Bug in handling of Windows services

I have looked at this a long time ago and it is something that is server side and has nothing to do with the client.

Thanks,
John
Upcoming PTO:

John Rothlisberger
IT Strategy, Infrastructure & Security - Technology Growth Platform
TGP for Business Process Outsourcing
Accenture
XXX.XXX.XXXX office

-----Original Message-----
From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of J.C.
Cleaver
Sent: Monday, March 23, 2015 9:40 PM
To: Gavin Stone-Tolcher
Cc: xymon at xymon.com; 'Neil Simmonds'
Subject: Re: [Xymon] Bug in handling of Windows services


Gavin,

Apologies on this, as I'm getting up to speed.

I can confirm that I see the same thing with WinPSClient and a testing version
of 4.3.19. After a service start/stop the color updates but the inline comment
is incorrect.

Taking a closer look.


Regards,

-jc


On Mon, March 23, 2015 6:13 pm, Gavin Stone-Tolcher wrote:

I’ve done further testing on the Windows service reporting issue
now and found that the format of analysis.cfg entries don’t seem to
matter, they can be status= startup= or startup= status= or just
status= and in all cases I get the color change but not the message
change.

Hi, has this issue been addressed? I seem to be seeing the same
behaviour with the latest (v2.00) WinPSClient and xymon server 4.3.18.
In my case I just have the following in analysis.cfg

HOST=name
        SVC servicename

Which would appear to be treated as just check that service is started
in “client_config.c”

   1367                                         if
(!currule->rule.svc.stateexp && !currule->rule.svc.startupexp) {
   1368                                                 /* No criteria
defined, so we'll assume they just want to check that the service is
running */
   1369
currule->rule.svc.stateexp = setup_expr("started", 0);
   1370                                         }

The colour changes correctly if the service is stopped, but the
message still says it is started!

I really don’t want my MS guys to get confused by this.


Cheers,
Gavin Stone-Tolcher, IT Support Officer, Network Operations and
Incident Response Information Technology Services The University of
Queensland Level 4, Prentice Building, St Lucia 4072
T: +61 7 334 66645, M: +61 401 140 838
E: user-6e44775a32e5@xymon.invalid<mailto:user-6e44775a32e5@xymon.invalid>

W:

www.its.uq.edu.au<http://www.its.uq.edu.au>;

ITS: Service. Team. Accountability. Results.

IMPORTANT: This email and any attachments are intended solely for the
addressee(s), contain copyright material and are confidential. We do
not waive any legal privilege or rights in respect of copyright or
confidentiality. Except as intended addressees are otherwise
permitted, you do not have permission to use, disclose, reproduce or
communicate any part of this email or its attachments. Statements,
opinions and information not related to the official business of The
University of Queensland are neither given nor endorsed by us. By
using this email (including accessing any attachments or links) you
agree we are not liable for any loss or damage of any kind arising in
connection with any electronic defect, virus or other malicious code
we did not intentionally include.

Please consider the environment before printing this email.

CRICOS Code 00025B

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil
Simmonds
Sent: Thursday, 6 February 2014 11:09 PM
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve done further testing on the Windows service reporting issue now
and found that the format of analysis.cfg entries don’t seem to
matter, they can be status= startup= or startup= status= or just
status= and in all cases I get the color change but not the message change.

However, if I restart the server when the state has changed then the
next client data send changes the messages, however if I then change
the state of the services the message doesn’t change with the color
again until I restart the server. I tested this on 2 different servers
(1 running BBWin and 1 running XymonPSClient) and the results are below.

State was stopped, Analysis.cfg is,

        SVC AdobeARMservice startup=automatic status=started
        SVC CentennialClientAgent status=started
        SVC CentennialIPTransferAgent status=started startup=automatic

Services started and this is seen

green AdobeARMservice is stopped/automatic - want started/automatic
green CentennialClientAgent is stopped/automatic - want
started/automatic green CentennialIPTransferAgent is stopped/automatic
- want started/automatic

State was started, Analysis.cfg is this,

        SVC Connect_Direct_v4.6.00 startup=automatic status=started
        SVC Spooler startup=automatic status=started
        SVC RemoteRegistry startup=automatic status=started

Services stopped and this is seen,

red Connect_Direct_v4.6.00 is started/automatic - want
started/automatic red Spooler is started/automatic - want
started/automatic red RemoteRegistry is started/automatic - want
started/automatic

Restart server and the following are displayed for the 2 sets

green AdobeARMservice is started/automatic - want started/automatic
green CentennialClientAgent is started/automatic - want started/Any
green CentennialIPTransferAgent is started/automatic - want
started/automatic

red Connect_Direct_v4.6.00 is stopped/automatic - want
started/automatic red Spooler is stopped/automatic - want
started/automatic red RemoteRegistry is stopped/automatic - want
started/automatic

Restart bottom 3 services and I get,

green Connect_Direct_v4.6.00 is stopped/automatic - want
started/automatic green Spooler is stopped/automatic - want
started/automatic green RemoteRegistry is stopped/automatic - want
started/automatic

Restart server and next time client data is received I get

green Connect_Direct_v4.6.00 is started/automatic - want
started/automatic green Spooler is started/automatic - want
started/automatic green RemoteRegistry is started/automatic - want
started/automatic

both hosts just have the ip address, host name and “# CLASS:win32”
in hosts.cfg

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil
Simmonds
Sent: 05 February 2014 14:47
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve been doing some further testing on this and as far as I can
tell, I was wrong about this being a bug in Xymon, it is just very
particular about the analysis.cfg file (and the bug is actually in the
documentation).


If I can’t narrow the problem down any further Henrik, I’ll send
the data across to you. At the moment I’m thinking it’s the order
of the values status= and started=. The documentation says status=
first and then optionally started= however initial testing leads me to
believe it’s the other way round.

However I’m seeing some funnies when testing so I’m going to plot
out a testing strategy and then run a full set of tests. Once I’ve
done that I will post the conclusions to the board

Regards,
Neil.

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of
user-ce4a2c883f75@xymon.invalid<mailto:user-ce4a2c883f75@xymon.invalid>
Sent: 05 February 2014 11:55
To: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: Re: [Xymon] Bug in handling of Windows services


Den 2014-02-05 12:51, Neil Simmonds skrev:
I believe there is a bug in the way Xymon handles Windows service data.
I’ve always used BBWin agents and had the issue when a Service is in
a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I’m currently testing the WinPSClient and have found that I also get
the same erroneous message with that. This suggests to me the Xymon is
icorrectly handling the data from the client.
Can you send me a copy of the client data from such a case? And the
configuration data (analysis.cfg, hosts.cfg entry) please.

Regards,
Henrik


Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE,
CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial
Conduct Authority ________________________________
NOTE: This email and any information contained within or attached in a
separate file is confidential and intended solely for the Individual
to whom it is addressed. The information or data included is solely
for the purpose indicated or previously agreed. Any information or
data included with this e-mail remains the property of Findel PLC and
the recipient will refrain from utilising the information for any
purpose other than that indicated and upon request will destroy the
information and remove it from their records. Any views or opinions
presented are solely those of the author and do not necessarily
represent those of Findel PLC. If you are not the intended recipient,
be advised that you have received this email in error and that any
use, dissemination, forwarding, printing, or copying of this email is
strictly prohibited. No warranties or assurances are made in relation to the
safety and content of this e-mail and any attachments.
No liability is accepted for any consequences arising from it. Findel
Plc reserves the right to monitor all e-mail communications through
its internal and external networks. If you have received this email in
error please notify our IT helpdesk on +44(0) 1254 303030

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE,
CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial
Conduct Authority ________________________________
NOTE: This email and any information contained within or attached in a
separate file is confidential and intended solely for the Individual
to whom it is addressed. The information or data included is solely
for the purpose indicated or previously agreed. Any information or
data included with this e-mail remains the property of Findel PLC and
the recipient will refrain from utilising the information for any
purpose other than that indicated and upon request will destroy the
information and remove it from their records. Any views or opinions
presented are solely those of the author and do not necessarily
represent those of Findel PLC. If you are not the intended recipient,
be advised that you have received this email in error and that any
use, dissemination, forwarding, printing, or copying of this email is
strictly prohibited. No warranties or assurances are made in relation to the
safety and content of this e-mail and any attachments.
No liability is accepted for any consequences arising from it. Findel
Plc reserves the right to monitor all e-mail communications through
its internal and external networks. If you have received this email in
error please notify our IT helpdesk on +44(0) 1254 303030

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy.

www.accenture.com