[Xymon] SMTP checks

[Jeremy Laidman]

Oh, by the way, the latest Xymon uses "ehlo xymonnet\r\nquit\r\n" as the
send string (with the same expect string). I doubt that would make a
difference. But you might be running a buggy xymonnet.

On Wed, 29 Sept 2021 at 17:54, Jeremy Laidman <jeremy at laidman.org> wrote:

> Ian
>
> [disclaimer: I don't use the smtp check]
>
> I'm wondering if the "connect timeout" relates not to the TCP connection
> but the SMTP conversation. I would do a packet capture during the
> interaction between xymonnet and the mail server, and see if it closely
> matches your telnet interaction, or deviates.
>
> The smtp check is defined in protocols.cfg
>
> [smtp]
>    send "mail\r\nquit\r\n"
>    expect "220"
>    options banner
>    port 25
>
> This expects a 220 in the response after the mail\r\nquit\r\n is sent:
>
> '*It will then expect a response beginning with "220".*' (my emphasis on
> the word "then")
>
> Your interaction shows 221 instead of 220, after the mail/quit strings.
> But if this is the problem, then protocols.cfg has been wrong for many,
> many years. I suspect (contrary to what I infer from the man page) that
> "expect" looks in the strings for the whole interaction, not just the ones
> after the "send" string is sent. In which case, the protocols.cfg entry for
> smtp should work fine.
>
> However, you might like to test removing the "expect" or altering to look
> for 221 instead of 220.
>
> Cheers
> Jeremy
>
>
> On Wed, 29 Sept 2021 at 00:22, Ian Diddams via Xymon <xymon at xymon.com>
> wrote:
>
>>
>>
>>
>> ---------- Forwarded message ----------
>> From: Ian Diddams <didds3 at yahoo.co.uk>
>> To: xymon <xymon at xymon.com>
>> Cc:
>> Bcc:
>> Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC)
>> Subject: SMTP checks
>> xymon server 4.3.28, centos 7.9
>> mail server centos 6 (about to be replaced anyway)
>>
>> I'm in a bit of a quandary...
>>
>> we have an smtp check of a server ("oscar").
>>
>> Literally for "years" (3+) the xymon in house smtp check has been more
>> than happy.
>>
>> Then since Sept 11th [1] its been flipping constantly beyween green and
>> happy to red
>> eg
>>
>> Service listening but unavailable (connect timeout)
>>
>>
>> Seconds: 0.001842000
>>
>>
>> But if I run a telnet test from the xymon server itself it always
>> connects immediately, and responds instantaneously.
>>
>> eg
>>
>> $ telnet oscar 25
>> Trying <redacted>...
>> Connected to oscar.
>> Escape character is '^]'.
>> 220 a.b.co.uk ESMTP Postfix
>> mail
>> 501 5.5.4 Syntax: MAIL FROM:<address>
>> quit
>> 221 2.0.0 Bye
>> Connection closed by foreign host.
>> $
>>
>>
>>
>> All xymon logs show are emails being sent because of the alerts, ad
>> falling statuses that are a result of the constant flipping from red to
>> green. maillog has nothing untoward, ditto messages.
>>
>> Anyone any ideas what on earth is suddenly occurring that may explain
>> this recent timeout issue?  any expereince of similar?
>>
>> didds
>>
>>
>>
>> [1] no changes made around that time etc.  Networks confirm nothing
>> shoing in their logs etc.
>>
>>
>>
>> ---------- Forwarded message ----------
>> From: Ian Diddams via Xymon <xymon at xymon.com>
>> To: xymon <xymon at xymon.com>
>> Cc:
>> Bcc:
>> Date: Tue, 28 Sep 2021 13:52:12 +0000 (UTC)
>> Subject: [Xymon] SMTP checks
>> _______________________________________________
>> Xymon mailing list
>> Xymon at xymon.com
>> http://lists.xymon.com/mailman/listinfo/xymon
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20210929/c6d92a47/attachment.htm>