False alarm on proc

[Jaime Kikpole]

You're not going to believe this, but the FreeBSD system running Xymon is
listing Windows processes in the proc test.  Which is why it can't see
httpd, sshd, etc. processes.

I just set up a new Windows Server 2019 VM yesterday and added the
PowerShell version of the Xymon client.  I accidentally put the server's
name in the configuration file where the host's name is supposed to go.
The server must have accepted it at its word, pulled in the process list
after it read its own process list, and overwritten the process list.  Thus
the alert is logical, but the sysadmin isn't.  :)

Thanks for pointing out the process list and making me realize this.




Jaime Kikpole

Director of Technology & Innovations
Cairo-Durham Central School District
(518) 622-8543, x59500
cairodurham.org <http://www.cairodurham.org>

Technical Support:
help at cairodurham.org
go.cairodurham.org/techtips

<https://www.credential.net/d24m9rrp>


On Wed, May 6, 2020 at 4:16 PM Root, Paul T <Paul.Root at centurylink.com>
wrote:

> Look in your xymond test on your server. I’d bet that you are getting
> oversized messages coming in from that host, and so processes is getting
> truncated.
>
>
>
> Or look at processes for that host. And you will see that the process
> table isn’t complete.
>
>
>
> Ultimately, you’ll need to increase messages in your configuration file.
>
>
>
> *From:* Jaime Kikpole <jkikpole at cairodurham.org>
> *Sent:* Wednesday, May 06, 2020 2:52 PM
> *To:* xymon at xymon.com
> *Subject:* False alarm on proc
>
>
>
> My xymon system has been running well for years and it just started
> showing a red alarm on one of my host's processes list.  It claims that
> there are 0 (zero) instances of every process it is checking for, but I can
> still ssh over to that host and see the processes in a ps command.
>
>
>
> I'm honestly at a loss.  I'm not sure how to troubleshoot this.  Any
> advice?
>
>
>
>
>
>
> *Jaime Kikpole*
>
> *Director of Technology & Innovations*
> *Cairo-Durham Central School District*
> (518) 622-8543, x59500
> cairodurham.org
> <https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f%2fwww.cairodurham.org&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-0cd119db5bbfc7260beb80640b84368f5878c1f1>
>
> *Technical Support:*
> help at cairodurham.org
> go.cairodurham.org/techtips
> <https://imss91-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=http%3a%2f%2fgo.cairodurham.org%2ftechtips&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-3f1cdf5014891be60a8d9cfac22252e12e3f30eb>
>
>
> <https://imss91-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fwww.credential.net%2fd24m9rrp&umid=33760788-A500-3905-8BC8-4967B16CB618&auth=19120be9529b25014b618505cb01789c5433dae7-2141eb3834e531da3de3ee87bf004f2f49b91746>
>
>
> This electronic message and any attachment(s) may contain confidential or
> legally privileged information protected by law from further disclosure and
> is intended only for the individual or entity identified above as the
> addressee. If you are not the addressee (or the employee or agency
> responsible to deliver it to the addressee), or if this message has been
> addressed to you in error, you are hereby notified that you may not copy,
> forward, disclose or use any part of this message or any attachment(s).
> Please notify the sender immediately by return email or telephone and
> permanently delete this message and attachment(s) from your system.
> This communication is the property of CenturyLink and may contain
> confidential or privileged information. Unauthorized use of this
> communication is strictly prohibited and may be unlawful. If you have
> received this communication in error, please immediately notify the sender
> by reply e-mail and destroy all copies of the communication and any
> attachments.
>

-- 
This electronic message and any attachment(s) may contain confidential or 
legally privileged information protected by law from further disclosure and 
is intended only for the individual or entity identified above as the 
addressee. If you are not the addressee (or the employee or agency 
responsible to deliver it to the addressee), or if this message has been 
addressed to you in error, you are hereby notified that you may not copy, 
forward, disclose or use any part of this message or any attachment(s). 
Please notify the sender immediately by return email or telephone and 
permanently delete this message and attachment(s) from your system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20200506/42ababb6/attachment.htm>