Xymon Mailing List Archive search

PORTS monitoring question

3 messages in this thread

list Charles Jones · Sun, 04 Jun 2006 09:04:55 -0700 ·
I'm trying to make that darn white ports dot go away (until Henrik adds the "noports" option) on my freshly installed hobbit server (latest snapshot).

Snippet of my hobbit-clients.cfg
HOST=my-hostname-1
     PORT LOCAL=%([.:]22^) STATE=LISTEN "TEXT=SSH listener" color="yellow"
     PORT LOCAL=%([.:]22^) STATE=ESTABLISHED MAX=10 TRACK=ssh "TEXT=SSH" color="yellow"
     PORT LOCAL=%([.:]8080^) STATE=LISTEN "TEXT=Apache SSL Server" color="yellow"
     PORT LOCAL=%([.:]8080^) STATE=ESTABLISHED MAX=20 TRACK=apache TEXT=apache color="yellow"

Do I have something wrong there? I still have the white dot of doom :)
Here is a snippet of the actual netstat output that is displayed on the ports page:

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN tcp        0      0 0.0.0.0:8080                0.0.0.0:*                   LISTEN
list Charles Jones · Wed, 07 Jun 2006 09:15:09 -0700 ·
I think I noticed why this isn't working on my new server. After installing the server I had all of the statuses that one would normally only expect to see if you had the client installed (cpu, memory, msgs, etc). So I assumed that the client was running also, but it's not.  Do I need to compile and run the client as well on the server, just to get the ports checks to work?
quoted from Charles Jones

Charles Jones wrote:
I'm trying to make that darn white ports dot go away (until Henrik adds the "noports" option) on my freshly installed hobbit server (latest snapshot).

Snippet of my hobbit-clients.cfg
HOST=my-hostname-1
    PORT LOCAL=%([.:]22^) STATE=LISTEN "TEXT=SSH listener" color="yellow"
    PORT LOCAL=%([.:]22^) STATE=ESTABLISHED MAX=10 TRACK=ssh "TEXT=SSH" color="yellow"
    PORT LOCAL=%([.:]8080^) STATE=LISTEN "TEXT=Apache SSL Server" color="yellow"
    PORT LOCAL=%([.:]8080^) STATE=ESTABLISHED MAX=20 TRACK=apache TEXT=apache color="yellow"

Do I have something wrong there? I still have the white dot of doom :)
Here is a snippet of the actual netstat output that is displayed on the ports page:

tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN tcp        0      0 0.0.0.0:8080                0.0.0.0:*                   LISTEN

list Henrik Størner · Thu, 8 Jun 2006 13:18:15 +0200 ·
quoted from Charles Jones
On Wed, Jun 07, 2006 at 09:15:09AM -0700, Charles Jones wrote:
I think I noticed why this isn't working on my new server. After 
installing the server I had all of the statuses that one would normally 
only expect to see if you had the client installed (cpu, memory, msgs, 
etc). So I assumed that the client was running also, but it's not.  Do I 
need to compile and run the client as well on the server, just to get 
the ports checks to work?
On the Hobbit server, the client is normally launched by the
hobbitlaunch program running all of the "server" tasks. This is just so
that you won't need to run a hobbitlaunch separately for the server-
and client-side stuff. So in your ~hobbit/server/etc/hobbitlaunch.cfg
you'll probably find a [hobbitclient] section:

	[hobbitclient]
		ENVFILE /usr/lib/hobbit/client/etc/hobbitclient.cfg
		NEEDS hobbitd
		CMD /usr/lib/hobbit/client/bin/hobbitclient.sh
		LOGFILE $BBSERVERLOGS/hobbitclient.log
		INTERVAL 5m

Now - about the "ports" status you have. Your regex is wrong:
   PORT LOCAL=%([.:]22^) STATE=LISTEN "TEXT=SSH listener" color="yellow"
The caret ^ means "beginning of data". You want "end of data", so it should
be a dollar-sign. So that rule should be
   PORT LOCAL=%([.:]22$) STATE=LISTEN "TEXT=SSH listener" color="yellow"

And yes - I know you probably just copied that from the example in the
hobbit-clients.cfg file. I've fixed those now :-)

(In general, for problems with the PCRE regular expressions there is a
utility shipped with the PCRE libraries, "pcretest", which lets you
try out the regular expressions against some data. Quite useful when
you're not a long-time Perl hacker).


Regards,
Henrik