[Xymon] Method to report/list all configured clients and their info.

[john.r.rothlisberger at accenture.com]

So, I find this command to be very interesting:

xymoncmd xymon localhost "xymondboard test=info fields=hostname,ip,XMH_ALLPAGEPATHS"

But, if I change it just a bit so that I get only the page name that a host resides on such as this:
xymon 0 "xymondboard host=<HOSTNAME> test=info fields=XMH_ALLPAGEPATHS"

It will return the page name that <HOSTNAME> resides on... UNLESS <HOSTNAME> is not unique and then it will include ALL the page names for hosts that match.

For example, if I put in "host=serverABC123" (and that particular server name is unique) it will return a single page name.  But, if I have multiple servers such as serverABC123, serverABC1, serverAB, & server - the page for every single one of those will be returned.

So, my question is, how can I return a single page for that one specific hostname?

I have tried several variations of the xymondboard command:
- "xymondboard serverAB.testname fields=..."
- "xymondboard host='serverAB' test=info fields=..."
- "xymondboard host=serverAB test=info fields=..."
Etc.

Any ideas how I can get the returned data to be for a single host?


Thanks,
John
Upcoming PTO:
_____________________________________________________________________
John Rothlisberger
IT Strategy, Infrastructure & Security - Technology Growth Platform
TGP for Business Process Outsourcing
Accenture
312.693.3136 office
_____________________________________________________________________


-----Original Message-----
From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of J.C. Cleaver
Sent: Thursday, May 12, 2016 11:45 AM
To: Mike Burger <mburger at bubbanfriends.org>
Cc: xymon at xymon.com
Subject: Re: [Xymon] Method to report/list all configured clients and their info.

On Wed, May 11, 2016 10:41 am, Mike Burger wrote:
> Good morning, all.
>
> I've got a request from my security and monitoring team for a way to
> export a list of all configured clients along with their IP addresses
> and either descriptions or page/subpage locations.
>
> Other than providing them with a copy of hosts.cfg on a regular basis,
> I've been unsuccessful in locating a way to do so (either in the
> documentation/man pages, mailing list archives or just good old Google).
>
> Is there a method to do so from the Xymon interface? Maybe a plugin
> that I'm not, yet, aware of?
>
> --
> Mike Burger
> http://www.bubbanfriends.org
>


Directly from the web interface, not especially (unless you've enabled xymoncgimsg.cgi for HTTP transport of xymon messages), but it's fairly easy from the command line:

xymoncmd xymon localhost "xymondboard test=info fields=hostname,ip,XMH_ALLPAGEPATHS"

This will only return systems that have sent (or been reported by) at least one xymon status message, but for most configurations that's fine.
There are different ways of collecting different types of auditable data as well such as looking at clientlog reports and comparing [ifconfig] output with whatever you might expect it to be. You can also compare incoming 'cpu' report existence with presence in hosts.cfg to find systems that haven't sent in a report at all and may not have been configured correctly.


If you have plenty of spare RAM on your main monitor server, I've found that saving client data via xymond_channel to tmpfs enables all sorts of interesting possibilities for a security and/or audit team. greping through the live state of your entire environment can be quite useful.


HTH,
-jc


_______________________________________________
Xymon mailing list
Xymon at xymon.com
http://lists.xymon.com/mailman/listinfo/xymon

________________________________

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.
______________________________________________________________________________________

www.accenture.com