using var in bb-hosts?
list Brandste
Hi all, maybe a not important question... Using bb-hosts with multiple hosts elongates to quiet a view lines ;-) But using different tests, slas, maintenance windows and stuff easy generates a lot of rows...and the line gets hard to read and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts? So one could group: $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0" $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3" 1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-service 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA-service ... man for bb-hosts says nothing about it. Best Mathias
list Brandste
[sorry, columns :(, this morning my input devics are a bit dizzy ]
▸
Hi all,
maybe a not important question...
Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)
But using different tests, slas, maintenance windows and stuff
easy generates a lot of columns...and the line gets hard to read
▸
and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts? So one could group: $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0" $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3" 1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-service 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA-service ... man for bb-hosts says nothing about it. Best Mathias
list Thomas Seglard
Hello, since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91 Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you ! Thomas Seglard (I'm using Lotus Notes, what a challenge...) Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
list Eric E *hs Schwimmer
Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22 I think if you disconnect after the version exchange, but before the diffie-helman key exchance, sshd wont log anything. Now, if you arent accepting v2 connections on your clients, you'll have to set up a separate [ssh1] stanza that supplies an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines. Otherwise your logs are just going to be filled with protocol mismatch messages instead. HTH, -Eric Schwimmer Network Engineer UVA HSCS Network Engineering
▸
-----Original Message----- From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 6:09 AM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] sshd notification in syslog Hello, since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91 Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you ! Thomas Seglard (I'm using Lotus Notes, what a challenge...) Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
list Thomas Seglard
Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :
▸
Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22 I think if you disconnect after the version exchange, but before the diffie-helman key exchance, sshd wont log anything. Now, if you arent accepting v2 connections on your clients, you'll have to set up a separate [ssh1] stanza that supplies an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines. Otherwise your logs are just going to be filled with protocol mismatch messages instead. HTH, -Eric Schwimmer Network Engineer UVA HSCS Network Engineering-----Original Message----- From: user-bb3e9041f07f@xymon.invalid > [mailto:user-bb3e9041f07f@xymon.invalid] > Sent: Thursday, March 02, 2006 6:09 AM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] sshd notification in syslogHello, > > since deployment of hobbit's client on 200 servers (hpux, > aix, sun, linux), I got this message in syslog : > > Feb 13 12:05:44 psa089 sshd[9813]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:06:47 psa089 sshd[9980]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:07:49 psa089 sshd[10006]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:17 psa089 sshd[10012]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:48 psa089 sshd[10078]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:09:52 psa089 sshd[10564]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:10:55 psa089 sshd[10871]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:11:57 psa089 sshd[10987]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:00 psa089 sshd[11060]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:20 psa089 sshd[11065]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:14:02 psa089 sshd[11166]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:15:06 psa089 sshd[11297]: Did not receive > identification string from 158.157.156.91 > > Ip address is the one from my hobbit's server > (158.157.156.91). This message do not specify that the ssh > test failed, so I'm not worried about this. The main problem > is the size of syslog and /var is growing rapidly ! Anyone > knows how to prevent this message to be display in syslog ? > Thank you ! > > Thomas Seglard > (I'm using Lotus Notes, what a challenge...)Ce message (et toutes ses pieces jointes eventuelles) est > confidentiel et etabli a l'intention exclusive de ses destinataires.Toute utilisation de ce message non conforme a sa > destination, toute diffusion ou toute publication, totale ou > partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce > message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie.***** This message and any attachments (the "message") are > confidential and intended solely for the addressees.Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or > affiliates shall be liable for the message if altered, > changed or falsified.
Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
list Robert P. McGraw
I am having the same problem and trying to follow your instructions. I ran ##R##-zorn->[227] ##> ssh -V Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f To get the version number. I also ran telnet host 22 and got back the following SSH-2.0-Sun_SSH_1.0.1 I have tried the following SSH-2.0-Sun_SSH_1.0.1 Sun_SSH_1.1 Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f as the version number with no luck. I keep getting the following message log. Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1 Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 The only change in the log message is the version identification string. How do I find the right version number to use? Thanks Robert Robert P. McGraw, Jr. Manager, Computer System EMAIL: user-33cf07af04dd@xymon.invalid Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (XXX) XXX-XXXX XXX N. University Street FAX: (XXX) XXX-XXXX West Lafayette, IN XXXXX-XXXX
▸
From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid]
Sent: Thursday, March 02, 2006 12:21 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog
Thank you !
the second option (the one you preferred) was a good bet !
I added the lines as you indicate and that's solved my problem.
Best regards,
Thomas Seglard
"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur
02/03/2006 17:31:10 :
Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22
list Eric E *hs Schwimmer
Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should have worked (or at least, it works on my server running the openssh version of sshd). Have you tried telneting into the port and typing the version number in yourself? If it accepts it, you'll get some crazy diffie-hellman text, otherwise it will spit a protocol mismatch line back at you. Also, silly question, but did you make sure to include to '\r\n' at the end of the message? If you did, you might want to try messing with that (changing it to just '\r' or '\n') because the protocol error in your syslog looks a little weird (extra newline), so I'm wondering if there isnt something wrong there. -Eric
▸
-----Original Message----- From: McGraw, Robert P. [mailto:user-33cf07af04dd@xymon.invalid] Sent: Thursday, March 02, 2006 2:19 PM To: user-ae9b8668bcde@xymon.invalid Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog I am having the same problem and trying to follow your instructions. I ran ##R##-zorn->[227] ##> ssh -V Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f To get the version number. I also ran telnet host 22 and got back the following SSH-2.0-Sun_SSH_1.0.1 I have tried the following SSH-2.0-Sun_SSH_1.0.1 Sun_SSH_1.1 Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f as the version number with no luck. I keep getting the following message log. Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1 Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 The only change in the log message is the version identification string. How do I find the right version number to use? Thanks Robert Robert P. McGraw, Jr. Manager, Computer System EMAIL: user-33cf07af04dd@xymon.invalid Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (XXX) XXX-XXXX XXX N. University Street FAX: (XXX) XXX-XXXX West Lafayette, IN XXXXX-XXXX From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 12:21 PM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :Three posibilities, off the top of my head: On the client side:1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages.On the hobbit server side:(this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining.ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22
list Robert P. McGraw
What ever I did this time seem to work. I used SSH-2.0-Sun_SSH_1.0.1\r\n and this seems to work now.
▸
Thanks
Robert
Robert P. McGraw, Jr.
Manager, Computer System EMAIL: user-33cf07af04dd@xymon.invalid
Purdue University ROOM: MATH-807
Department of Mathematics PHONE: (XXX) XXX-XXXX
XXX N. University Street FAX: (XXX) XXX-XXXX
West Lafayette, IN XXXXX-XXXX
-----Original Message----- From: Schwimmer, Eric E *HS [mailto:user-1e1008b069d5@xymon.invalid] Sent: Thursday, March 02, 2006 2:42 PM To: user-ae9b8668bcde@xymon.invalid Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should have worked (or at least, it works on my server running the openssh version of sshd). Have you tried telneting into the port and typing the version number in yourself? If it accepts it, you'll get some crazy diffie-hellman text, otherwise it will spit a protocol mismatch line back at you. Also, silly question, but did you make sure to include to '\r\n' at the end of the message? If you did, you might want to try messing with that (changing it to just '\r' or '\n') because the protocol error in your syslog looks a little weird (extra newline), so I'm wondering if there isnt something wrong there. -Eric-----Original Message----- From: McGraw, Robert P. [mailto:user-33cf07af04dd@xymon.invalid] Sent: Thursday, March 02, 2006 2:19 PM To: user-ae9b8668bcde@xymon.invalid Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog I am having the same problem and trying to follow your instructions. I ran ##R##-zorn->[227] ##> ssh -V Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f To get the version number. I also ran telnet host 22 and got back the following SSH-2.0-Sun_SSH_1.0.1 I have tried the following SSH-2.0-Sun_SSH_1.0.1 Sun_SSH_1.1 Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f as the version number with no luck. I keep getting the following message log. Mar 2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1 Mar 2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176 The only change in the log message is the version identification string. How do I find the right version number to use? Thanks Robert Robert P. McGraw, Jr. Manager, Computer System EMAIL: user-33cf07af04dd@xymon.invalid Purdue University ROOM: MATH-807 Department of Mathematics PHONE: (XXX) XXX-XXXX XXX N. University Street FAX: (XXX) XXX-XXXX West Lafayette, IN XXXXX-XXXX From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 12:21 PM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22
list Rob Munsch
Funny you should mention. From the SSH list where i posted the same question (user-1a0876705083@xymon.invalid): "Generally, these are caused when a machine connects to the SSH port, but doesn't attempt login. they're very common if, for example, you're making periodic connections to port 22 via some kind of monitoring system. However, any connection which never gets around to authenticating, from a port scan to a user connecting and walking away for a few minutes, can cause this message." So... yeah.
▸
user-bb3e9041f07f@xymon.invalid wrote:
Hello, since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91 Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you ! Thomas Seglard (I'm using Lotus Notes, what a challenge...) Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
--
Rob Munsch
Solutions For Progress IT
list Rob Munsch
Hmm. yes. sometimes it helps to keep reading the thread before replying. Giving it the version number stopped the log-choking complaints here as well. Thanks!
▸
user-bb3e9041f07f@xymon.invalid wrote:
Thank you ! the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. Best regards, Thomas Seglard "Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :Three posibilities, off the top of my head: On the client side: 1. Install syslog-ng instead of ksyslogd, and filter on the ip address of your hobbit server. 2. Call your logrotate script (assuming you use one) more often, and/or make it compress your old syslog messages. On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22 I think if you disconnect after the version exchange, but before the diffie-helman key exchance, sshd wont log anything. Now, if you arent accepting v2 connections on your clients, you'll have to set up a separate [ssh1] stanza that supplies an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines. Otherwise your logs are just going to be filled with protocol mismatch messages instead. HTH, -Eric Schwimmer Network Engineer UVA HSCS Network Engineering-----Original Message----- From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 6:09 AM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] sshd notification in syslog Hello, since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91 Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you ! Thomas Seglard (I'm using Lotus Notes, what a challenge...) Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires. Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse. L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite au titre de ce message, s'il a ete altere, deforme ou falsifie. ***** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
-- Rob Munsch Solutions For Progress IT
list Rob Munsch
Along the lines of
~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to permanenly remove all traces of a test.
from the FAQ, can i do something like
"drop HOSTNAME disk /file/system/i/dont/care/about"
to get rid of something goofy causing an alert (in this case, a mounted
ISO, which is, of course, at 100%...)?
--
Rob Munsch
Solutions For Progress IT
list Eric E *hs Schwimmer
No, because the test data will just get regenerated the text time the hobbit client sends data. Assuming you ARE using the hobbit client, you could modify the hobbit-clients.cfg on your display server to not alarm against those mounted filesystems: DISK /mnt/iso 101 102 HOST=myhost Although I'm not entirely certain that it will work with percentages above 100%, but it'd be worth a shot. -Eric
▸
-----Original Message-----
From: Rob Munsch [mailto:user-f39e4aae1456@xymon.invalid] Sent: Thursday, March 02, 2006 6:01 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Dropping a filesystem as opposed to entire DISK test
Along the lines of
~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to permanenly remove all traces of a test.
from the FAQ, can i do something like
"drop HOSTNAME disk /file/system/i/dont/care/about"
to get rid of something goofy causing an alert (in this case, a mounted ISO, which is, of course, at 100%...)?
--
Rob Munsch
Solutions For Progress IT
list Henrik Størner
▸
On Thu, Mar 02, 2006 at 11:31:10AM -0500, Schwimmer, Eric E *HS wrote:
On the hobbit server side: (this is my preferred option) 1. change your bb-services file ($HOBBIT/server/etc/bb-services) so that ssh test sends the version string. I think that will stop your sshd from complaining. ie.: [ssh|ssh1|ssh2] send "SSH-2.0-OpenSSH_4.1\r\n" expect "SSH" options banner port 22
Thanks, I've added this to the default bb-services file in Hobbit. Regards, Henrik
list Henrik Størner
You can also use the NORRDDISKS setting in hobbitserver.cfg to ignore all filesystem data for certain disks. E.g. to drop graphs for the filesystems mounted below /mnt or /media or the common cdrom/floppy mount points, you'd use NORRDDISKS="^/mnt|^/media|^/cdrom|^/floppy" Henrik
▸
On Fri, Mar 03, 2006 at 09:14:12AM -0500, Schwimmer, Eric E *HS wrote:No, because the test data will just get regenerated the text time the hobbit client sends data. Assuming you ARE using the hobbit client, you could modify the hobbit-clients.cfg on your display server to not alarm against those mounted filesystems: DISK /mnt/iso 101 102 HOST=myhost Although I'm not entirely certain that it will work with percentages above 100%, but it'd be worth a shot. -Eric-----Original Message----- From: Rob Munsch [mailto:user-f39e4aae1456@xymon.invalid] > Sent: Thursday, March 02, 2006 6:01 PM To: user-ae9b8668bcde@xymon.invalid Subject: [hobbit] Dropping a filesystem as opposed to entire DISK testAlong the lines of ~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to > permanenly remove all traces of a test. > > > from the FAQ, can i do something like "drop HOSTNAME disk /file/system/i/dont/care/about" to get rid of something goofy causing an alert (in this case, > a mounted > ISO, which is, of course, at 100%...)? -- > Rob MunschSolutions For Progress IT
--
Henrik Storner
list Henrik Størner
▸
On Thu, Mar 02, 2006 at 09:44:02AM +0100, user-1579f5e36334@xymon.invalid wrote:
Using bb-hosts with multiple hosts elongates to quiet a view lines ;-) But using different tests, slas, maintenance windows and stuff easy generates a lot of columns...and the line gets hard to read and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts? So one could group: $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0" $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3" 1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-service 1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA-service
Not currently. I'm working on several enhancements to the configuration library, because frankly the "bb-hosts" format has been pushed too far. It was OK for Big Brother, but Hobbit has just evolved to have way too many configuration options. We need something that allows using templates, macros and such. And I also very much want to cut the connection between the configuration of e.g. network tests and SLA's, and the configuration of the webpage layout - that would allow for a much more flexible setup of the Hobbit display. Regards, Henrik
list Brandste
Thanxs! i guess we will love the next versions ;-) best Mathias
▸
In message <user-9331a571919d@xymon.invalid>, Henrik Stoerner writes:On Thu, Mar 02, 2006 at 09:44:02AM +0100, user-1579f5e36334@xymon.invalid wrote:Using bb-hosts with multiple hosts elongates to quiet a view lines ;-) But using different tests, slas, maintenance windows and stuff easy generates a lot of columns...and the line gets hard to read and to edit. (okok....i know about sed ;-) ) Is there a possibility to use variables as in hobbit-alerts?So one could group:$locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0"
$locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3"1.1.1.1 usermonitor # http://www.userurl.com $locationA-sla $locationA-s ervice1.1.1.2 usermonitor2 # http://www.userurl2.com $locationA-sla $locationA- service
▸
Not currently. I'm working on several enhancements to the configuration library, because frankly the "bb-hosts" format has been pushed too far. It was OK for Big Brother, but Hobbit has just evolved to have way too many configuration options. We need something that allows using templates, macros and such. And I also very much want to cut the connection between the configuration of e.g. network tests and SLA's, and the configuration of the webpage layout - that would allow for a much more flexible setup of the Hobbit display. Regards, Henrik