[Xymon] Bug in handling of Windows services

Tue Mar 24 02:13:20 CET 2015

> I’ve done further testing on the Windows service reporting issue now and found that the format of analysis.cfg
> entries don’t seem to matter, they can be status= startup= or startup= status= or just status= and in all cases I get
> the color change but not the message change.

Hi, has this issue been addressed? I seem to be seeing the same behaviour with the latest (v2.00) WinPSClient and xymon server 4.3.18.
In my case I just have the following in analysis.cfg

HOST=name
        SVC servicename

Which would appear to be treated as just check that service is started in “client_config.c”

   1367                                         if (!currule->rule.svc.stateexp && !currule->rule.svc.startupexp) {
   1368                                                 /* No criteria defined, so we'll assume they just want to check that the service is running */
   1369                                                 currule->rule.svc.stateexp = setup_expr("started", 0);
   1370                                         }

The colour changes correctly if the service is stopped, but the message still says it is started!

I really don’t want my MS guys to get confused by this.

Cheers,
Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response
Information Technology Services
The University of Queensland
Level 4, Prentice Building, St Lucia 4072
T: +61 7 334 66645, M: +61 401 140 838
E: g.stone-tolcher at its.uq.edu.au<mailto:g.stone-tolcher at its.uq.edu.au> W: www.its.uq.edu.au<http://www.its.uq.edu.au>

ITS: Service. Team. Accountability. Results.

IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include.

Please consider the environment before printing this email.

CRICOS Code 00025B

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds
Sent: Thursday, 6 February 2014 11:09 PM
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve done further testing on the Windows service reporting issue now and found that the format of analysis.cfg entries don’t seem to matter, they can be status= startup= or startup= status= or just status= and in all cases I get the color change but not the message change.

However, if I restart the server when the state has changed then the next client data send changes the messages, however if I then change the state of the services the message doesn’t change with the color again until I restart the server. I tested this on 2 different servers (1 running BBWin and 1 running XymonPSClient) and the results are below.

State was stopped, Analysis.cfg is,

        SVC AdobeARMservice startup=automatic status=started
        SVC CentennialClientAgent status=started
        SVC CentennialIPTransferAgent status=started startup=automatic

Services started and this is seen

green AdobeARMservice is stopped/automatic - want started/automatic
green CentennialClientAgent is stopped/automatic - want started/automatic
green CentennialIPTransferAgent is stopped/automatic - want started/automatic

State was started, Analysis.cfg is this,

        SVC Connect_Direct_v4.6.00 startup=automatic status=started
        SVC Spooler startup=automatic status=started
        SVC RemoteRegistry startup=automatic status=started

Services stopped and this is seen,

red Connect_Direct_v4.6.00 is started/automatic - want started/automatic
red Spooler is started/automatic - want started/automatic
red RemoteRegistry is started/automatic - want started/automatic

Restart server and the following are displayed for the 2 sets

green AdobeARMservice is started/automatic - want started/automatic
green CentennialClientAgent is started/automatic - want started/Any
green CentennialIPTransferAgent is started/automatic - want started/automatic

red Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
red Spooler is stopped/automatic - want started/automatic
red RemoteRegistry is stopped/automatic - want started/automatic

Restart bottom 3 services and I get,

green Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
green Spooler is stopped/automatic - want started/automatic
green RemoteRegistry is stopped/automatic - want started/automatic

Restart server and next time client data is received I get

green Connect_Direct_v4.6.00 is started/automatic - want started/automatic
green Spooler is started/automatic - want started/automatic
green RemoteRegistry is started/automatic - want started/automatic

both hosts just have the ip address, host name and “# CLASS:win32” in hosts.cfg

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds
Sent: 05 February 2014 14:47
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve been doing some further testing on this and as far as I can tell, I was wrong about this being a bug in Xymon, it is just very particular about the analysis.cfg file (and the bug is actually in the documentation).

If I can’t narrow the problem down any further Henrik, I’ll send the data across to you. At the moment I’m thinking it’s the order of the values status= and started=. The documentation says status= first and then optionally started= however initial testing leads me to believe it’s the other way round.

However I’m seeing some funnies when testing so I’m going to plot out a testing strategy and then run a full set of tests. Once I’ve done that I will post the conclusions to the board

Regards,
Neil.

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of henrik at hswn.dk<mailto:henrik at hswn.dk>
Sent: 05 February 2014 11:55
To: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: Re: [Xymon] Bug in handling of Windows services

Den 2014-02-05 12:51, Neil Simmonds skrev:
I believe there is a bug in the way Xymon handles Windows service data. I’ve always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I’m currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client.
Can you send me a copy of the client data from such a case? And the configuration data (analysis.cfg, hosts.cfg entry) please.

Regards,
Henrik

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Conduct Authority
________________________________
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20150324/a8041645/attachment.html>