recurring email alerts

6 messages in this thread

list John D. Alexander · Fri, 11 Apr 2014 22:41:57 +0000 ·

My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.

Nothing I can find is testing for this file and the permissions are such that xymon can read it.

Any clues on where to look to find what is causing this?

Thanks.

John Alexander
Network Administrator
user-43e31ec8d822@xymon.invalid<mailto:user-43e31ec8d822@xymon.invalid>
Feeney Wireless, LLC  - PO Box 2549, Eugene, Oregon 97402
(Free) XXX-XXX-XXXX   (P) XXX-XXX-XXXX     (F) XXX-XXX-XXXX
www.feeneywireless.com<http://www.feeneywireless.com/>;
[FW_Acronym_email]<http://feeneywireless.com/>;
This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.

list John Thurston · Fri, 11 Apr 2014 14:57:02 -0800 ·

▸ quoted from John D. Alexander

On 4/11/2014 2:41 PM, John D. Alexander wrote:

My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.

Nothing I can find is testing for this file and the permissions are such that xymon can read it.

Any clues on where to look to find what is causing this?

First, confirm it isn't another host reporting under a false name. You 
could be investigating the wrong target.

-- 
    Do things because you should, not just because you can.

John Thurston    XXX-XXX-XXXX
user-ce4d79d99bab@xymon.invalid
Enterprise Technology Services
Department of Administration
State of Alaska

list Betsy Schwartz · Fri, 11 Apr 2014 21:43:31 -0400 ·

I had that error once when I had a space after the file name in analysis.cfg

If you can't find that file name maybe there's a shell eval that includes it somewhere?

Sent from my iPhone

▸ quoted from John D. Alexander

On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <user-9a0964743c57@xymon.invalid> wrote:

My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.
 Nothing I can find is testing for this file and the permissions are such that xymon can read it.
 Any clues on where to look to find what is causing this?
 Thanks.
 John Alexander
Network Administrator


user-43e31ec8d822@xymon.invalid
Feeney Wireless, LLC  - PO Box 2549, Eugene, Oregon 97402
(Free) XXX-XXX-XXXX   (P) XXX-XXX-XXXX     (F) XXX-XXX-XXXX www.feeneywireless.com
<image001.jpg>

▸ quoted from John D. Alexander

This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.

list John D. Alexander · Mon, 14 Apr 2014 15:14:50 +0000 ·

I’m at a loss.  Now I’ve got a client reporting /var/log/messages as unreadable and the server is showing a flapping status for msgs.  Group ownership for /var/log/messages is set to root:xymon with proper permissions, so it should be able to read it.  When I su to the xymon user, it can get to that file just fine.

There is nothing in analysis.cfg that is watching either /var/log/messages or /var/log/fail2ban.

I cleared msgs from the server.  Restarted the client.  The issue keeps coming back.

Any ideas?

John A.

▸ quoted from Betsy Schwartz

From: Betsy Schwartz [mailto:user-c61747246f66@xymon.invalid]
Sent: Friday, April 11, 2014 6:44 PM
To: John D. Alexander
Cc: xymon at xymon.com
Subject: Re: [Xymon] recurring email alerts

I had that error once when I had a space after the file name in analysis.cfg

If you can't find that file name maybe there's a shell eval that includes it somewhere?

Sent from my iPhone

On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <user-9a0964743c57@xymon.invalid<mailto:user-9a0964743c57@xymon.invalid>> wrote:
My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.

Nothing I can find is testing for this file and the permissions are such that xymon can read it.

Any clues on where to look to find what is causing this?

Thanks.

John Alexander
Network Administrator
user-43e31ec8d822@xymon.invalid<mailto:user-43e31ec8d822@xymon.invalid>
Feeney Wireless, LLC  - PO Box 2549, Eugene, Oregon 97402
(Free) XXX-XXX-XXXX   (P) XXX-XXX-XXXX     (F) XXX-XXX-XXXX
www.feeneywireless.com<http://www.feeneywireless.com/>;


<image001.jpg><http://feeneywireless.com/>;

▸ quoted from Betsy Schwartz

This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.

list Adam Goryachev · Tue, 15 Apr 2014 09:37:54 +1000 ·

▸ quoted from John D. Alexander

On 15/04/14 01:14, John D. Alexander wrote:

I'm at a loss. Now I've got a client reporting /var/log/messages as unreadable and the server is showing a flapping status for msgs.  Group ownership for /var/log/messages is set to root:xymon with proper permissions, so it should be able to read it.  When I su to the xymon user, it can get to that file just fine.

Look at the IP address reporting the issue, possibly you have two systems reporting under the same name.

Regards,
Adam

▸ quoted from John D. Alexander

There is nothing in analysis.cfg that is watching either /var/log/messages or /var/log/fail2ban.

I cleared msgs from the server.  Restarted the client.  The issue keeps coming back.

Any ideas?

John A.


*From:*Betsy Schwartz [mailto:user-c61747246f66@xymon.invalid]

▸ quoted from John D. Alexander

*Sent:* Friday, April 11, 2014 6:44 PM
*To:* John D. Alexander
*Cc:* xymon at xymon.com
*Subject:* Re: [Xymon] recurring email alerts


I had that error once when I had a space after the file name in analysis.cfg

If you can't find that file name maybe there's a shell eval that includes it somewhere?


Sent from my iPhone


On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <user-9a0964743c57@xymon.invalid <mailto:user-9a0964743c57@xymon.invalid>> wrote:

    My Xymon server keeps sending alerts for a system saying that
    /var/log/fail2ban.log is unreadable.

    Nothing I can find is testing for this file and the permissions
    are such that xymon can read it.

    Any clues on where to look to find what is causing this?

    Thanks.

    *John Alexander*
    Network Administrator


    /user-735ff4477b34@xymon.invalid
    <mailto:user-43e31ec8d822@xymon.invalid>_/

▸ quoted from John D. Alexander

    Feeney Wireless, LLC  - PO Box 2549, Eugene, Oregon 97402

    (Free) XXX-XXX-XXXX (P) XXX-XXX-XXXX    (F) XXX-XXX-XXXX


    /www.feeneywireless.com/ <http://www.feeneywireless.com/>;

    <image001.jpg> <http://feeneywireless.com/>;

▸ quoted from John D. Alexander


    This email transmission is intended only for the addressee shown
    above. It may contain information that is privileged, confidential
    or otherwise protected from disclosure. Any review, dissemination
    or use of this transmission or its contents by persons other than
    the addressee is strictly prohibited! If you have received this
    email transmission in error please notify us immediately.

--


Adam Goryachev Website Managers www.websitemanagers.com.au

list John D. Alexander · Tue, 15 Apr 2014 15:05:59 +0000 ·

I've checked all of my systems and no misconfigurations like that.  I also disabled the msgs report on the server and cleared all of the msgs status for the two servers and they are still reporting the issue of not being able to read log files.

I guess the next thing is to clear the entire host off the server and wait to see what happens.

John A.

▸ quoted from Adam Goryachev

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Adam Goryachev
Sent: Monday, April 14, 2014 4:38 PM
To: xymon at xymon.com
Subject: Re: [Xymon] recurring email alerts

On 15/04/14 01:14, John D. Alexander wrote:
I'm at a loss.  Now I've got a client reporting /var/log/messages as unreadable and the server is showing a flapping status for msgs.  Group ownership for /var/log/messages is set to root:xymon with proper permissions, so it should be able to read it.  When I su to the xymon user, it can get to that file just fine.

Look at the IP address reporting the issue, possibly you have two systems reporting under the same name.

Regards,
Adam

There is nothing in analysis.cfg that is watching either /var/log/messages or /var/log/fail2ban.

I cleared msgs from the server.  Restarted the client.  The issue keeps coming back.

Any ideas?

John A.

From: Betsy Schwartz [mailto:user-c61747246f66@xymon.invalid]
Sent: Friday, April 11, 2014 6:44 PM
To: John D. Alexander
Cc: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: Re: [Xymon] recurring email alerts

I had that error once when I had a space after the file name in analysis.cfg

If you can't find that file name maybe there's a shell eval that includes it somewhere?

Sent from my iPhone

On Apr 11, 2014, at 6:41 PM, "John D. Alexander" <user-9a0964743c57@xymon.invalid<mailto:user-9a0964743c57@xymon.invalid>> wrote:
My Xymon server keeps sending alerts for a system saying that /var/log/fail2ban.log is unreadable.

Nothing I can find is testing for this file and the permissions are such that xymon can read it.

Any clues on where to look to find what is causing this?

Thanks.

John Alexander
Network Administrator
user-43e31ec8d822@xymon.invalid<mailto:user-43e31ec8d822@xymon.invalid>
Feeney Wireless, LLC  - PO Box 2549, Eugene, Oregon 97402
(Free) XXX-XXX-XXXX   (P) XXX-XXX-XXXX     (F) XXX-XXX-XXXX
www.feeneywireless.com<http://www.feeneywireless.com/>;
<image001.jpg><http://feeneywireless.com/>;
This email transmission is intended only for the addressee shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the addressee is strictly prohibited! If you have received this email transmission in error please notify us immediately.

--


Adam Goryachev Website Managers www.websitemanagers.com.au<http://www.websitemanagers.com.au>;

recurring email alerts 🔗 link

recurring email alerts