Xymon Mailing List Archive search

using var in bb-hosts?

16 messages in this thread

list Brandste · Thu, 02 Mar 2006 09:35:42 +0100 ·

Hi all,

maybe a not important question...

Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)

But using different tests, slas, maintenance windows and stuff
easy generates a lot of rows...and the line gets hard to read
and to edit. (okok....i know about sed ;-) )

Is there a possibility to use variables as in hobbit-alerts?


So one could group:

   $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0"
   $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3"


1.1.1.1  usermonitor  #  http://www.userurl.com $locationA-sla $locationA-service
1.1.1.2  usermonitor2 #  http://www.userurl2.com $locationA-sla $locationA-service
...

man for bb-hosts says nothing about it.

Best
  Mathias
list Brandste · Thu, 02 Mar 2006 09:44:02 +0100 ·

[sorry, columns :(, this morning my input devics are a bit dizzy ]
quoted from Brandste

Hi all,

maybe a not important question...

Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)

But using different tests, slas, maintenance windows and stuff

easy generates a lot of columns...and the line gets hard to read
quoted from Brandste
and to edit. (okok....i know about sed ;-) )

Is there a possibility to use variables as in hobbit-alerts?


So one could group:

   $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0"
   $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3"


1.1.1.1  usermonitor  #  http://www.userurl.com $locationA-sla $locationA-service
1.1.1.2  usermonitor2 #  http://www.userurl2.com $locationA-sla $locationA-service
...

man for bb-hosts says nothing about it.

Best
  Mathias
list Thomas Seglard · Thu, 2 Mar 2006 12:09:25 +0100 ·
Hello,

since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : 
Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91
Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91
Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91
Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91
Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91
Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91
Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91
Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91
Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91
Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91
Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91
Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91

Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you !

Thomas Seglard
(I'm using Lotus Notes, what a challenge...)

Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
list Eric E *hs Schwimmer · Thu, 2 Mar 2006 11:31:10 -0500 ·
Three posibilities, off the top of my head:

On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.

On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22

I think if you disconnect after the version exchange, but
before the diffie-helman key exchance, sshd wont log anything.

Now, if you arent accepting v2 connections on your clients,
you'll have to set up a separate [ssh1] stanza that supplies
an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines.  Otherwise your logs are just going to be filled with
protocol mismatch messages instead.

HTH,

-Eric Schwimmer
Network Engineer
UVA HSCS Network Engineering  
quoted from Thomas Seglard
-----Original Message-----
From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 6:09 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] sshd notification in syslog


Hello, 
since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog : 
Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91 Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91 Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91 Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91 Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91 Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91 Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91 Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91 Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91 Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91 
Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ? Thank you ! 
Thomas Seglard (I'm using Lotus Notes, what a challenge...)

Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.

list Thomas Seglard · Thu, 2 Mar 2006 18:21:17 +0100 ·
Thank you !

the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem.

Best regards,

Thomas Seglard

"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :
quoted from Eric E *hs Schwimmer
Three posibilities, off the top of my head:

On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.

On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22

I think if you disconnect after the version exchange, but
before the diffie-helman key exchance, sshd wont log anything.

Now, if you arent accepting v2 connections on your clients,
you'll have to set up a separate [ssh1] stanza that supplies
an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh statement in your bb-hosts to ssh1 for those machines. Otherwise your logs are just going to be filled with
protocol mismatch messages instead.

HTH,

-Eric Schwimmer
Network Engineer
UVA HSCS Network Engineering 
-----Original Message-----
From: user-bb3e9041f07f@xymon.invalid > [mailto:user-bb3e9041f07f@xymon.invalid] > Sent: Thursday, March 02, 2006 6:09 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] sshd notification in syslog
Hello, > > since deployment of hobbit's client on 200 servers (hpux, > aix, sun, linux), I got this message in syslog : > > Feb 13 12:05:44 psa089 sshd[9813]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:06:47 psa089 sshd[9980]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:07:49 psa089 sshd[10006]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:17 psa089 sshd[10012]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:08:48 psa089 sshd[10078]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:09:52 psa089 sshd[10564]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:10:55 psa089 sshd[10871]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:11:57 psa089 sshd[10987]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:00 psa089 sshd[11060]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:13:20 psa089 sshd[11065]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:14:02 psa089 sshd[11166]: Did not receive > identification string from 158.157.156.91 > Feb 13 12:15:06 psa089 sshd[11297]: Did not receive > identification string from 158.157.156.91 > > Ip address is the one from my hobbit's server > (158.157.156.91). This message do not specify that the ssh > test failed, so I'm not worried about this. The main problem > is the size of syslog and /var is growing rapidly ! Anyone > knows how to prevent this message to be display in syslog ? > Thank you ! > > Thomas Seglard > (I'm using Lotus Notes, what a challenge...)
Ce message (et toutes ses pieces jointes eventuelles) est > confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa > destination, toute diffusion ou toute publication, totale ou > partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce > message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.
*****
This message and any attachments (the "message") are > confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or > affiliates shall be liable for the message if altered, > changed or falsified.
Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.
list Robert P. McGraw · Thu, 2 Mar 2006 14:19:12 -0500 ·
I am having the same problem and trying to follow your instructions.

 
I ran

 
 ##R##-zorn->[227] ##> ssh -V

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

 
To get the version number.

 
I also ran telnet host 22 and got back the following 

 
SSH-2.0-Sun_SSH_1.0.1

 
I have tried the following 

 
SSH-2.0-Sun_SSH_1.0.1

Sun_SSH_1.1

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

 
as the version number with no luck. 

 
I keep getting the following message log.

 
Mar  2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad
protocol version identification 'Sun_SSH_1.1

Mar  2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176

 
The only change in the log message is the version identification string.

 
How do I find the right version number to use?

 
Thanks

 
Robert

 
Robert P. McGraw, Jr.

Manager, Computer System                                         EMAIL:
user-33cf07af04dd@xymon.invalid

Purdue University
ROOM: MATH-807

Department of Mathematics                                        PHONE:
(XXX) XXX-XXXX

XXX N. University Street
FAX: (XXX) XXX-XXXX

West Lafayette, IN XXXXX-XXXX            
quoted from Thomas Seglard


From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] 
Sent: Thursday, March 02, 2006 12:21 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog

 
Thank you ! 

the second option (the one you preferred) was a good bet ! 
I added the lines as you indicate and that's solved my problem. 

Best regards, 

Thomas Seglard 

"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur
02/03/2006 17:31:10 :
Three posibilities, off the top of my head:

On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.

On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22
list Eric E *hs Schwimmer · Thu, 2 Mar 2006 14:41:48 -0500 ·
Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should
have worked (or at least, it works on my server running the openssh
version of sshd).  
Have you tried telneting into the port and  typing the version number
in yourself?  If it accepts it, you'll get some crazy diffie-hellman text, otherwise it will spit a protocol mismatch line back at you.

Also, silly question, but did you make sure to include to '\r\n' at
the end of the message?  If you did, you might want to try messing
with that (changing it to just '\r' or '\n') because the protocol
error in your syslog looks a little weird (extra newline), so I'm
wondering if there isnt something wrong there.

-Eric 
quoted from Robert P. McGraw
-----Original Message-----
From: McGraw, Robert P. [mailto:user-33cf07af04dd@xymon.invalid] Sent: Thursday, March 02, 2006 2:19 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog

I am having the same problem and trying to follow your instructions.

 
I ran

 
 ##R##-zorn->[227] ##> ssh -V

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

 
To get the version number.

 
I also ran telnet host 22 and got back the following 
 
SSH-2.0-Sun_SSH_1.0.1

 
I have tried the following 
 
SSH-2.0-Sun_SSH_1.0.1

Sun_SSH_1.1

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f

 
as the version number with no luck. 
 
I keep getting the following message log.

 
Mar  2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047 auth.info] Bad protocol version identification 'Sun_SSH_1.1

Mar  2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176

 
The only change in the log message is the version identification string.

 
How do I find the right version number to use?

 
Thanks

 
Robert

 
Robert P. McGraw, Jr.

Manager, Computer System                                         EMAIL: user-33cf07af04dd@xymon.invalid

Purdue University                                                          ROOM: MATH-807

Department of Mathematics                                        PHONE: (XXX) XXX-XXXX

XXX N. University Street                                                  FAX: (XXX) XXX-XXXX

West Lafayette, IN XXXXX-XXXX            

From: user-bb3e9041f07f@xymon.invalid [mailto:user-bb3e9041f07f@xymon.invalid] Sent: Thursday, March 02, 2006 12:21 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog

 
Thank you ! 
the second option (the one you preferred) was a good bet ! I added the lines as you indicate and that's solved my problem. 
Best regards, 
Thomas Seglard 
"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 02/03/2006 17:31:10 :
Three posibilities, off the top of my head:
On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.
On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.
ie.:
[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22
list Robert P. McGraw · Thu, 2 Mar 2006 14:54:29 -0500 ·
What ever I did this time seem to work. 

I used SSH-2.0-Sun_SSH_1.0.1\r\n and this seems to work now. 
quoted from Eric E *hs Schwimmer

Thanks

Robert


Robert P. McGraw, Jr.
Manager, Computer System                 EMAIL: user-33cf07af04dd@xymon.invalid
Purdue University                         ROOM: MATH-807
Department of Mathematics                PHONE: (XXX) XXX-XXXX
XXX N. University Street                   FAX: (XXX) XXX-XXXX
West Lafayette, IN XXXXX-XXXX            

-----Original Message-----
From: Schwimmer, Eric E *HS [mailto:user-1e1008b069d5@xymon.invalid]
Sent: Thursday, March 02, 2006 2:42 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog


Hrm, the first string (SSH-2.0-Sun_SSH_1.0.1) should
have worked (or at least, it works on my server running the openssh
version of sshd).

Have you tried telneting into the port and  typing the version number
in yourself?  If it accepts it, you'll get some crazy diffie-hellman
text, otherwise it will spit a protocol mismatch line back at you.

Also, silly question, but did you make sure to include to '\r\n' at
the end of the message?  If you did, you might want to try messing
with that (changing it to just '\r' or '\n') because the protocol
error in your syslog looks a little weird (extra newline), so I'm
wondering if there isnt something wrong there.

-Eric
-----Original Message-----
From: McGraw, Robert P. [mailto:user-33cf07af04dd@xymon.invalid]
Sent: Thursday, March 02, 2006 2:19 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog

I am having the same problem and trying to follow your instructions.


I ran


 ##R##-zorn->[227] ##> ssh -V

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f


To get the version number.


I also ran telnet host 22 and got back the following


SSH-2.0-Sun_SSH_1.0.1


I have tried the following


SSH-2.0-Sun_SSH_1.0.1

Sun_SSH_1.1

Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f


as the version number with no luck.


I keep getting the following message log.


Mar  2 14:03:47 zada.math.purdue.edu sshd[29349]: [ID 800047
auth.info] Bad protocol version identification 'Sun_SSH_1.1

Mar  2 14:03:47 zada.math.purdue.edu ' from 128.210.3.176


The only change in the log message is the version
identification string.


How do I find the right version number to use?


Thanks


Robert


Robert P. McGraw, Jr.

Manager, Computer System
   EMAIL: user-33cf07af04dd@xymon.invalid

Purdue University
             ROOM: MATH-807

Department of Mathematics
   PHONE: (XXX) XXX-XXXX

XXX N. University Street
            FAX: (XXX) XXX-XXXX

West Lafayette, IN XXXXX-XXXX


From: user-bb3e9041f07f@xymon.invalid
[mailto:user-bb3e9041f07f@xymon.invalid]
Sent: Thursday, March 02, 2006 12:21 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] RE: [SOLVED][hobbit] sshd notification in syslog


Thank you !

the second option (the one you preferred) was a good bet !
I added the lines as you indicate and that's solved my problem.

Best regards,

Thomas Seglard

"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a
écrit sur 02/03/2006 17:31:10 :
Three posibilities, off the top of my head:

On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.

On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22
list Rob Munsch · Thu, 02 Mar 2006 17:04:49 -0500 ·
Funny you should mention.

 From the SSH list where i posted the same question (user-1a0876705083@xymon.invalid):

"Generally, these are caused when a machine connects to the SSH port, but
doesn't attempt login.  they're very common if, for example, you're
making periodic connections to port 22 via some kind of monitoring
system.  However, any connection which never gets around to
authenticating, from a port scan to a user connecting and walking away
for a few minutes, can cause this message."

So... yeah.
quoted from Thomas Seglard

user-bb3e9041f07f@xymon.invalid wrote:
Hello,

since deployment of hobbit's client on 200 servers (hpux, aix, sun, linux), I got this message in syslog :

Feb 13 12:05:44 psa089 sshd[9813]: Did not receive identification string from 158.157.156.91
Feb 13 12:06:47 psa089 sshd[9980]: Did not receive identification string from 158.157.156.91
Feb 13 12:07:49 psa089 sshd[10006]: Did not receive identification string from 158.157.156.91
Feb 13 12:08:17 psa089 sshd[10012]: Did not receive identification string from 158.157.156.91
Feb 13 12:08:48 psa089 sshd[10078]: Did not receive identification string from 158.157.156.91
Feb 13 12:09:52 psa089 sshd[10564]: Did not receive identification string from 158.157.156.91
Feb 13 12:10:55 psa089 sshd[10871]: Did not receive identification string from 158.157.156.91
Feb 13 12:11:57 psa089 sshd[10987]: Did not receive identification string from 158.157.156.91
Feb 13 12:13:00 psa089 sshd[11060]: Did not receive identification string from 158.157.156.91
Feb 13 12:13:20 psa089 sshd[11065]: Did not receive identification string from 158.157.156.91
Feb 13 12:14:02 psa089 sshd[11166]: Did not receive identification string from 158.157.156.91
Feb 13 12:15:06 psa089 sshd[11297]: Did not receive identification string from 158.157.156.91

Ip address is the one from my hobbit's server (158.157.156.91). This message do not specify that the ssh test failed, so I'm not worried about this. The main problem is the size of syslog and /var is growing rapidly ! Anyone knows how to prevent this message to be display in syslog ?
Thank you !

Thomas Seglard
(I'm using Lotus Notes, what a challenge...)

Ce message (et toutes ses pieces jointes eventuelles) est confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified.

-- 

Rob Munsch
Solutions For Progress IT
list Rob Munsch · Thu, 02 Mar 2006 17:10:24 -0500 ·
Hmm. yes.  sometimes it helps to keep reading the thread before replying.
Giving it the version number stopped the log-choking complaints here as 
well.
Thanks!
quoted from Rob Munsch

user-bb3e9041f07f@xymon.invalid wrote:
Thank you !

the second option (the one you preferred) was a good bet !
I added the lines as you indicate and that's solved my problem.

Best regards,

Thomas Seglard

"Schwimmer, Eric E *HS" <user-1e1008b069d5@xymon.invalid> a écrit sur 
02/03/2006 17:31:10 :
Three posibilities, off the top of my head:

On the client side:
1. Install syslog-ng instead of ksyslogd, and
   filter on the ip address of your hobbit server.
2. Call your logrotate script (assuming you use one)
   more often, and/or make it compress your old syslog
   messages.

On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22

I think if you disconnect after the version exchange, but
before the diffie-helman key exchance, sshd wont log anything.

Now, if you arent accepting v2 connections on your clients,
you'll have to set up a separate [ssh1] stanza that supplies
an ssh v1 string (SSH-1.5-OpenSSH_4.2) and change your ssh
statement in your bb-hosts to ssh1 for those machines.  
Otherwise your logs are just going to be filled with
protocol mismatch messages instead.

HTH,

-Eric Schwimmer
Network Engineer
UVA HSCS Network Engineering  
-----Original Message-----
From: user-bb3e9041f07f@xymon.invalid
[mailto:user-bb3e9041f07f@xymon.invalid]
Sent: Thursday, March 02, 2006 6:09 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] sshd notification in syslog


Hello,

since deployment of hobbit's client on 200 servers (hpux,
aix, sun, linux), I got this message in syslog :

Feb 13 12:05:44 psa089 sshd[9813]: Did not receive
identification string from 158.157.156.91
Feb 13 12:06:47 psa089 sshd[9980]: Did not receive
identification string from 158.157.156.91
Feb 13 12:07:49 psa089 sshd[10006]: Did not receive
identification string from 158.157.156.91
Feb 13 12:08:17 psa089 sshd[10012]: Did not receive
identification string from 158.157.156.91
Feb 13 12:08:48 psa089 sshd[10078]: Did not receive
identification string from 158.157.156.91
Feb 13 12:09:52 psa089 sshd[10564]: Did not receive
identification string from 158.157.156.91
Feb 13 12:10:55 psa089 sshd[10871]: Did not receive
identification string from 158.157.156.91
Feb 13 12:11:57 psa089 sshd[10987]: Did not receive
identification string from 158.157.156.91
Feb 13 12:13:00 psa089 sshd[11060]: Did not receive
identification string from 158.157.156.91
Feb 13 12:13:20 psa089 sshd[11065]: Did not receive
identification string from 158.157.156.91
Feb 13 12:14:02 psa089 sshd[11166]: Did not receive
identification string from 158.157.156.91
Feb 13 12:15:06 psa089 sshd[11297]: Did not receive
identification string from 158.157.156.91

Ip address is the one from my hobbit's server
(158.157.156.91). This message do not specify that the ssh
test failed, so I'm not worried about this. The main problem
is the size of syslog and /var is growing rapidly ! Anyone
knows how to prevent this message to be display in syslog ?
Thank you !

Thomas Seglard
(I'm using Lotus Notes, what a challenge...)

Ce message (et toutes ses pieces jointes eventuelles) est
confidentiel et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa
destination, toute diffusion ou toute publication, totale ou
partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce
message, CNP Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are
confidential and intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or
affiliates shall be liable for the message if altered,
changed or falsified.

Ce message (et toutes ses pieces jointes eventuelles) est confidentiel 
et etabli a l'intention exclusive de ses destinataires.
Toute utilisation de ce message non conforme a sa destination, toute 
diffusion ou toute publication, totale ou partielle, est
interdite, sauf autorisation expresse.
L'internet ne permettant pas d'assurer l'integrite de ce message, CNP 
Assurances et ses filiales declinent toute responsabilite
au titre de ce message, s'il a ete altere, deforme ou falsifie.

*****

This message and any attachments (the "message") are confidential and 
intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.
E-mails are susceptible to alteration.
Neither CNP Assurances nor any of its subsidiaries or affiliates shall 
be liable for the message if altered, changed or falsified.

-- 
Rob Munsch
Solutions For Progress IT
list Rob Munsch · Thu, 02 Mar 2006 18:00:46 -0500 ·
Along the lines of

    ~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to permanenly remove all traces of a test. 


from the FAQ, can i do something like

	"drop HOSTNAME disk /file/system/i/dont/care/about"

to get rid of something goofy causing an alert (in this case, a mounted 
ISO, which is, of course, at 100%...)?

-- 
Rob Munsch
Solutions For Progress IT
list Eric E *hs Schwimmer · Fri, 3 Mar 2006 09:14:12 -0500 ·
No, because the test data will just get regenerated the text time the hobbit client sends data.  Assuming you ARE using the hobbit
client, you could modify the hobbit-clients.cfg on your display
server to not alarm against those mounted filesystems:

DISK /mnt/iso 101 102 HOST=myhost

Although I'm not entirely certain that it will work with percentages
above 100%, but it'd be worth a shot.

-Eric
quoted from Rob Munsch
-----Original Message-----
From: Rob Munsch [mailto:user-f39e4aae1456@xymon.invalid] Sent: Thursday, March 02, 2006 6:01 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Dropping a filesystem as opposed to entire DISK test

Along the lines of

    ~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to permanenly remove all traces of a test. 

from the FAQ, can i do something like

	"drop HOSTNAME disk /file/system/i/dont/care/about"

to get rid of something goofy causing an alert (in this case, a mounted ISO, which is, of course, at 100%...)?

-- 
Rob Munsch
Solutions For Progress IT

list Henrik Størner · Mon, 6 Mar 2006 10:39:20 +0100 ·
quoted from Rob Munsch
On Thu, Mar 02, 2006 at 11:31:10AM -0500, Schwimmer, Eric E *HS wrote:
On the hobbit server side:
(this is my preferred option)
1. change your bb-services file ($HOBBIT/server/etc/bb-services)
   so that ssh test sends the version string.  I think that will
   stop your sshd from complaining.

ie.:

[ssh|ssh1|ssh2]
   send "SSH-2.0-OpenSSH_4.1\r\n"
   expect "SSH"
   options banner
   port 22
Thanks, I've added this to the default bb-services file in Hobbit.


Regards,
Henrik
list Henrik Størner · Mon, 6 Mar 2006 10:44:05 +0100 ·
You can also use the NORRDDISKS setting in hobbitserver.cfg to ignore
all filesystem data for certain disks. E.g. to drop graphs for the
filesystems mounted below /mnt or /media or the common cdrom/floppy mount points, you'd use
  NORRDDISKS="^/mnt|^/media|^/cdrom|^/floppy"


Henrik
quoted from Eric E *hs Schwimmer


On Fri, Mar 03, 2006 at 09:14:12AM -0500, Schwimmer, Eric E *HS wrote:
No, because the test data will just get regenerated the text time the hobbit client sends data.  Assuming you ARE using the hobbit
client, you could modify the hobbit-clients.cfg on your display
server to not alarm against those mounted filesystems:

DISK /mnt/iso 101 102 HOST=myhost

Although I'm not entirely certain that it will work with percentages
above 100%, but it'd be worth a shot.

-Eric
-----Original Message-----
From: Rob Munsch [mailto:user-f39e4aae1456@xymon.invalid] > Sent: Thursday, March 02, 2006 6:01 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] Dropping a filesystem as opposed to entire DISK test
Along the lines of
    ~/server/bin/bb 127.0.0.1 "drop HOSTNAME ftp" to > permanenly remove all traces of a test. > > > from the FAQ, can i do something like
	"drop HOSTNAME disk /file/system/i/dont/care/about"
to get rid of something goofy causing an alert (in this case, > a mounted > ISO, which is, of course, at 100%...)?
-- > Rob Munsch
Solutions For Progress IT
-- 

Henrik Storner
list Henrik Størner · Mon, 6 Mar 2006 11:11:51 +0100 ·
quoted from Brandste
On Thu, Mar 02, 2006 at 09:44:02AM +0100, user-1579f5e36334@xymon.invalid wrote:
Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)

But using different tests, slas, maintenance windows and stuff
easy generates a lot of columns...and the line gets hard to read
and to edit. (okok....i know about sed ;-) )

Is there a possibility to use variables as in hobbit-alerts?


So one could group:

   $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0"
   $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router2,router3"

1.1.1.1  usermonitor  #  http://www.userurl.com $locationA-sla $locationA-service
1.1.1.2  usermonitor2 #  http://www.userurl2.com $locationA-sla $locationA-service
Not currently.

I'm working on several enhancements to the configuration library,
because frankly the "bb-hosts" format has been pushed too far. It was OK
for Big Brother, but Hobbit has just evolved to have way too many
configuration options. We need something that allows using templates,
macros and such. And I also very much want to cut the connection between
the configuration of e.g. network tests and SLA's, and the configuration
of the webpage layout - that would allow for a much more flexible setup
of the Hobbit display.


Regards,
Henrik
list Brandste · Mon, 06 Mar 2006 11:48:33 +0100 ·
Thanxs!

i guess we will love the next versions ;-)


best
  Mathias
quoted from Henrik Størner


In message <user-9331a571919d@xymon.invalid>, Henrik Stoerner writes:
On Thu, Mar 02, 2006 at 09:44:02AM +0100, user-1579f5e36334@xymon.invalid wrote:
Using bb-hosts with multiple hosts elongates to quiet a view lines ;-)
But using different tests, slas, maintenance windows and stuff
easy generates a lot of columns...and the line gets hard to read
and to edit. (okok....i know about sed ;-) )
Is there a possibility to use variables as in hobbit-alerts?
So one could group:
   $locationA-sla="DOWNTIME=W:0700:0730 REPORTTIME=W:0731:0659 WARNPCT:95.0
"
   $locationA-service="NK:conn ftp ssh imap otherstuff route:router1,router
2,router3"
1.1.1.1  usermonitor  #  http://www.userurl.com $locationA-sla $locationA-s
ervice
1.1.1.2  usermonitor2 #  http://www.userurl2.com $locationA-sla $locationA-
service
quoted from Henrik Størner
Not currently.

I'm working on several enhancements to the configuration library,
because frankly the "bb-hosts" format has been pushed too far. It was OK
for Big Brother, but Hobbit has just evolved to have way too many
configuration options. We need something that allows using templates,
macros and such. And I also very much want to cut the connection between
the configuration of e.g. network tests and SLA's, and the configuration
of the webpage layout - that would allow for a much more flexible setup
of the Hobbit display.


Regards,
Henrik