I have searched through the archives but other than finding this tantalizing match
To: xymon at xymon.com
Date: Wed, 26 Mar 2014 12:59:35 +0100 From: henrik at hswn.dk Subject: Re: [Xymon] Have network tests report yellow instead of red?
Den 2014-03-25 18:19, John Thurston skrev:
I must be blind, but I am unable to find a way to have a xymonnet test result go yellow instead of red.
If I have the following line in my hosts.cfg: 0.0.0.0 foo.bar.com # telnet
I'd like the telnet test to report yellow instead of red when the port test is not responding. I see I can prefix it with "?" to have it return clear instead of red, but how can I make it return yellow instead of red?
Not possible, sorry.
You can use 'delayred' to give it some time to recover without triggering an alert.
Regards, Henrik
I have not been able to figure out how to have a conn test (ping test) only turn red if it has been failing for 10 minutes.
Anybody! Please and thank you.
G
On 3/18/2016 11:50 AM, Bakkies Gatvol wrote:
- snip -
I have not been able to figure out how to have a conn test (ping test) only turn red if it has been failing for 10 minutes.
Use the "DELAYRED" tag on your host. Set the delay to be 10 minutes.
From the man page for hosts.cfg
delayred=STATUSCOLUMN:DELAY[,STATUSCOLUMN:DELAY...] Usually, status changes happen immediately. This tag is used to defer an update to red for the STATUSCOLUMN status for DELAY minutes. E.g. with delayred=disk:10,cpu:30, a red disk-status will not appear on the Xymon webpages until it has been red for at least 10 minutes
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
I did try the simple case ...
10.83.19.249 granite_ip_printer delayred=conn:15but it turned red immediately. I thought it was because ping was a network test ... as mentioned here:
delayred=STATUSCOLUMN:DELAY[,STATUSCOLUMN:DELAY...] Usually, status changes happen immediately. This tag is used to defer an update to red for the STATUSCOLUMN status for DELAY minutes. E.g. with delayred=disk:10,cpu:30, a red disk-status will not appear on the Xymon webpages until it has been red for at least 10 minutes. Note: Since most tests only execute once every 5 minutes, it will usually not make sense to set N to anything but a multiple of 5. The exception is network tests, since xymonnet-again.sh(1)
will re-run failed network tests once a minute for up to 30 minutes.
On 3/18/2016 1:08 PM, Bakkies Gatvol wrote:
Note: Since most tests only execute once every 5 minutes, it will usually not make sense to set N to anything but a multiple of 5. *The exception is network tests*, since /xymonnet-again.sh will re-run failed network tests once a minute for up to 30 minutes.
The exception is to the suggested interval, not the function.
Normal tests run on a set interval, usually every five minutes. Setting your DELAYRED to 9 minutes isn't much different from setting to to 5 minutes. There is still one failed test with no opportunity for change.
xymonnet test, however, get tossed into the xymonnet-again queue upon failure. This increases the frequency of the retest. In this case, setting the DELAYRED to 9 minutes permits four more tests to happen than setting it to 5 minutes.
But maybe my interpretation is wrong, because I've tried out your test scenario, see that notation at the bottom of the info-page, and (like you) don't see any delay of the appearance of red on the info, parent-page, or non-green screen.
Can anyone confirm that "delayred" is working for them with conn?
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
On 3/18/2016 1:27 PM, John Thurston wrote:
- snip -
Can anyone confirm that "delayred" is working for them with conn?
Ohhhh. I think I see something interesting.
In xymond.c, I see the following comment:
/* Ignore any delays when we start with a purple status */
My test case was to change a noconn tag on a host to conn. Which meant I went from clear/no-state to red. I haven't read the rest of that code, but I suspect my test would be valid only if starting from a green state.
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
It didn't work for me. Pretty weird though.
I started with this:
10.5.136.247 wilee # ntp delayred=conn:9
Then, put in a rule in iptables to block pings. It went red immediately.
And paged after 5 minutes, as my alerts tells it.
Then the weird thing happened. It changed to yellow.
Hold on, I’m going to test again. I bet hosts.cfg hadn't been re-read yet. So it's probably an invalid test.
BTW, 4.3.21 on the server and client.
I'll reply again in 15 minutes or so.
-----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of John Thurston Sent: Friday, March 18, 2016 4:34 PM To: xymon at xymon.com Subject: Re: [Xymon] delayred on conn
On 3/18/2016 1:27 PM, John Thurston wrote:
- snip -
Can anyone confirm that "delayred" is working for them with conn?
Ohhhh. I think I see something interesting.
In xymond.c, I see the following comment:
/* Ignore any delays when we start with a purple status */
My test case was to change a noconn tag on a host to conn. Which meant I went from clear/no-state to red. I haven't read the rest of that code, but I suspect my test would be valid only if starting from a green state.
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Ok, this time it looks like it's working:
$ iptables -I INPUT 1 -p icmp -s 10.5.130.117 -j REJECT --reject-with icmp-host-prohibited $ date Fri Mar 18 16:52:57 CDT 2016
Then on the server:
Fri Mar 18 16:55:44 2016 yellow 0:01:11 Fri Mar 18 16:47:12 2016 green 0:08:32
So I’m guessing it should change red at 17:01:57 or so.
Yes, it did:
Fri Mar 18 17:04:45 2016 red 0:00:20 Fri Mar 18 16:55:44 2016 yellow 0:09:01 Fri Mar 18 16:47:12 2016 green 0:08:32
However, it also meant that it paged out immediately, not waiting 5 minutes after it turned red from yellow.
-----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Root, Paul T Sent: Friday, March 18, 2016 4:52 PM To: 'John Thurston'; xymon at xymon.com Subject: Re: [Xymon] delayred on conn
It didn't work for me. Pretty weird though.
I started with this:
10.5.136.247 wilee # ntp delayred=conn:9
Then, put in a rule in iptables to block pings. It went red immediately.
And paged after 5 minutes, as my alerts tells it.
Then the weird thing happened. It changed to yellow.
Hold on, I’m going to test again. I bet hosts.cfg hadn't been re-read yet. So it's probably an invalid test.
BTW, 4.3.21 on the server and client.
I'll reply again in 15 minutes or so.
-----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of John Thurston Sent: Friday, March 18, 2016 4:34 PM To: xymon at xymon.com Subject: Re: [Xymon] delayred on conn
On 3/18/2016 1:27 PM, John Thurston wrote:
- snip -
Can anyone confirm that "delayred" is working for them with conn?
Ohhhh. I think I see something interesting.
In xymond.c, I see the following comment:
/* Ignore any delays when we start with a purple status */
My test case was to change a noconn tag on a host to conn. Which meant I went from clear/no-state to red. I haven't read the rest of that code, but I suspect my test would be valid only if starting from a green state.
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Thanks to all
I tried again today and it seemed to work. The yellow was unexpected, but nice. Maybe trying something new late on Friday is just not worth it ....
at Tue Mar 22 10:55:23 EDT 2016
10.83.19.249 granite_ip_printer #DESCR:socket-9100 delayred=conn:9
Tue Mar 22 11:10:27 2016 red 0:04:17 Tue Mar 22 11:00:57 2016 yellow 0:09:30
From: Paul.Root at CenturyLink.com To: Paul.Root at CenturyLink.com; john.thurston at alaska.gov; xymon at xymon.com Date: Fri, 18 Mar 2016 22:06:20 +0000 Subject: Re: [Xymon] delayred on conn
Ok, this time it looks like it's working:
$ iptables -I INPUT 1 -p icmp -s 10.5.130.117 -j REJECT --reject-with icmp-host-prohibited $ date Fri Mar 18 16:52:57 CDT 2016
Then on the server:
Fri Mar 18 16:55:44 2016 yellow 0:01:11 Fri Mar 18 16:47:12 2016 green 0:08:32
So I’m guessing it should change red at 17:01:57 or so.
Yes, it did:
Fri Mar 18 17:04:45 2016 red 0:00:20 Fri Mar 18 16:55:44 2016 yellow 0:09:01 Fri Mar 18 16:47:12 2016 green 0:08:32
However, it also meant that it paged out immediately, not waiting 5 minutes after it turned red from yellow.
-----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Root, Paul T Sent: Friday, March 18, 2016 4:52 PM To: 'John Thurston'; xymon at xymon.com Subject: Re: [Xymon] delayred on conn
It didn't work for me. Pretty weird though.
I started with this:
10.5.136.247 wilee # ntp delayred=conn:9
Then, put in a rule in iptables to block pings. It went red immediately.
And paged after 5 minutes, as my alerts tells it.
Then the weird thing happened. It changed to yellow.
Hold on, I’m going to test again. I bet hosts.cfg hadn't been re-read yet. So it's probably an invalid test.
BTW, 4.3.21 on the server and client.
I'll reply again in 15 minutes or so.
-----Original Message----- From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of John Thurston Sent: Friday, March 18, 2016 4:34 PM To: xymon at xymon.com Subject: Re: [Xymon] delayred on conn
On 3/18/2016 1:27 PM, John Thurston wrote:
- snip -
Can anyone confirm that "delayred" is working for them with conn?
Ohhhh. I think I see something interesting.
In xymond.c, I see the following comment:
/* Ignore any delays when we start with a purple status */My test case was to change a noconn tag on a host to conn. Which meant I went from clear/no-state to red. I haven't read the rest of that code, but I suspect my test would be valid only if starting from a green state.
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
participants (3)
-
bakgat8＠hotmail.com
-
john.thurston＠alaska.gov
-
Paul.Root＠CenturyLink.com