[Xymon] Disk space test ignored

[J.C. Cleaver]

On Wed, April 6, 2016 10:26 am, Scot Kreienkamp wrote:
>

>> > On Tue, April 5, 2016 8:08 pm, Scot Kreienkamp wrote:
>> >
>> > >
>> > > I ran the dump and grep'd for the server name.  Here are the
>> matching
>> > > lines:
>> > >
>> > > PORT local=%([.:]80)$ min=1 color=red TRACK=WWW
>> > > HOST=innocent2.in.hq,innocent.in.hq TEXT=80-WWW (line: 468)
>> > > PORT local=%([.:]55000)$ min=0 color=red TRACK=RPC_Clients
>> > > HOST=innocent2.in.hq,innocent.in.hq TEXT=55000-RPC Client Access
>> > Sessions
>> > > (line: 469)
>> > > SVC MSExchangeADTopology status=started color=red
>> > > HOST=innocent2.in.hq,innocent.in.hq (line: 470)
>> > > SVC MSExchangeIS status=started color=red
>> > > HOST=innocent2.in.hq,innocent.in.hq (line: 471)
>> > > SVC MSExchangeMailboxAssistants status=started color=red
>> > > HOST=innocent2.in.hq,innocent.in.hq (line: 472)
>> > > SVC MSExchangeRPC status=started color=red
>> > > HOST=innocent2.in.hq,innocent.in.hq (line: 473)
>> > > SVC MSExchangeSA status=started color=red
>> > > HOST=innocent2.in.hq,innocent.in.hq (line: 474)
>> > > DISK * 15728640U 10485760U 0 -1 red
>> HOST=innocent2.in.hq,innocent.in.hq
>> > > (line: 475)
>> > > DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE
>> > HOST=innocent2.in.hq,innocent.in.hq
>> > > (line: 482)
>> > >
>> > >
>> > > It appears to be understanding the config correctly, but it's still
>> > > alerting on the percentage:
>> > > M (96% used) has reached the PANIC level (95%)
>> > > Filesystem    1K-blocks         Used        Avail  Capacity
>> Mounted
>> > > Label      Summary(Total\Avail GB)
>> > > M            2115137532   2032580452     82557080        96%
>> /FIXED/M:\
>> > > Ret_Mail   2017.15\78.73
>> > >
>> > >
>> >
>> > It still might be part of the DEFAULT entry, though. Is the "host"
>> entry
>> > listed literally as:
>> >
>> > HOST=innocent2.in.hq,innocent.in.hq
>> >
>> > ...in the config? IIRC, that needs to be a regex. Comma-separated is
>> only
>> > used when specifying colors (which aren't evaluated textually).
>> >
>> >
>> > HTH,
>> > -jc
>>
>>
>> If it's not parsing comma separated HOST= lines then the man pages are
>> wrong.  I'll separate it out and see if it makes any difference.

Yikes. That might be a documentation bug. Pretty sure COLOR is all that
will be eval'd like that.



>>
>> Here's the section from the analysis.cfg man page:
>> HOST=targetstring Rule matching a host by the hostname. "targetstring"
>> is
>> either a comma-separated list of hostnames (from the hosts.cfg file),
>> "*" to
>> indicate "all hosts", or a Perl-compatible regular expression. E.g.
>> "HOST=dns.foo.com,www.foo.com" identifies two specific hosts;
>> "HOST=%www.*.foo.com EXHOST=www-test.foo.com" matches all hosts
>> with a name beginning with "www", except the "www-test" host.
>>
>
> It's separated out with only that hostname on a HOST= line by itself.  No
> change in behavior.  I waited 4 hours between when I made the change and
> when I checked the results as I was out all morning, so it has definitely
> taken affect by now.
>
> PORT local=%([.:]80)$ min=1 color=red TRACK=WWW HOST=innocent.in.hq
> TEXT=80-WWW (line: 468)
> PORT local=%([.:]55000)$ min=0 color=red TRACK=RPC_Clients
> HOST=innocent.in.hq TEXT=55000-RPC Client Access Sessions (line: 469)
> SVC MSExchangeADTopology status=started color=red HOST=innocent.in.hq
> (line: 470)
> SVC MSExchangeIS status=started color=red HOST=innocent.in.hq (line: 471)
> SVC MSExchangeMailboxAssistants status=started color=red
> HOST=innocent.in.hq (line: 472)
> SVC MSExchangeRPC status=started color=red HOST=innocent.in.hq (line:
> 473)
> SVC MSExchangeSA status=started color=red HOST=innocent.in.hq (line: 474)
> DISK * 15728640U 10485760U 0 -1 red HOST=innocent.in.hq (line: 475)
> DISK %^(1|2|3|4|5|6|7|8|9|0).* IGNORE HOST=innocent.in.hq (line: 482)
>
> Any ideas?
>
>


Can you grep for DISK on this instead of the host? The config shown
*looks* correct to me, which makes me think that it's a different rule
being applied still.

When you run with --debug enabled on xymond_client, is there any output on
the 'df' evaluation for this host?

-jc