Custom test results displayed on a test page
list Rafal Roginela
Hi All,
Merry Christmas! I have a question and I have no Idea how to begin to
ask it so I'll just start by giving the scenario and maybe someone has a
totally different approach that I should take for this:
I have a PIX that sends syslog to my hobbit server I also have cron job
that runs a script that analyses that log file and gives me a nice
looking results that are piped out to a text file:
196 MB XX.XX.XX.XX
100 MB XX.XX.XX.XX
18 MB XX.XX.XX.XX
12 MB XX.XX.XX.XX
7 MB XX.XX.XX.XX
6 MB XX.XX.XX.XX
4 MB XX.XX.XX.XX
2 MB XX.XX.XX.XX
Ran at Fri Dec 19 11:40:36 2008
This is a top talker output from the PIX with different IP's in
different places depending on the amount of traffic generated by that
host.
What I would like to do is generate a custom test that would be able to,
at the very least, display this output so I can easily look at it by
clicking on the green dot for this custom test. But it would be cool if
I could graph it but that is a very much "Nice to have" and I have a
feeling that just getting the output on a page will be challenging
enough for me since I'm a complete newb at Xymon!
PS If anyone has ever ran into this also: My pix is sysloging to the
hobbit box good; I even have it going to a separate file for easy
sorting but I'm finding that it clogs up my messages file with duplicate
entries no mater which facility I try (right now I have used local4
through local6 changing the appropriate commands in the pix).
Thank you,
Rafal Roginela
Network Engineer
AmeriCash Loans, LLC
XXX Lee Street, Suite XXX
Des Plaines, IL XXXXX
Office (XXX) XXX-XXXX x109
Fax (XXX) XXX-XXXX
user-5b0d0daed758@xymon.invalid <mailto:user-5b0d0daed758@xymon.invalid>
This e-mail may contain confidential and/or privileged information. If
you are not the intended recipient (or have received this e-mail in
error) please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden.
list Henrik Størner
▸
In <user-8be2e3e23809@xymon.invalid> "Rafal Roginela" <user-744e62462615@xymon.invalid> writes:
I have a PIX that sends syslog to my hobbit server I also have cron job that runs a script that analyses that log file and gives me a nice looking results that are piped out to a text file:
196 MB XX.XX.XX.XX
100 MB XX.XX.XX.XX
18 MB XX.XX.XX.XX
12 MB XX.XX.XX.XX
7 MB XX.XX.XX.XX
6 MB XX.XX.XX.XX
4 MB XX.XX.XX.XX
2 MB XX.XX.XX.XX
Ran at Fri Dec 19 11:40:36 2008What I would like to do is generate a custom test that would be able to, at the very least, display this output so I can easily look at it by clicking on the green dot for this custom test.
That's easy. This script will do it, just add a section to hobbitlaunch.cfg to run this every 5 minutes or so. #!/bin/sh PIXLOGFILE=/var/log/pixlog.txt PIXHOSTNAME=pix.foo.com PIXCOLUMNNAME=talkers $BB $BBDISP "status $PIXHOSTNAME.$PIXCOLUMNNAME green `date` `cat $PIXLOGFILE` " exit 0 Modify the PIXLOGFILE / PIXHOSTNAME / PIXCOLUMNNAME to suit your setup.
But it would be cool if I could graph it
That's a bit more tricky. I guess those "XX.XX.XX.XX" are IP's ? And if they are IP-adresses of remote hosts talking to your site, then perhaps they change a lot ? In that case graphing it is pretty un-interesting, because one IP will not show up for very long in your data. On the other hand, if your PIX only gets traffic from a limited number of IP's, then it would make sense to create an RRD (graph database file) for each IP. It would probably be easier if your output would list the IP first and then the MB-value; then you could use the SPLITNCV handler that is built into Xymon 4.2.2 to parse the data and generate the RRD files. See the hobbitd_rrd man-page and "Custom graphs" section in the on-line help on your Hobbit server.
▸
PS If anyone has ever ran into this also: My pix is sysloging to the hobbit box good; I even have it going to a separate file for easy sorting but I'm finding that it clogs up my messages file with duplicate entries no mater which facility I try (right now I have used local4 through local6 changing the appropriate commands in the pix).
See your syslog.conf man-page. It depends on the exact flavor of syslogd your system has, but on my Linux box one can filter out certain facility.priority items from a logfile by using the "!" operator, or by specifying "none" as the priority. So on your "messages" syslog.conf entry, adding "log4,log5,log6.none" to the set of selectors should weed out your PIX logs from going to the messages file. Regards, Henrik
list Rafal Roginela
WOW! Thank You Henrik! Allot of times I'm just not sure where to start and I am a newb to anything *nix but I'm learning a lot. The problem is that it is like drinking from a fire hose so much so quick! Thank you so much this is exactly what I need to start off with! Those are IP's and especially the top 5 don't generally change much since this is my VPN PIX so I'll do more searching on the rrd stuff and I'm pretty sure I can hack up the script to make the output anyway I like it is just a few lines of Perl I picked up from the web. Thank You, Rafal Roginela
▸
Office (XXX) XXX-XXXX x109
Fax (XXX) XXX-XXXX
This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.
-----Original Message-----
▸
From: Henrik "Størner [mailto:user-ce4a2c883f75@xymon.invalid]
Sent: Friday, December 19, 2008 3:49 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] Custom test results displayed on a test page
In <user-8be2e3e23809@xymon.invalid> "Rafal Roginela" <user-744e62462615@xymon.invalid> writes:
I have a PIX that sends syslog to my hobbit server I also have cron job that runs a script that analyses that log file and gives me a nice looking results that are piped out to a text file:
196 MB XX.XX.XX.XX
100 MB XX.XX.XX.XX
18 MB XX.XX.XX.XX
12 MB XX.XX.XX.XX
7 MB XX.XX.XX.XX
6 MB XX.XX.XX.XX
4 MB XX.XX.XX.XX
2 MB XX.XX.XX.XX
Ran at Fri Dec 19 11:40:36 2008What I would like to do is generate a custom test that would be able to, at the very least, display this output so I can easily look at it by clicking on the green dot for this custom test.
That's easy. This script will do it, just add a section to hobbitlaunch.cfg to run this every 5 minutes or so. #!/bin/sh PIXLOGFILE=/var/log/pixlog.txt PIXHOSTNAME=pix.foo.com PIXCOLUMNNAME=talkers $BB $BBDISP "status $PIXHOSTNAME.$PIXCOLUMNNAME green `date` `cat $PIXLOGFILE` " exit 0 Modify the PIXLOGFILE / PIXHOSTNAME / PIXCOLUMNNAME to suit your setup.
But it would be cool if I could graph it
That's a bit more tricky. I guess those "XX.XX.XX.XX" are IP's ? And if they are IP-adresses of remote hosts talking to your site, then perhaps they change a lot ? In that case graphing it is pretty un-interesting, because one IP will not show up for very long in your data. On the other hand, if your PIX only gets traffic from a limited number of IP's, then it would make sense to create an RRD (graph database file) for each IP. It would probably be easier if your output would list the IP first and then the MB-value; then you could use the SPLITNCV handler that is built into Xymon 4.2.2 to parse the data and generate the RRD files. See the hobbitd_rrd man-page and "Custom graphs" section in the on-line help on your Hobbit server.
PS If anyone has ever ran into this also: My pix is sysloging to the hobbit box good; I even have it going to a separate file for easy sorting but I'm finding that it clogs up my messages file with duplicate entries no mater which facility I try (right now I have used local4 through local6 changing the appropriate commands in the pix).
See your syslog.conf man-page. It depends on the exact flavor of syslogd your system has, but on my Linux box one can filter out certain facility.priority items from a logfile by using the "!" operator, or by specifying "none" as the priority. So on your "messages" syslog.conf entry, adding "log4,log5,log6.none" to the set of selectors should weed out your PIX logs from going to the messages file. Regards, Henrik
list Rafal Roginela
Hi,
Well thanks to Henrik I got the page to display really cool! I reformatted the display so it could be graphed so now it looks like:
XX.XX.XX.XX: 75
XX.XX.XX.XX: 28
XX.XX.XX.XX: 7
XX.XX.XX.XX: 7
XX.XX.XX.XX: 4
The values are in MB and those are IP's. It is really cool!! Now onto the graph I'm having trouble finding how to use the SPLITNCV that Henrik mentioned. So far I have made the entry for the graph and I am generating the rrd file but it contains data for all hosts in one. I'd like to set the graph definition like the disk utilization where it splits per IP and then it puts it on one graph.
So far this is as far as I got:
I have the data on the page (thanks Henrik!)
I have inserted "talkers=ncv" into hobbitserver.cfg in the TEST2RRD field
I have inserted a line in hobbitserver.cfg SPLITNCV_talkers="*:GUAGE"
This only generates a single file though talkers.rrd and it looks valid using the rrdtool dump method listed in help. Any help with the graph definition and all that would be very helpful plus I'm sure that I have the SPLITNCV part wrong in defining columns too.
This is about as far as I can get at this point and there is no graph yet since all I have in hobbitgraph.cfg is:
[talkers]
TITLE Top Talkers on the VPN
YAXIS Megabytes
Any help would be appreciated.
Merry Christmas!
▸
Thank You,
Rafal Roginela
Office (XXX) XXX-XXXX x109
Fax (XXX) XXX-XXXX
This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.
-----Original Message-----
▸
From: Henrik "Størner [mailto:user-ce4a2c883f75@xymon.invalid]
Sent: Friday, December 19, 2008 3:49 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] Custom test results displayed on a test page
In <user-8be2e3e23809@xymon.invalid> "Rafal Roginela" <user-744e62462615@xymon.invalid> writes:
I have a PIX that sends syslog to my hobbit server I also have cron job that runs a script that analyses that log file and gives me a nice looking results that are piped out to a text file:
196 MB XX.XX.XX.XX
100 MB XX.XX.XX.XX
18 MB XX.XX.XX.XX
12 MB XX.XX.XX.XX
7 MB XX.XX.XX.XX
6 MB XX.XX.XX.XX
4 MB XX.XX.XX.XX
2 MB XX.XX.XX.XX
Ran at Fri Dec 19 11:40:36 2008What I would like to do is generate a custom test that would be able to, at the very least, display this output so I can easily look at it by clicking on the green dot for this custom test.
That's easy. This script will do it, just add a section to hobbitlaunch.cfg to run this every 5 minutes or so. #!/bin/sh PIXLOGFILE=/var/log/pixlog.txt PIXHOSTNAME=pix.foo.com PIXCOLUMNNAME=talkers $BB $BBDISP "status $PIXHOSTNAME.$PIXCOLUMNNAME green `date` `cat $PIXLOGFILE` " exit 0 Modify the PIXLOGFILE / PIXHOSTNAME / PIXCOLUMNNAME to suit your setup.
But it would be cool if I could graph it
That's a bit more tricky. I guess those "XX.XX.XX.XX" are IP's ? And if they are IP-adresses of remote hosts talking to your site, then perhaps they change a lot ? In that case graphing it is pretty un-interesting, because one IP will not show up for very long in your data. On the other hand, if your PIX only gets traffic from a limited number of IP's, then it would make sense to create an RRD (graph database file) for each IP. It would probably be easier if your output would list the IP first and then the MB-value; then you could use the SPLITNCV handler that is built into Xymon 4.2.2 to parse the data and generate the RRD files. See the hobbitd_rrd man-page and "Custom graphs" section in the on-line help on your Hobbit server.
PS If anyone has ever ran into this also: My pix is sysloging to the hobbit box good; I even have it going to a separate file for easy sorting but I'm finding that it clogs up my messages file with duplicate entries no mater which facility I try (right now I have used local4 through local6 changing the appropriate commands in the pix).
See your syslog.conf man-page. It depends on the exact flavor of syslogd your system has, but on my Linux box one can filter out certain facility.priority items from a logfile by using the "!" operator, or by specifying "none" as the priority. So on your "messages" syslog.conf entry, adding "log4,log5,log6.none" to the set of selectors should weed out your PIX logs from going to the messages file. Regards, Henrik