Nathan Gibbs | 3 Aug 03:42 2011

Infocon monitor v0.2 Released

The ISC changed the infocon file on their site to a redirect, so we had
to adjust the code.
:-)

http://www.cmpublishers.com/oss/#infocon.monitor

Enjoy

--

-- 
Sincerely,

Nathan Gibbs

Systems Administrator
Christ Media
http://www.cmpublishers.com

_______________________________________________
mon mailing list
mon <at> linux.kernel.org
http://linux.kernel.org/mailman/listinfo/mon
Davide Brini | 27 Jul 16:55 2011
Picon

Syslog problems

Hi, I'm using the stable mon-1.2.0-1 under Ubuntu 11.04 (Perl 5.10.1), and I
noticed that mon wasn't logging anything at all in syslog. Further
inspection revealed that the problem seems to be in the redefined syslog()
function:

no warnings; # Redefining syslog
sub syslog {
   eval {
       local $SIG{"__DIE__"}= sub { }; 
       my  <at> log = map { s/\%//mg; }  <at> _;
       Sys::Syslog::syslog( <at> log);
   }
}

since $_ is aliased in a map {} block, when the function is passed constant
strings, the map {} on  <at> _ fails with a "modification of a read-only value
attempted". However this is not apparent, not even in debug mode, since it
happens inside the eval{} block.

Suggested change (for example):

no warnings; # Redefining syslog
sub syslog {
   eval {
       local $SIG{"__DIE__"}= sub { };
       my  <at> log =  <at> _;
       s/\%//mg for ( <at> log);
       Sys::Syslog::syslog( <at> log);
   }
}
(Continue reading)

Giampaolo Rodolà | 19 Jul 12:03 2011

Defunct children after sending alert

Hi all,
I bumped into this problem:
http://www.mail-archive.com/mon <at> linux.kernel.org/msg00828.html

My configuration consists of a master mon server which receives traps from different mon slaves.
Extract from my conf:

watch uci
    service cpu
        period wd {Sun-Sat}
            alert mail.alert {my email address}
            upalert mail.alert {my email address}
            alertevery 1h

Every time a failure trap is sent from one of my slaves the mon master correctly sends an email alert and I can detect that a new defunct process appeared with:

$ ps aux | grep mon
13637 ? Z 0:00 [mon] <defunct>
13659 ? Z 0:00 [mon] <defunct>
13697 ? Z 0:00 [mon] <defunct>


This is kind of annoying as I'm forced to restart the mon master server periodically given that we can send hundreds of traps per-day.

By digging into commit history I found this:
http://www.mail-archive.com/mon <at> linux.kernel.org/msg00828.html
...so I picked up latest development version from https://mon.wiki.kernel.org/index.php/Development and replaced the main mon executable but that didn't fix the problem.

I noticed latest stable version goes back to year 2007.
Are there plans to release a new version including this specific bug fix?


Thanks in advance,

Giampaolo Rodolà

_______________________________________________
mon mailing list
mon <at> linux.kernel.org
http://linux.kernel.org/mailman/listinfo/mon
Marco | 15 Jul 10:24 2011
Picon

Running a task once a day, at given time

Hello, this is my requirement: I want to run a monitor exactly once
per day, around 4am. If the monitor fails, I want to get exactly one
alert; if it succeeds, nothing should happen.

This is what I've tried so far:

watch myserver
        service testservice
                description Test for monitoring once per day
                interval 5m
                exclude_period hr {5-23} min {0-59}, hr {0-3} min
{0-59}, hr {4} min {5-59}
                monitor testservice.monitor
                period wd {Mon-Sun}
                        alert mail.alert alerts <at> example.com

Currently, "testservice.monitor" is a dummy script that always returns failure.

I figured that leaving a 5-minute window for the monitor to run, it
would run exactly once during that 5-minute window. However, it
doesn't seem to work that way as I get no email.

I also though of using "interval 1d", but there doesn't seem to be a
way to specify when, during the day, the monitor should run, so I
suppose that would just take the time the daemon is started as the
start of the period, which isn't what I want since I may restart or
stop/start the daemon at different times for different reasons.

Ideas? Thanks.
Shigeru Yanagibayashi | 10 Jul 08:17 2011
Picon

http.monitor IPv6 version

Does anyone use http.monitor IPv6 version? I tried to modify original one
to use "use Socket6;", but it is hard for me. Any help will be appreciated.
Nathan Gibbs | 8 Jul 02:04 2011

Infocon monitor

http://isc.sans.org/diary.html?date=2011-06-26

for nagios

Now we have one too.
:-)

http://www.cmpublishers.com/oss/#infocon.monitor

--

-- 
Sincerely,

Nathan Gibbs

Systems Administrator
Christ Media
http://www.cmpublishers.com

_______________________________________________
mon mailing list
mon <at> linux.kernel.org
http://linux.kernel.org/mailman/listinfo/mon
Chris Hoogendyk | 14 Jun 19:10 2011
Picon

mon monitor for arpwatch?

OK. I know arpwatch itself is a monitoring tool. But I haven't figured out a direct way to tell it 
to reduce the noise. I have it running with "-d" in a terminal session with unlimited cache so I can 
scroll back, search, and check it out. But, if I ran it in the background, with it sending emails, 
it looks like it would immediately have the systems group yelling, "kill it. now."

I've seen a writeup in Linux Journal where they funnel all the output into a file, process it with 
perl into a database, and then provide a web interface to view the database. Why does everything 
have to be so involved? This stuff is supposed to just work. Like mon. And arpwatch has been around 
forever.

So, I'm wondering if anyone has put together a mon monitor that can mediate the notifications from 
arpwatch. I'm using arpwatch-NG1.7.

--

-- 
---------------

Chris Hoogendyk

-
    O__  ---- Systems Administrator
   c/ /'_ --- Biology&  Geology Departments
  (*) \(*) -- 140 Morrill Science Center
~~~~~~~~~~ - University of Massachusetts, Amherst

<hoogendyk <at> bio.umass.edu>

---------------

Erdös 4
Nico Kadel-Garcia | 14 Jun 05:38 2011
Picon

Failure to find designatated monitor reported as "untested"

I just ran into some confuson. I misunderstood the "mondir" setting in
a configuration, and presumed that it mon would search *all* the
listed directories for a specific monitor. The result was that I tried
stashing them, for separation from default monitors, in their own
directory.

It didn't work: not a huge surprise. What confused me was that the
missing monitors were simply "Untested", as opposed to being reported
"Missing". or "Unavailable". Would it seem appropriate and reasonable
to report missing minotirs as "Missing", to help avoid confusion
during restarts or confusion about monitors being unavailable from
some NFS shared resource?
Nico Kadel-Garcia | 11 Jun 18:20 2011
Picon

New mon admin, some questions

Hi! i've been handed some mon server migration and maintenance tasks
in a new workplace, and I'm glad to find a mailing list for it. It
does seem quiet out here,.

Is there a central code base now for updates? The Wiki and codebase at
https://mon.wiki.kernel.org/index.php/Main_Page/ seems to have last
been updated in 2007. I do see some published patches, mostly from
Nathan....

I'm also running into issues with daemontools integration rather than
the normal init scripts published by my supported Linux distribution
(which I've been trying to integrate per a local demand), and would
happily publish notes for it.

I'm also running into issues with "monshow" output clipping the names
of services and groups automatically to align the columns, which makes
descriptive service names kind of tough to use. Has anyone published a
tweak to "monshow" to create more verbose output?
Nathan Gibbs | 25 May 18:16 2011

mon.cgi CMRv9 Released

Updated mon.cgi.

http://www.cmpublishers.com/oss/#moncgi

It is strongly recommended that users upgrade to this version.
Some vulnerabilities from upstream were discovered and hopefully corrected.
We have removed all old versions from our website.

Enjoy.

--

-- 
Sincerely,

Nathan Gibbs

Systems Administrator
Christ Media
http://www.cmpublishers.com

_______________________________________________
mon mailing list
mon <at> linux.kernel.org
http://linux.kernel.org/mailman/listinfo/mon
Nathan Gibbs | 13 May 04:47 2011

mon.cgi request for feedback.

Hi, all.
Is anyone using our mon.cgi to monitor multiple monhosts.  Especially on
different ports.  I'm reviewing/revising that section of code again and wasn't
sure how it was being used out there.

Feed back would be appreciated.

Thanks.

--

-- 
Sincerely,

Nathan Gibbs

Systems Administrator
Christ Media
http://www.cmpublishers.com

_______________________________________________
mon mailing list
mon <at> linux.kernel.org
http://linux.kernel.org/mailman/listinfo/mon

Gmane