<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Courier New";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">this seems like a big text, but it might be a short reading and understanding…..<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’m wondering if the following is either a bug, a config error or my missunderstanding.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We are running Xymon 4.3.11. We have a couple of Linux servers running several distributions of Linux OS, but all containing Xymon 4.3.11 and above; installed as client.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">On our Xymon server, we have the following DEFAULT section in analysis.cfg:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">DEFAULT<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""># These are the built-in defaults.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> UP 3<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> CLOCK 60<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOAD 5.0 10.0<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> DISK * 90 95<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> MEMPHYS 100 101<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> MEMSWAP 80 90<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> MEMACT 90 97<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> FILE /var/log/ntp SIZE>0<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> FILE %/var/(adm|log)/messages<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages WARNING IGNORE=%(smbd|STORVSC:*.WARNING\!|gdm-simple-greeter|GdmDisplay|GdmSession|GDM|packagekitd|parport)
COLOR=yellow<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages %(I/O|read).error IGNORE=%(fd0|smbd|read_fd_with_timeout|Connection.reset.by.peer|error\.txt) COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages ERROR IGNORE=%(fd0|smbd|read_fd_with_timeout|Connection.reset.by.peer|error\.txt|gdm-simple-greeter|GdmDisplay|GdmSession|GDM|packagekitd|parport)
COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages FAIL IGNORE=%(smbd|Connection.reset.by.peer|gdm-simple-greeter|GdmDisplay|GdmSession|GDM|packagekitd|parport|NT_STATUS_LOGON_FAILURE|LOGIN)
COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages CRITICAL IGNORE=%(smbd|gdm-simple-greeter|GdmDisplay|GdmSession|GDM|packagekitd|parport) COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">(I don’t want to dicuss about the sense or the absurdity of the configured IGNORE statements here; let’s simply say they are OK for us…. Shouldn’t matter for my question here…..)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">As one can read in the man page of analysis.cfg (which is available at
<a href="https://www.xymon.com/help/manpages/man5/analysis.cfg.5.html">https://www.xymon.com/help/manpages/man5/analysis.cfg.5.html</a> ) i’ve read the following:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt;text-indent:35.4pt"><i><span lang="EN-US">Note that Xymon defaults to case-insensitive pattern matching; if that is not what you want, put "(?-i)" between the "%" and the regular expression to turn this off. E.g.
"%(?-i)WARNING" will match the word WARNING only when it is upper-case.<o:p></o:p></span></i></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We don’t have (?-i) in front of our keywords; that should match our keywords regardless of their upper and lower case. So far, so good.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">That was my meaning…..<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">A colleague called me saying that one of our servers had a problem with a openvpn connection. I logged in to the server and inspected /var/log/messages, and I found these lines (I’ve changed IP’s and ports to #):<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:18 open-vpn ovpn-server[39555]: ##.##.##.##:##### TLS Error: TLS key negotiation failed to occur within 60 seconds (check your
network connectivity)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:18 open-vpn ovpn-server[39555]: ##.##.##.##:##### TLS Error: TLS handshake failed<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:18 open-vpn ovpn-server[39555]: ##.##.##.##:##### Fatal TLS error (check_tls_errors_co), restarting<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:18 open-vpn ovpn-server[39555]: ##.##.##.##:##### SIGUSR1[soft,tls-error] received, client-instance restarting<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:23 open-vpn ovpn-server[39555]: TCP connection established with [AF_INET]##.##.##.##:#####<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:06:24 open-vpn ovpn-server[39555]: ##.##.##.##:##### TLS: Initial packet from [AF_INET]##.##.##.##:#####, sid=######## ########<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:07:06 open-vpn ovpn-server[39555]: ##.##.##.##:##### TLS Error: TLS key negotiation failed to occur within 60 seconds (check your
network connectivity)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:07:06 open-vpn ovpn-server[39555]: ##.##.##.##:##### TLS Error: TLS handshake failed<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:07:06 open-vpn ovpn-server[39555]: ##.##.##.##:##### Fatal TLS error (check_tls_errors_co), restarting<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:70.8pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New"">Dec 1 12:07:06 open-vpn ovpn-server[39555]: ##.##.##.##:##### SIGUSR1[soft,tls-error] received, client-instance restarting<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">As you can see, there are the keywords “Error”, “error” and “failed” in these lines. At this time the msgs test of that server was at state green.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This made me think that the statement of the man page of analysis.cfg regarding case-insensitive might be wrong.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve tested this and inserted this line in the DEFAULT section of analysis.cfg:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span lang="EN-US" style="font-size:9.0pt;font-family:"Courier New""> LOG %/var/(adm|log)/messages Error IGNORE=%(fd0|smbd|read_fd_with_timeout|Connection.reset.by.peer|error\.txt|gdm-simple-greeter|GdmDisplay|GdmSession|GDM|packagekitd|parport)
COLOR=red<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">After a couple of minutes, the msgs test for that server changed to red.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Did i understand something wrong or miss something? Or is this really a bug?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Do i need to configure my keywords in a different way?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Best regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Christian<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE">Christian Becker</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE"><br>
IT-Services<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE"><a href="mailto:Christian.Becker@rhein-zeitung.net"><span style="color:#0563C1">Christian.Becker@rhein-zeitung.net</span></a></span><u><span lang="EN-US" style="color:#0563C1;mso-fareast-language:DE"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE">_________________________________</span><span lang="EN-US" style="mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:10.0pt"><span style="font-size:7.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE">Mittelrhein-Verlag GmbH<br>
August-Horch-Straße 28<br>
D-56070 Koblenz</span><span style="mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-top:2.0pt;line-height:10.0pt"><span style="font-size:7.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE">Verleger und Geschäftsführer: Walterpeter Twer<br>
Reg.-Gericht Koblenz HRB 121<br>
Finanzamt Koblenz Str.Nr. 22 65 10 285 2</span><span style="mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:4.0pt"><span style="font-size:7.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE"><a href="http://www.rhein-zeitung.de/"><span style="color:blue">www.rhein-zeitung.de</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>