<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Even if you are planning to change to Tivoli you'll want to consider upgrading to a newer version of Xymon server since there were many security patches added since that release. And if you really want to twist the knife a bit, I'm sure that Tivoli is not
inexpensive...and that's just the software cost that doesn't include the people cost to transition any custom monitors to use their framework plus the learning curve required to familiarize yourselves with a whole new system. But management will do, what
management will do...and often defy logic.<br>
</p>
<p><br>
</p>
<p>=G=<br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Xymon <xymon-bounces@xymon.com> on behalf of Adam Goryachev <mailinglists@websitemanagers.com.au><br>
<b>Sent:</b> Wednesday, March 16, 2016 6:46 PM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] How Xymon invokes an SSH connection to the Client?</font>
<div> </div>
</div>
<div>
<div class="moz-cite-prefix">Unless part of your problem is load related, and you are getting false alerts because the hobbit/xymon server is overloaded somehow.... (not entirely sure about this, but I guess it might happen that way)...<br>
<br>
Though yes, why not just fix the monitoring system, and/or upgrade, rather than try to re-invent what has already been done...<br>
<br>
Regards,<br>
Adam<br>
<br>
On 17/03/16 05:35, Agege wrote:<br>
</div>
<blockquote type="cite">
<div>Well said Galen!</div>
<div id="AppleMailSignature">In addition, we're currently running Hobbit/Xymon 4.3.0.0 beta2. And there's discussion going on about upgrading Xymon or build a new Server for Xymon or move newer Xymon hosts to Tivoli.</div>
<div id="AppleMailSignature"><br>
Thanks,
<div>Agege</div>
</div>
<div><br>
On Mar 16, 2016, at 8:27 AM, Galen Johnson <<a href="mailto:Galen.Johnson@sas.com"></a><a class="moz-txt-link-abbreviated" href="mailto:Galen.Johnson@sas.com">Galen.Johnson@sas.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<p>This is just a curiousity on my part but why does upper management think that moving to Tivoli is going to change the number of alerts you get (reasoning inferred from the statement below)? If you configure Tivoli with the same thresholds, you're going
to get the same alerting. If it's a volume issue, it seems like it would make more sense to reconsider the current monitoring thresholds. Just sayin'.<br>
</p>
<p><br>
</p>
<p>=G=<br>
</p>
<p><br>
</p>
<div style="word-wrap:break-word">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Xymon <<a href="mailto:xymon-bounces@xymon.com"></a><a class="moz-txt-link-abbreviated" href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>>
on behalf of Agege Information Systems, Inc. <<a href="mailto:cs@agege.com"></a><a class="moz-txt-link-abbreviated" href="mailto:cs@agege.com">cs@agege.com</a>><br>
<b>Sent:</b> Tuesday, March 15, 2016 11:15 PM<br>
<b>To:</b> Jeremy Laidman<br>
<b>Cc:</b> <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>
<b>Subject:</b> Re: [Xymon] How Xymon invokes an SSH connection to the Client?</font>
<div> </div>
</div>
<div>Thank you Jeremy!
<div class=""><br class="">
</div>
<div class="">Yes, the issues is that I have been asked to figure out is how Xymon handle monitoring activities with Xymon Clients.</div>
<div class=""><br class="">
</div>
<div class="">And the reason being is that we have one Xymon server with over 3,000 Xymon clients on it. And we keep getting thousands of alert emails every day from Xymon clients.</div>
<div class=""><br class="">
</div>
<div class="">Therefore, the Upper Management would like to move some servers to Tivoli and they want to understand what Xymon does, and how it actually communicate with Clients. So that when we finally move some servers to Tivoli, we will not be missing
anything that Xymon has been monitoring.</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Agege<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 15, 2016, at 6:08 PM, Jeremy Laidman <<a href="mailto:jlaidman@rebel-it.com.au" class="">jlaidman@rebel-it.com.au</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px
#ccc solid; padding-left:1ex">
<div dir="ltr" class="" style="font-size:12pt; background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif">
<div class="" style="word-wrap:break-word">
<div class="">
<div class="">Please what script trigger the SSH tests that are built into the services that Xymon uses.</div>
</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">The SSH test, and all of the other network-probe tests (ping, http, etc) are performed by the xymonnet program. This is launched by the xymonlaunch supervisor process, by default once every 5 minutes. The execution parameters are defined in
the tasks.cfg file, in the [xymonnet] section.</div>
<div class=""><br class="">
</div>
<div class="">The way it works is this. When xymonnet runs, it looks in protocols.cfg and builts up its suite of TCP tests from there, such as "smtp" and "ssh". It also has built-in the three special non-TCP tests "ping", "dns" (or "dig") and "ntp". Next,
xymonnet scans the hosts file for any host with a tag matching any of these defined test names. And then it runs through each test for each host having that test.</div>
<div class=""><br class="">
</div>
<div class="">It's actually slightly more complicated than that, but it's functionally equivalent to how I've explained it. For more of the details, refer to the man page for xymonnet, and read the "XYMONNET INTERNALS" section.</div>
<div class=""><br class="">
</div>
<div class="">The "ssh" test is defined in protocols.cfg as follows:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">[ssh|ssh1|ssh2]</div>
<div class=""> send "SSH-2.0-OpenSSH_4.1\r\n"</div>
<div class=""> expect "SSH"</div>
<div class=""> options banner</div>
<div class=""> port 22</div>
</div>
<div class=""><br class="">
</div>
<div class="">This defines the port (which can be overridden per host in hosts.cfg) and whether the status page should show the response received after sending the "send" string. The "send" string gets sent to the remote server being subjected to the test.
The "expect" string is matched against the response (banner) and if successful, the status goes green, otherwise red. Or if the TCP socket fails to connect, the status goes red.</div>
<div class=""><br class="">
</div>
<div class="">Is there a particular problem you're trying to solve? If you would like some more relevant help, perhaps you could explain what you're trying to do, and what you are expecting to happen but is not.</div>
<div class=""><br class="">
</div>
<div class="">Cheers</div>
<div class="">Jeremy</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre>_______________________________________________
Xymon mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Xymon@xymon.com">Xymon@xymon.com</a>
<a class="moz-txt-link-freetext" href="http://lists.xymon.com/mailman/listinfo/xymon">http://lists.xymon.com/mailman/listinfo/xymon</a>
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
Adam Goryachev Website Managers <a class="moz-txt-link-abbreviated" href="http://www.websitemanagers.com.au">
www.websitemanagers.com.au</a></div>
</div>
</div>
</body>
</html>