are working via command line, just not when automated.

Thank you.

*Kris Springer* *=======================*

On Sun, Nov 10, 2013 at 4:34 AM, Henrik Størner <henrik at hswn.dk> wrote:

So, what happens if you run this command from the commandline:

On 10-11-2013 02:35, Kris Springer wrote:

echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Your notifications.log file shows that the alerts are being generated, so we can now rule out problems with the alerts.cfg configuration.

Regards, Henrik

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

When I run the following command it works and I receive an email immediately.

su xymon -c echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Thank you.

*Kris Springer* *=======================*

On Sun, Nov 10, 2013 at 12:15 PM, Carl Inglis <Carl.Inglis at rakon.com> wrote:

Who are you running that command as? Make sure you’re doing it using “su [user] –c [command” – that way you can replicate the situation as it would be from inside Xymon.

Regards,

Carl

*From:* Xymon [mailto:xymon-bounces at xymon.com] *On Behalf Of *Kris Springer *Sent:* 10 November 2013 18:34 *To:* Henrik Størner *Cc:* Xymon MailingList *Subject:* Re: [Xymon] not receiving alerts

When I run that command I receive an email with the info that's defined in the command.

I think we're making progress tracking this down. It appears that things are working via command line, just not when automated.

Thank you.

---

*Kris Springer*

*=======================*

On Sun, Nov 10, 2013 at 4:34 AM, Henrik Størner <henrik at hswn.dk> wrote:

So, what happens if you run this command from the commandline:

On 10-11-2013 02:35, Kris Springer wrote:

echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Your notifications.log file shows that the alerts are being generated, so we can now rule out problems with the alerts.cfg configuration.

Regards, Henrik Carl Inglis

Alright. Now we may be getting somewhere.

When I run that command as user ubuntu, it attempts then hangs. ubuntu at ip:~$ su xymon -c xymoncmd echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com -bash: /var/mail/ubuntu: No such file or directory Password: 2013-11-11 05:41:39 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

When I run the command as user root, it attempts then hangs. ubuntu at ip:~# sudo bash root at ip:~# su xymon -c xymoncmd echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com bash: /var/mail/root: Permission denied 2013-11-11 05:44:20 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

When I run that command as user xymon, it attempts then hangs. root at ip:~# su xymon xymon at ip:/home/ubuntu$ su xymon -c xymoncmd echo "mail test" | $MAIL "Xyon [12345] VM-Firesall:proc CRITICAL (RED)" support at innovateteam.com bash: /var/mail/xymon: No such file or directory Password: 2013-11-11 05:47:16 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

I have to CTRL+C to stop it when it hangs, and I never receive any emails from these tests.

Thank you.

*Kris Springer*

*=======================*

On Sun, Nov 10, 2013 at 4:15 PM, Jeremy Laidman <jlaidman at rebel-it.com.au>wrote:

On 11 November 2013 07:19, Kris Springer <kspringer at innovateteam.com>wrote:

...

When I run the following command it works and I receive an email immediately.

su xymon -c echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Thank you.

The environment might have something to do with it, so should be tested, and at least eliminated from our enquiries. When Xymon runs the command, it does so using the Xymon server environment, including PATH and MAIL. To test, try running the command like this:

su xymon -c xymoncmd echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

J

Yes, I'm running the commands on the only xymon server that I have. What directory should I be in when I run the command? What settings for MAIL in the config file should there be? Which config file are you referring to? A previous person asked me about the MAIL settings xymonserver.cfg and my settings are what he said they should be.

Thank you.

*Kris Springer*

*=======================*

On Mon, Nov 11, 2013 at 6:20 AM, Carl Inglis <Carl.Inglis at rakon.com> wrote:

Hi Kris,

That seems to be trying to use the client configuration rather than the server configuration.

Are you running this on the server host?

Are you running it from inside the server directory?

Have you checked the setting for MAIL in the config file it’s using?

Of course, I may be missing the point completely.

Regards,

Carl

*From:* Kris Springer [mailto:kspringer at innovateteam.com] *Sent:* 11 November 2013 13:57 *To:* Jeremy Laidman *Cc:* Carl Inglis; Xymon MailingList *Subject:* Re: [Xymon] not receiving alerts

Alright. Now we may be getting somewhere.

When I run that command as user ubuntu, it attempts then hangs.

ubuntu at ip:~$ su xymon -c xymoncmd echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

-bash: /var/mail/ubuntu: No such file or directory

Password:

2013-11-11 05:41:39 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

When I run the command as user root, it attempts then hangs.

ubuntu at ip:~# sudo bash

root at ip:~# su xymon -c xymoncmd echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

bash: /var/mail/root: Permission denied

2013-11-11 05:44:20 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

When I run that command as user xymon, it attempts then hangs.

root at ip:~# su xymon

xymon at ip:/home/ubuntu$ su xymon -c xymoncmd echo "mail test" | $MAIL "Xyon [12345] VM-Firesall:proc CRITICAL (RED)" support at innovateteam.com

bash: /var/mail/xymon: No such file or directory

Password:

2013-11-11 05:47:16 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg

I have to CTRL+C to stop it when it hangs, and I never receive any emails from these tests.

Thank you.

---

*Kris Springer*

*=======================*

On Sun, Nov 10, 2013 at 4:15 PM, Jeremy Laidman <jlaidman at rebel-it.com.au> wrote:

On 11 November 2013 07:19, Kris Springer <kspringer at innovateteam.com> wrote:

When I run the following command it works and I receive an email immediately.

su xymon -c echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Thank you.

The environment might have something to do with it, so should be tested, and at least eliminated from our enquiries. When Xymon runs the command, it does so using the Xymon server environment, including PATH and MAIL. To test, try running the command like this:

su xymon -c xymoncmd

echo "mail test" | $MAIL "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

J

Carl Inglis

• Systems Administrator*

*Rakon UK Limited* Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom Tel: +44 1522 812630 | Fax: +44 1522 812664 | Mob: +44 7786 552915 Carl.Inglis at rakon.com | www.rakon.com

[image: The Queens Awards for Enterprise 2012]

[image: Rakon Logo]

This message together with any attachments contains confidential information and may be subject to privilege. If you are not the intended recipient you may not distribute it in any way, you must notify the sender immediately and delete any copies of the message along with its attachments.

*Rakon UK Ltd is a limited company registered in England and Wales. Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS Company Registration Number: 5128090. Please be aware that Rakon UK Limited may monitor email traffic data including the date, time, subject line, sender and recipients for the purposes of security and usage monitoring. Automated monitoring systems may also be applied to ascertain whether incoming/outgoing emails are likely to contain viruses, other destructive devices or inappropriate content. *

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

UPDATE: I was receiving test emails even when the host was green, they just all got combined by Gmail and only appeared to be 1 email.

Thank you.

*Kris Springer* *=======================*

On Sun, Nov 10, 2013 at 4:34 AM, Henrik Størner <henrik at hswn.dk> wrote:

So, what happens if you run this command from the commandline:

On 10-11-2013 02:35, Kris Springer wrote:

echo "mail test" | mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com

Your notifications.log file shows that the alerts are being generated, so we can now rule out problems with the alerts.cfg configuration.

Regards, Henrik

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon