<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \, serif";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Okay, this is embarrassing, but I’ll post anyway in case someone runs into this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I had originally installed Big Brother and BB clients. Then I migrated to Xymon. On the two systems in question, I had neglected to turn off and remove the BB clients. So.. I had 2 applications – only one
of which had permissions to /var/log/messages and was getting flapping status.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">bbc up at the top of the chkconfig printout and xymon-client down at the bottom.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I found it after turning the xymon-client off on one of the server and observing new messages saying that /var/log/messages was unreadable. Light bulb!!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">John A.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>John D. Alexander<br>
<b>Sent:</b> Tuesday, April 15, 2014 8:06 AM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] recurring email alerts<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">I’ve checked all of my systems and no misconfigurations like that. I also disabled the msgs report on the server and cleared all of the msgs status for the two servers and they are still reporting the issue
of not being able to read log files.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I guess the next thing is to clear the entire host off the server and wait to see what happens.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">John A.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> Xymon [<a href="mailto:xymon-bounces@xymon.com">mailto:xymon-bounces@xymon.com</a>]
<b>On Behalf Of </b>Adam Goryachev<br>
<b>Sent:</b> Monday, April 14, 2014 4:38 PM<br>
<b>To:</b> <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> Re: [Xymon] recurring email alerts<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 15/04/14 01:14, John D. Alexander wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#1F497D">I’m at a loss. Now I’ve got a client reporting /var/log/messages as unreadable and the server is showing a flapping status for msgs. Group ownership for /var/log/messages is set to root:xymon with proper permissions,
so it should be able to read it. When I su to the xymon user, it can get to that file just fine.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
Look at the IP address reporting the issue, possibly you have two systems reporting under the same name.<br>
<br>
Regards,<br>
Adam<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">There is nothing in analysis.cfg that is watching either /var/log/messages or /var/log/fail2ban.
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">I cleared msgs from the server. Restarted the client. The issue keeps coming back.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Any ideas?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">John A.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Betsy Schwartz [<a href="mailto:betsy.schwartz@gmail.com">mailto:betsy.schwartz@gmail.com</a>]
<br>
<b>Sent:</b> Friday, April 11, 2014 6:44 PM<br>
<b>To:</b> John D. Alexander<br>
<b>Cc:</b> <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> Re: [Xymon] recurring email alerts</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
I had that error once when I had a space after the file name in analysis.cfg<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If you can't find that file name maybe there's a shell eval that includes it somewhere?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
Sent from my iPhone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <<a href="mailto:JAlexander@feeneywireless.com">JAlexander@feeneywireless.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Nothing I can find is testing for this file and the permissions are such that xymon can read it.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Any clues on where to look to find what is causing this?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#00467F">John Alexander</span></b><br>
<span style="font-size:9.0pt;font-family:"Arial","sans-serif"">Network Administrator<br>
</span><i><u><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#00467F"><a href="mailto:John.Alexander@feeneywireless.com">John.Alexander@feeneywireless.com</a></span></u></i><span style="font-size:9.0pt;font-family:"Arial","sans-serif""><br>
Feeney Wireless, LLC - PO Box 2549, Eugene, Oregon 97402</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">(Free) 800-683-4818<span style="position:relative;top:-3.0pt;mso-text-raise:3.0pt">
</span> (P) 541-685-9045 <span style="position:relative;top:-3.0pt;mso-text-raise:3.0pt">
</span> (F) 541-284-0030 <br>
<a href="http://www.feeneywireless.com/"><i><span style="color:#00467F">www.feeneywireless.com</span></i></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="http://feeneywireless.com/"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:black;text-decoration:none"><image001.jpg></span></a><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:7.0pt;font-family:"Arial","sans-serif";color:#00467F">This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from
disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman , serif","serif"">_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a></span><o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Xymon mailing list<o:p></o:p></pre>
<pre><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><o:p></o:p></pre>
<pre><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><o:p></o:p></pre>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">--
<br>
Adam Goryachev Website Managers <a href="http://www.websitemanagers.com.au">www.websitemanagers.com.au</a><o:p></o:p></span></p>
</div>
</div>
</body>
</html>