<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:EN-AU;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:333384429;
mso-list-type:hybrid;
mso-list-template-ids:-1105796610 1135761296 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">> The state is different: Windows says "LISTENING" while Unix says "LISTEN".<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thank you so much, It really was that simple!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Cheers,<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response</span></b><b><span style="font-size:10.0pt;color:red;mso-fareast-language:EN-AU"><o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Information Technology Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">The University of Queensland<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Level 4, Prentice Building, St Lucia 4072<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">T: +61 7 334 66645, M: +61 401 140 838<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">E:
</span><span style="font-size:10.0pt;color:red;mso-fareast-language:EN-AU"><a href="mailto:g.stone-tolcher@its.uq.edu.au"><span style="color:blue">g.stone-tolcher@its.uq.edu.au</span></a>
</span><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">W:
<a href="http://www.its.uq.edu.au"><span style="color:blue">www.its.uq.edu.au</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">ITS: Service. Team. Accountability. Results.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">IMPORTANT:</span></b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"> This email and any attachments are intended solely for the addressee(s),
contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate
any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you
agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Please consider the environment before printing this email.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">CRICOS Code 00025B<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="color:windowtext;mso-fareast-language:EN-AU">From:</span></b><span lang="EN-US" style="color:windowtext;mso-fareast-language:EN-AU"> David Baldwin [mailto:david.baldwin@ausport.gov.au]
<br>
<b>Sent:</b> Friday, 17 July 2015 11:02 AM<br>
<b>To:</b> Gavin Stone-Tolcher; xymon@xymon.com<br>
<b>Cc:</b> Christopher Blom<br>
<b>Subject:</b> Re: [Xymon] analysis.cfg PORT LOCAL syntax not working for powershell client netstat output?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Gavin,<br>
<br>
The state is different: Windows says "LISTENING" while Unix says "LISTEN".<br>
<br>
I tend to use state=%LISTEN as a universal match.<br>
<br>
David.<span style="font-size:12.0pt;mso-fareast-language:EN-AU"><o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi, has anyone got “ports” working with “LOCAL” criteria with client data from a powershell or bbwin client? It does not seem to work for me, but it works fine for unix clients:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">analysis.cfg line for windows host:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">HOST=windows.host<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">PORT "LOCAL=%([.:]80)$" state=LISTEN TEXT=http<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">PORT "LOCAL=%([.:]443)$" state=LISTEN TEXT=https<o:p></o:p></p>
<p class="MsoNormal"> PORT STATE=LISTENING MIN=0 TRACK=Listen TEXT=Listen<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Display output:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<pre><img border="0" width="16" height="16" id="Picture_x0020_5" src="cid:image001.gif@01D0C082.EE148CB0" alt="red"> http (found 0, req. 1 or more)<o:p></o:p></pre>
<pre><img border="0" width="16" height="16" id="Picture_x0020_4" src="cid:image001.gif@01D0C082.EE148CB0" alt="red"> https (found 0, req. 1 or more)<o:p></o:p></pre>
<pre><img border="0" width="16" height="16" id="Picture_x0020_3" src="cid:image002.gif@01D0C082.EE148CB0" alt="green"> Listen (found 43, req. none)<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>Active Connections<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre> Proto Local Address Foreign Address State<o:p></o:p></pre>
<pre> TCP 0.0.0.0:80 0.0.0.0:0 LISTENING<o:p></o:p></pre>
<pre> TCP 0.0.0.0:135 0.0.0.0:0 LISTENING<o:p></o:p></pre>
<pre> TCP 0.0.0.0:443 0.0.0.0:0 LISTENING<o:p></o:p></pre>
<pre> TCP 0.0.0.0:445 0.0.0.0:0 LISTENING<o:p></o:p></pre>
<pre>…<o:p></o:p></pre>
<pre> TCP [::]:80 [::]:0 LISTENING<o:p></o:p></pre>
<pre> TCP [::]:135 [::]:0 LISTENING<o:p></o:p></pre>
<pre> TCP [::]:443 [::]:0 LISTENING<o:p></o:p></pre>
<pre> UDP 0.0.0.0:123 *:* <o:p></o:p></pre>
<pre> UDP 0.0.0.0:500 *:* <o:p></o:p></pre>
<pre> UDP 0.0.0.0:4500 *:* <o:p></o:p></pre>
<pre> UDP 0.0.0.0:5355 *:* <o:p></o:p></pre>
<pre> UDP 0.0.0.0:11211 *:* <o:p></o:p></pre>
<pre>…<o:p></o:p></pre>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">analysis.cfg lines for unix host<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">HOST=unixhost.blah<o:p></o:p></p>
<p class="MsoNormal"> PORT "LOCAL=%([.:]80)$" state=LISTEN TEXT=http<o:p></o:p></p>
<p class="MsoNormal"> PORT "LOCAL=%([.:]22)$" state=LISTEN TEXT=ssh<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Display output:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU"><img border="0" width="16" height="16" id="Picture_x0020_2" src="cid:image002.gif@01D0C082.EE148CB0" alt="green">http (found 3, req. 1 or more)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU"><img border="0" width="16" height="16" id="Picture_x0020_1" src="cid:image002.gif@01D0C082.EE148CB0" alt="green">ssh (found 2, req. 1 or more)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 127.0.0.1.80 127.0.0.1.54675 TIME_WAIT</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 *.1984 *.* LISTEN</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 *.22 *.* LISTEN</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 *.* *.* CLOSED</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 *.80 *.* LISTEN</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp4 0 0 10.0.1.1.80 *.* LISTEN</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";mso-fareast-language:EN-AU">tcp6 0 0 *.22 *.* LISTEN</span><o:p></o:p></p>
<p class="MsoNormal">…..<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">A cursory glance at “xymond/xymond_client.c” found a “localcol” being defined as 4:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">1989: int localcol = 4, remotecol = 5, statecol = 6, portcolor = COL_GREEN;<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I am not sure how it is handling the different number of columns from windows “netstat –an” which does not have the Recv-Q Send-Q columns present?<o:p></o:p></p>
<p class="MsoNormal">Any help/advice appreciated!<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Cheers<o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Information Technology Services</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">The University of Queensland</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Level 4, Prentice Building, St Lucia 4072</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">T: +61 7 334 66645, M: +61 401 140 838</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">E:
</span><span style="font-size:10.0pt;color:red;mso-fareast-language:EN-AU"><a href="mailto:g.stone-tolcher@its.uq.edu.au"><span style="color:blue">g.stone-tolcher@its.uq.edu.au</span></a>
</span><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">W:
<a href="http://www.its.uq.edu.au"><span style="color:blue">www.its.uq.edu.au</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">ITS: Service. Team. Accountability. Results.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">IMPORTANT:</span></b><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"> This email and any attachments are intended solely for the addressee(s),
contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate
any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you
agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">Please consider the environment before printing this email.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D;mso-fareast-language:EN-AU">CRICOS Code 00025B</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Xymon mailing list<o:p></o:p></pre>
<pre><a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><o:p></o:p></pre>
<pre><a href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a><o:p></o:p></pre>
</blockquote>
<pre>-- <o:p></o:p></pre>
<pre>David Baldwin - Senior Systems Administrator (Datacentres + Networks)<o:p></o:p></pre>
<pre>Information and Communication Technology Services<o:p></o:p></pre>
<pre>Australian Sports Commission <a href="http://ausport.gov.au">http://ausport.gov.au</a><o:p></o:p></pre>
<pre>Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616<o:p></o:p></pre>
<pre><a href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> 1 Leverrier Street Bruce ACT 2617<o:p></o:p></pre>
<pre>Our Values: RESPECT + INTEGRITY + TEAMWORK + EXCELLENCE<o:p></o:p></pre>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:EN-AU">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:EN-AU">Keep up to date with what's happening in Australian sport visit
<a href="http://www.ausport.gov.au">www.ausport.gov.au</a> <br>
<br>
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;mso-fareast-language:EN-AU">This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any
form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:EN-AU">
<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:EN-AU">
<hr size="2" width="100%" align="center">
</span></div>
</div>
</body>
</html>