[Xymon] How to test remote ports

[Jeremy Laidman]

I would try *:80 as Josh suggested. It might not be exactly what you want,
but it might help to narrow down where the problem is.

What scenario are you trying to alert on? Are you trying to detect when
there's an established outgoing connection from the monitored host to one
specific other host?

I tend to use regular expressions, perhaps because of the examples in
analysis.cfg.

In case it helps, here's an example that works for me, albeit from the
analysis.cfg file (I don't use client mode anywhere):

PORT "REMOTE=%([.:]179)$" state=ESTABLISHED min=0 max=4 color=yellow
"TEXT=bgp connections out (TCP/179)"

I don't believe the quotes around "REMOTE=..." are important - it's just
how I tend to use regular expressions.

J

On Thu, 19 Jan 2023 at 07:43, Josh Luthman <josh at imaginenetworksllc.com>
wrote:

> Is 1.2.3.4 your Xymon server or the host IP?  The 1.2.3.4 in your example
> is the local addr that it would request from.  If you don't care, you could
> use *:80.
>
> https://xymon.com/help/manpages/man5/analysis.cfg.5.html
>
> On Tue, Jan 17, 2023 at 5:52 PM Christoph Zechner <zechner at vrvis.at>
> wrote:
>
>> Hi,
>>
>> I've been trying to establish a remote port check, but cannot get it to
>> work. After reading the man pages and the corresponding topics on the
>> mailing list, I've configured a test like this:
>>
>> PORT REMOTE=1.2.3.4:80
>>
>> but the remote port always comes back as down, even though it is up. Am
>> I doing something wrong? Local port checks all work perfectly, only the
>> remote ones do not.
>>
>> Am I doing something wrong here?
>>
>> Context: I am using local mode on all clients, so I'm putting all my
>> checks in /etc/xymon/localclient.cfg, but this should not effect this
>> check, right?
>>
>> Thanks in advance!
>>
>> Best regards
>> Christoph Zechner
>> _______________________________________________
>> Xymon mailing list
>> Xymon at xymon.com
>> http://lists.xymon.com/mailman/listinfo/xymon
>>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20230119/62fe14b6/attachment.htm>