[Xymon] not receiving alerts

Sun Nov 10 09:54:42 CET 2013

I guess the next thing is to check your mail logs on the server, and see if it's mentioned there at that time and date.

Where would your xymon server send undeliverables?

Regards,

Carl

From: Kris Springer [mailto:kspringer at innovateteam.com]
Sent: 10 November 2013 01:36
To: Carl Inglis
Cc: Xymon MailingList
Subject: Re: [Xymon] not receiving alerts

Here's the output from the --test.

root at ip:/xymon/bin# ./bbcmd xymond_alert --test VM-Firewall proc

2013-11-09 17:31:40 Using default environment file /usr/lib/xymon/client/etc/xymonserver.cfg
00011942 2013-11-09 17:31:40 send_alert VM-Firewall:proc state Paging
00011942 2013-11-09 17:31:40 Matching host:service:dgroup:page 'VM-Firewall:proc:Innovate Servers:' against rule line 1
00011942 2013-11-09 17:31:40 *** Match with 'HOST=*' ***
00011942 2013-11-09 17:31:40 Matching host:service:dgroup:page 'VM-Firewall:proc:Innovate Servers:' against rule line 2
00011942 2013-11-09 17:31:40 *** Match with 'MAIL support at innovateteam.com<mailto:support at innovateteam.com> COLOR=red' ***
00011942 2013-11-09 17:31:40 Mail alert with command 'mail -s "Xymon [12345] VM-Firewall:proc CRITICAL (RED)" support at innovateteam.com<mailto:support at innovateteam.com>'

Thank you.
------------------------------------------------
Kris Springer

=======================

On Sat, Nov 9, 2013 at 3:32 PM, Carl Inglis <Carl.Inglis at rakon.com<mailto:Carl.Inglis at rakon.com>> wrote:
Hi Kris,

Searching the Archives I found this:

http://lists.xymon.com/archive/2008-June/019952.html

It includes an example of the "-test" option which will allow you to ensure that your tests are firing correctly.

Hope that helps.

Carl

From: Xymon [mailto:xymon-bounces at xymon.com<mailto:xymon-bounces at xymon.com>] On Behalf Of Kris Springer
Sent: 09 November 2013 22:45
To: Henrik Størner; Xymon MailingList
Subject: Re: [Xymon] not receiving alerts

I've attached a screen shot of the 'info' page of the host that's red.

Strangely enough the notifications.log file suddenly has some data in it now that I stripped some options out of the alerts.cfg file.

Here's some of the notifications.log data.  I X'd out the IP that was showing.

Sat Nov  9 11:50:47 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384026647 722
Sat Nov  9 12:12:48 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384027968 722
Sat Nov  9 12:20:57 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384028457 722
Sat Nov  9 12:35:59 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384029359 722
Sat Nov  9 14:31:55 2013 VM-Firewall.ssh (x.x.x.x) support at innovateteam.com<mailto:support at innovateteam.com>[2] 1384036315 722

Thank you.
------------------------------------------------
Kris Springer
=======================

On Sat, Nov 9, 2013 at 1:02 PM, Henrik Størner <henrik at hswn.dk<mailto:henrik at hswn.dk>> wrote:
On 09-11-2013 19:49, Kris Springer wrote:
Here's my new alerts.cfg file.  It didn't change anything though.  I'm
still not receiving alerts.  To force a trouble situation I've got a
line in my hosts file that's checking for ssh on a machine that has it
turned off so it will cause a red alert.

HOST=*
   MAIL support at innovateteam.com<mailto:support at innovateteam.com> <mailto:support at innovateteam.com<mailto:support at innovateteam.com>>
COLOR=red RECOVERED NOTICE

First, check the "info" status column for that host: The alert must be shown there, or your configuration is not being picked up.

Second, check the notifications.log logfile to see if the alerts are being sent. If they are, then you need to look into the mail logs.

Third, try running xymond_alert with the "--test HOSTNAME SERVICE" option to see what rules get picked up; see the man-page.

Regards,
Henrik

Carl Inglis
Systems Administrator

Rakon UK Limited
Dowsett House, Sadler Road, Lincoln LN6 3RS, United Kingdom
Tel: +44 1522 812630 | Fax: +44 1522 812664 | Mob: +44 7786 552915
Carl.Inglis at rakon.com | www.rakon.com

[The Queens Awards for Enterprise 2012]

[Rakon Logo]

This message together with any attachments contains confidential information and may be
subject to privilege. If you are not the intended recipient you may not distribute it in any
way, you must notify the sender immediately and delete any copies of the message along
with its attachments.

Rakon UK Ltd is a limited company registered in England and Wales.
Registered Office: Dowsett House, Sadler Road, Lincoln LN6 3RS
Company Registration Number: 5128090.

Please be aware that Rakon UK Limited may monitor email traffic data
including the date, time, subject line, sender and recipients for the
purposes of security and usage monitoring. Automated monitoring
systems may also be applied to ascertain whether incoming/outgoing
emails are likely to contain viruses, other destructive devices or
inappropriate content.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20131110/fd818588/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: qafe2.jpg
Type: image/jpeg
Size: 9624 bytes
Desc: qafe2.jpg
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20131110/fd818588/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: emailsig.jpg
Type: image/jpeg
Size: 4046 bytes
Desc: emailsig.jpg
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20131110/fd818588/attachment-0001.jpg>