<div dir="ltr"><div>You're not going to believe this, but the FreeBSD system running Xymon is listing Windows processes in the proc test. Which is why it can't see httpd, sshd, etc. processes.</div><div><div><br></div><div>I just set up a new Windows Server 2019 VM yesterday and added the PowerShell version of the Xymon client. I accidentally put the server's name in the configuration file where the host's name is supposed to go. The server must have accepted it at its word, pulled in the process list after it read its own process list, and overwritten the process list. Thus the alert is logical, but the sysadmin isn't. :)</div><div><br></div><div>Thanks for pointing out the process list and making me realize this.</div><div><br></div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"></div><div dir="ltr"></div><div dir="ltr"><table border="0" cellpadding="0" cellspacing="0" width="450" style="font-family:Times;table-layout:fixed"><tbody><tr><td align="center" valign="top" width="10"><br></td><td align="left" valign="top" nowrap width="16" style="border-left:6px solid rgb(71,124,204)"><img src="https://s3.amazonaws.com/htmlsig-assets/spacer.gif" width="10"></td><td align="left" valign="top" nowrap width="350"><br><p style="font-family:Helvetica,Arial,sans-serif;font-size:14px;line-height:16px;color:rgb(33,33,33);margin-bottom:10px;font-weight:bold;display:inline">Jaime Kikpole</p><p style="font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:14px;margin-bottom:10px"><span style="font-weight:bold;color:rgb(33,33,33)">Director of Technology & Innovations</span><br><span style="font-weight:bold;color:rgb(33,33,33)">Cairo-Durham Central School District</span><br><span style="color:rgb(33,33,33)">(518) 622-8543, x59500</span><br><a href="http://www.cairodurham.org" style="color:rgb(71,124,204);display:inline" target="_blank">cairodurham.org</a></p><p style="font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:14px;margin-bottom:10px"><span style="font-weight:bold;color:rgb(33,33,33)">Technical Support:</span><br><span style="color:rgb(33,33,33)"><a href="mailto:help@cairodurham.org" style="color:rgb(71,124,204);display:inline" target="_blank">help@cairodurham.org</a></span><br><a href="http://go.cairodurham.org/techtips" style="color:rgb(71,124,204);display:inline" target="_blank">go.cairodurham.org/techtips</a></p><p><a href="https://www.credential.net/d24m9rrp" target="_blank"><img src="https://drive.google.com/a/cairodurham.org/uc?id=11_6AEsVwBo6dOoVtRQGLMe9sQ-0t0-ga&export=download" width="96" height="96"></a><img src="https://api.accredible.com/v1/frontend/credential_website_embed_image/badge/13415328" width="96" height="96"></p></td></tr></tbody></table></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 6, 2020 at 4:16 PM Root, Paul T <<a href="mailto:Paul.Root@centurylink.com">Paul.Root@centurylink.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_3277218885513589137WordSection1">
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt">Look in your xymond test on your server. I’d bet that you are getting oversized
messages coming in from that host, and so processes is getting truncated.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt">Or look at processes for that host. And you will see that the process table
isn’t complete. <u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt">Ultimately, you’ll need to increase messages in your configuration file.<u></u><u></u></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><font size="2" face="Calibri"><span style="font-size:11pt;font-weight:bold">From:</span></font></b><span> Jaime Kikpole <<a href="mailto:jkikpole@cairodurham.org" target="_blank">jkikpole@cairodurham.org</a>>
<br>
<b><span style="font-weight:bold">Sent:</span></b> Wednesday, May 06, 2020 2:52 PM<br>
<b><span style="font-weight:bold">To:</span></b> <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>
<b><span style="font-weight:bold">Subject:</span></b> False alarm on proc<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
<div>
<div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt">My xymon system has been running well for years and it just started showing a red alarm on one of my host's processes list. It claims that there are 0 (zero) instances of every
process it is checking for, but I can still ssh over to that host and see the processes in a ps command.<u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt">I'm honestly at a loss. I'm not sure how to troubleshoot this. Any advice?<u></u><u></u></span></font></p>
</div>
<div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><u></u> <u></u></span></font></p>
</div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><br clear="all">
<u></u><u></u></span></font></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<table border="0" cellspacing="0" cellpadding="0" width="450" style="width:337.5pt">
<tbody>
<tr>
<td width="10" valign="top" style="width:7.5pt;padding:0in"></td>
<td width="16" nowrap valign="top" style="width:12pt;border-top:none;border-right:none;border-bottom:none;border-left:4.5pt solid rgb(71,124,204);padding:0in">
<p class="MsoNormal"><font face="Times"><span style="font-family:Times,serif"><img width="10" height="10" id="gmail-m_3277218885513589137_x0000_i1027" src="https://s3.amazonaws.com/htmlsig-assets/spacer.gif"></span></font><font face="Times"><span style="font-family:Times,serif"><u></u><u></u></span></font></p>
</td>
<td width="350" nowrap valign="top" style="width:262.5pt;padding:0in">
<p class="MsoNormal"><font size="2" face="Times"><span style="font-size:11pt;font-family:Times,serif"><u></u> <u></u></span></font></p>
<p style="margin-bottom:7.5pt;line-height:12pt"><b><font size="2" color="#212121" face="Helvetica"><span style="font-size:10.5pt;font-family:Helvetica,sans-serif;color:rgb(33,33,33);font-weight:bold">Jaime Kikpole<u></u><u></u></span></font></b></p>
<p style="margin-bottom:7.5pt;line-height:10.5pt"><b><font size="1" color="#212121" face="Helvetica"><span style="font-size:9pt;font-family:Helvetica,sans-serif;color:rgb(33,33,33);font-weight:bold">Director of Technology & Innovations</span></font></b><font size="1" face="Helvetica"><span style="font-size:9pt;font-family:Helvetica,sans-serif"><br>
<b><font color="#212121"><span style="color:rgb(33,33,33);font-weight:bold">Cairo-Durham Central School District</span></font></b><br>
<font color="#212121"><span style="color:rgb(33,33,33)">(518) 622-8543, x59500</span></font><br>
<a href="https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f%2fwww.cairodurham.org&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-0cd119db5bbfc7260beb80640b84368f5878c1f1" target="_blank"><font color="#477ccc"><span style="color:rgb(71,124,204)">cairodurham.org</span></font></a><u></u><u></u></span></font></p>
<p style="margin-bottom:7.5pt;line-height:10.5pt"><b><font size="1" color="#212121" face="Helvetica"><span style="font-size:9pt;font-family:Helvetica,sans-serif;color:rgb(33,33,33);font-weight:bold">Technical Support:</span></font></b><font size="1" face="Helvetica"><span style="font-size:9pt;font-family:Helvetica,sans-serif"><br>
<font color="#212121"><span style="color:rgb(33,33,33)"><a href="mailto:help@cairodurham.org" target="_blank"><font color="#477ccc"><span style="color:rgb(71,124,204)">help@cairodurham.org</span></font></a></span></font><br>
<a href="https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f%2fgo.cairodurham.org%2ftechtips&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-3f1cdf5014891be60a8d9cfac22252e12e3f30eb" target="_blank"><font color="#477ccc"><span style="color:rgb(71,124,204)">go.cairodurham.org/techtips</span></font></a><u></u><u></u></span></font></p>
<p><font size="2" face="Calibri"><span style="font-size:11pt"><a href="https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fwww.credential.net%2fd24m9rrp&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-2141eb3834e531da3de3ee87bf004f2f49b91746" target="_blank"><font face="Times"><span style="font-family:Times,serif;text-decoration:none"><img border="0" width="96" height="96" id="gmail-m_3277218885513589137_x0000_i1026" src="https://drive.google.com/a/cairodurham.org/uc?id=11_6AEsVwBo6dOoVtRQGLMe9sQ-0t0-ga&export=download"></span></font></a></span></font><font face="Times"><span style="font-family:Times,serif"><img border="0" width="96" height="96" id="gmail-m_3277218885513589137_x0000_i1025" src="https://api.accredible.com/v1/frontend/credential_website_embed_image/badge/13415328"></span></font><font face="Times"><span style="font-family:Times,serif"><u></u><u></u></span></font></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11pt"><br>
</span></font><font size="1" color="#222222" face="Arial"><span style="font-size:8.5pt;font-family:Arial,sans-serif;color:rgb(34,34,34);background:white">This electronic message and any attachment(s) may contain confidential or legally privileged information protected
by law from further disclosure and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agency responsible to deliver it to the addressee), or if this message has been addressed to
you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachment(s). Please notify the sender immediately by return email or telephone and permanently delete this message and attachment(s) from
your system.</span></font> <u></u><u></u></p>
</div>
<center>This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately
notify the sender by reply e-mail and destroy all copies of the communication and any attachments.</center>
</div>
</blockquote></div>
<br>
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:11px;background-color:rgb(255,255,255)">This electronic message and any attachment(s) may contain confidential or legally privileged information protected by law from further disclosure and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agency responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachment(s). Please notify the sender immediately by return email or telephone and permanently delete this message and attachment(s) from your system.</span>