[Xymon] Xymon Digest, Vol 38, Issue 21

[Steff Watkins]

> Message: 1
> Date: Mon, 24 Mar 2014 18:43:26 +0000
> From: "Wilcox, Theodore A -FS" <tawilcox at fs.fed.us>
> To: "Xymon at xymon.com" <Xymon at xymon.com>
> Subject: [Xymon] Service smtp on hostname is not OK : Unexpected
> 	service	response
> Message-ID:
> 	<77942EE84FB4A845897BD3D18ED44CEA0105AA61 at 001FSN2MPN1-
> 028.001f.mgd2.msft.net>
> 
> Content-Type: text/plain; charset="us-ascii"
> 
> We are getting yellow alerts for all SMTP tests in Xymon.  The error given is
> "Service smtp on hostname is not OK : Unexpected service response".  This is
> a new installation and all of the SMTP servers have been yellow since Xymon
> was started.  Telnet into the server gives the response:  "220
> sv62.r1.fs.fed.us ESMTP Service  ready at Mon, 24 Mar 2014 12:23:42 -0600".
> The hosts file is from Big Brother.  All SMTP tests are SMTP.S.  We tried
> commenting out any line in the [SMTP] section that starts with "Send", but
> that didn't change anything.  There is nothing recent in the archives about
> this.  Any suggestions?
> 
> Ted

Hello Ted,

 I suspect this is caused by the 'reply' that the Xymon server is getting when it "handshakes" the SMTP server on the tested system.

To explain: I had a similar problem with solid yellow results for the sshd tests on some of my servers, not all even though the ssh daemons were available and reliable on the servers that were yellowing out. I took a look through documentation and newsgroups and found that it was most likely caused by  the header line that was being returned by the ssh daemon when the xymon test was run against it.

The expected response was set in the protocols.cfg file, in the following section:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22

That line, expect "SSH", instructs the xymon server to "expect" the response to be (to start with?) the phrase "SSH". As I had a mix of different ssh server daemons, most Openssh, some Sun-specific, some linux-specific, this meant that the initial header response from the various ssh servers were different. Some returned the required "SSH" tag in their headers and others didn't. So, xymon seemed to be reporting that it could connect to the ssh daemon, but that it was not getting the expected response hence a "yellow" light. I commented out the 'expect "SSH"' line and ever since I have not seen the erroneous yellow light.

Now, onto your issue in particular, if you look in the [$XYMONDIR]/server/etc/protocols.cfg file you will (most likely) find the default setup which is shown below:

-----
[smtp]
   send "mail\r\nquit\r\n"
   expect "220"
   options banner
   port 25
-----

Unless you have a definite reason for checking the text that is returned in the header when connecting to your SMTP server[1] I would suggest that you comment out the 'expect "220"'  line. Xymon would still just be checking that it could connect to your SMTP server just it would not be "expect"ing your SMTP server to return a specific header.

I can't remember if I needed to restart the xymon server to pickup the changes to protocols.cfg so please be aware that you "may" have to restart the xymon server.

Hope that helps.

[1] this could be useful for checking which servers are in need of upgrading, are running unwanted versions of servers or have changed for some reason

Regards,
Steff Watkins
-----
Steff Watkins                           Natural History Museum, Cromwell Road, London,SW75BD 
Systems programmer                      Email: s.watkins at nhm.ac.uk 
Systems Team                            Phone: +44 (0)20 7942 6000 opt 2
========
"Many were increasingly of the opinion that they'd all made a big mistake in coming down from the trees in the first place. And some said that even the trees had been a bad move, and that no one should ever have left the oceans." - HHGTTG