[Xymon] Who Column Test

[Henrik Størner]

On 13-11-2012 16:05, Ray Reuter wrote:
> I need to be able to alert off of the "who" column. An example would be
> if there was less than 5 connections I would like to be alerted. I know
> way back in Big Brother days there was a perl script to do just that but
> I am having zero luck of finding it now.

First step is to make the "who" status red - if you do that, then you 
can use the normal alert-rules to send out alerts.

Current Xymon versions allow you to modify the color of an existing 
status, by sending a "modify" command to xymond. So what I would do was 
to run a script on the Xymon server which regularly fetches all of the 
"who" statuses, counts how many users are logged in on each host, and 
the sends a "modify" status if the maximum is exceeded.


To get all of the "who" statuses, you can use
	xymon 127.0.0.1 "xymondboard test=who fields=hostname,msg"
The output from this command is one line per status, with the hostname, 
then a '|' delimiter, and then the status-message with new-line changed 
into '\n'. I'm sure someone with Perl / Python / whatever scripting 
knowledge could easily turn this into something where you could count 
the number of lines (one for each user, minus a couple of header-lines), 
but here's a C program that will do it:

--- cut here ---
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
         char buf[4096];
         char *hostname, *msg, *l_start, *l_end;

         while (fgets(buf, sizeof(buf), stdin)) {
                 int loggedin = 0;

                 hostname = strtok(buf, "|");
                 msg = strtok(NULL, "\n");
		if (!msg) continue;

                 l_start = msg;
                 do {
                         l_end = strstr(l_start, "\\n");

                         if ( (strncmp(l_start, "SESSIONNAME", 11) == 0) ||
                              (strncmp(l_start, ">", 1) == 0) ||
                              (strncmp(l_start, "rdp-tcp", 7) == 0) ||
                              (strncmp(l_start, "console", 7) == 0) ) {
                                 /* Ignore the line */
                         }
                         else {
                                 loggedin++;
                         }

                         l_start = l_end ? (l_end + 2) : NULL;
                 } while (l_start);

                 fprintf(stdout, "%s %d\n", hostname, loggedin);
         }

         return 0;
}
--- cut here ---

Just save this to "whocount.c" and run "gcc -o whocount whocount.c" to 
compile it. It ignores lines beginning with the texts "SESSIONNAME", 
">", "rdp-tcp" or "console" - I think those lines always appear in the 
"who" status regardless of who is logged in.

When you feed the input from the xymondboard command into this, it 
should output one line for each host with the hostname and the number of 
users logged in.

So putting it all together, this script will change the "who" status to 
red for all hosts where 5 or more users are logged in:

--- cut here ---
#!/bin/sh

LIMIT=5

xymon 127.0.0.1 "xymondboard test=who fields=hostname,msg" | whocount | 
while read L
do
     set $L
     HOSTNAME=$1
     LOGINCOUNT=$2

     if test $LOGINCOUNT -gt $LIMIT
     then
         echo 127.0.0.1 "modify $HOSTNAME.who red whomon $LOGINCOUNT 
users logged in (max is $LIMIT)"
     fi
done

exit 0
--- cut here ---

(assumes the "whocount" utility is in your PATH).

You'd run this as an extra task from tasks.cfg - e.g. every 5 minutes.


Now you have the "who" status going red when too many users are logged 
in, so alerting is easy - just add

TEST=who COLOR=red
	MAIL security at example.com

to alerts.cfg .


Regards,
Henrik