Bug in handling of Windows services

8 messages in this thread

list Neil Simmonds · Wed, 5 Feb 2014 11:51:00 +0000 ·

I believe there is a bug in the way Xymon handles Windows service data. I've always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I'm currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client.

I'm on version 4.3.4 of Xymon Server. I had a look through the release notes for all versions since 4.3.4 and couldn't find any mention of it so I suspect it is still an issue.

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Services Authority
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

list Henrik Størner · Wed, 05 Feb 2014 12:54:59 +0100 ·

▸ quoted from Neil Simmonds

 
Den 2014-02-05 12:51, Neil Simmonds skrev:

I believe there is a
bug in the way Xymon handles Windows service data. I've always used

BBWin agents and had the issue when a Service is in a stopped state that
Xymon actually reports,

Service is started/automatic - want
started/automatic 

This is with the analysis.cfg line of 
SVC

Service status=started startup=automatic

I'm currently testing the

WinPSClient and have found that I also get the same erroneous message
with that. This suggests to me the Xymon is icorrectly handling the data
from the client.


 Can you send me a copy of the client data from such a
case? And the configuration data (analysis.cfg, hosts.cfg entry)
please.

Regards,
Henrik

list Neil Simmonds · Wed, 5 Feb 2014 14:47:08 +0000 ·

I’ve been doing some further testing on this and as far as I can tell, I was wrong about this being a bug in Xymon, it is just very particular about the analysis.cfg file (and the bug is actually in the documentation).


If I can’t narrow the problem down any further Henrik, I’ll send the data across to you. At the moment I’m thinking it’s the order of the values status= and started=. The documentation says status= first and then optionally started= however initial testing leads me to believe it’s the other way round.

However I’m seeing some funnies when testing so I’m going to plot out a testing strategy and then run a full set of tests. Once I’ve done that I will post the conclusions to the board

Regards,
Neil.

▸ quoted from Neil Simmonds

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of user-ce4a2c883f75@xymon.invalid
Sent: 05 February 2014 11:55
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

Den 2014-02-05 12:51, Neil Simmonds skrev:
I believe there is a bug in the way Xymon handles Windows service data. I’ve always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I’m currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client.
Can you send me a copy of the client data from such a case? And the configuration data (analysis.cfg, hosts.cfg entry) please.

Regards,
Henrik

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Services Authority
NOTE:  This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records.  Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments.  No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

list Neil Simmonds · Thu, 6 Feb 2014 13:09:09 +0000 ·

I’ve done further testing on the Windows service reporting issue now and found that the format of analysis.cfg entries don’t seem to matter, they can be status= startup= or startup= status= or just status= and in all cases I get the color change but not the message change.

However, if I restart the server when the state has changed then the next client data send changes the messages, however if I then change the state of the services the message doesn’t change with the color again until I restart the server. I tested this on 2 different servers (1 running BBWin and 1 running XymonPSClient) and the results are below.

State was stopped, Analysis.cfg is,

        SVC AdobeARMservice startup=automatic status=started
        SVC CentennialClientAgent status=started
        SVC CentennialIPTransferAgent status=started startup=automatic

Services started and this is seen

green AdobeARMservice is stopped/automatic - want started/automatic
green CentennialClientAgent is stopped/automatic - want started/automatic
green CentennialIPTransferAgent is stopped/automatic - want started/automatic

State was started, Analysis.cfg is this,

        SVC Connect_Direct_v4.6.00 startup=automatic status=started
        SVC Spooler startup=automatic status=started
        SVC RemoteRegistry startup=automatic status=started

Services stopped and this is seen,

red Connect_Direct_v4.6.00 is started/automatic - want started/automatic
red Spooler is started/automatic - want started/automatic
red RemoteRegistry is started/automatic - want started/automatic

Restart server and the following are displayed for the 2 sets

green AdobeARMservice is started/automatic - want started/automatic
green CentennialClientAgent is started/automatic - want started/Any
green CentennialIPTransferAgent is started/automatic - want started/automatic

red Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
red Spooler is stopped/automatic - want started/automatic
red RemoteRegistry is stopped/automatic - want started/automatic

Restart bottom 3 services and I get,

green Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
green Spooler is stopped/automatic - want started/automatic
green RemoteRegistry is stopped/automatic - want started/automatic

Restart server and next time client data is received I get

green Connect_Direct_v4.6.00 is started/automatic - want started/automatic
green Spooler is started/automatic - want started/automatic
green RemoteRegistry is started/automatic - want started/automatic

both hosts just have the ip address, host name and “# CLASS:win32” in hosts.cfg

▸ quoted from Neil Simmonds

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds
Sent: 05 February 2014 14:47
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve been doing some further testing on this and as far as I can tell, I was wrong about this being a bug in Xymon, it is just very particular about the analysis.cfg file (and the bug is actually in the documentation).

If I can’t narrow the problem down any further Henrik, I’ll send the data across to you. At the moment I’m thinking it’s the order of the values status= and started=. The documentation says status= first and then optionally started= however initial testing leads me to believe it’s the other way round.

However I’m seeing some funnies when testing so I’m going to plot out a testing strategy and then run a full set of tests. Once I’ve done that I will post the conclusions to the board

Regards,
Neil.

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of user-ce4a2c883f75@xymon.invalid<mailto:user-ce4a2c883f75@xymon.invalid>
Sent: 05 February 2014 11:55
To: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: Re: [Xymon] Bug in handling of Windows services

Den 2014-02-05 12:51, Neil Simmonds skrev:
I believe there is a bug in the way Xymon handles Windows service data. I’ve always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I’m currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client.
Can you send me a copy of the client data from such a case? And the configuration data (analysis.cfg, hosts.cfg entry) please.

Regards,
Henrik

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.


Express Gifts Limited is authorised and regulated by the Financial Conduct Authority

▸ quoted from Neil Simmonds

NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Services Authority
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the
Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any
information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the
information for any purpose other than that indicated and upon request will destroy the information and remove it from their records.
Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not
the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing,
or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this
e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor
all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT
helpdesk on +44(0) 1254 303030

list Gavin Stone-Tolcher · Tue, 24 Mar 2015 01:13:20 +0000 ·

▸ quoted from Neil Simmonds

I’ve done further testing on the Windows service reporting issue now and found that the format of analysis.cfg
entries don’t seem to matter, they can be status= startup= or startup= status= or just status= and in all cases I get
the color change but not the message change.

Hi, has this issue been addressed? I seem to be seeing the same behaviour with the latest (v2.00) WinPSClient and xymon server 4.3.18.
In my case I just have the following in analysis.cfg

HOST=name
SVC servicename

Which would appear to be treated as just check that service is started in “client_config.c”

1367 if (!currule->rule.svc.stateexp && !currule->rule.svc.startupexp) {
1368 /* No criteria defined, so we'll assume they just want to check that the service is running */
1369 currule->rule.svc.stateexp = setup_expr("started", 0);
1370 }

The colour changes correctly if the service is stopped, but the message still says it is started!

I really don’t want my MS guys to get confused by this.

Cheers,
Gavin Stone-Tolcher, IT Support Officer, Network Operations and Incident Response
Information Technology Services
The University of Queensland
Level 4, Prentice Building, St Lucia 4072
T: +61 7 334 66645, M: +61 401 140 838
E: user-6e44775a32e5@xymon.invalid<mailto:user-6e44775a32e5@xymon.invalid> W: www.its.uq.edu.au<http://www.its.uq.edu.au>;

ITS: Service. Team. Accountability. Results.

IMPORTANT: This email and any attachments are intended solely for the addressee(s), contain copyright material and are confidential. We do not waive any legal privilege or rights in respect of copyright or confidentiality. Except as intended addressees are otherwise permitted, you do not have permission to use, disclose, reproduce or communicate any part of this email or its attachments. Statements, opinions and information not related to the official business of The University of Queensland are neither given nor endorsed by us. By using this email (including accessing any attachments or links) you agree we are not liable for any loss or damage of any kind arising in connection with any electronic defect, virus or other malicious code we did not intentionally include.

Please consider the environment before printing this email.

CRICOS Code 00025B

▸ quoted from Neil Simmonds

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds
Sent: Thursday, 6 February 2014 11:09 PM
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve done further testing on the Windows service reporting issue now and found that the format of analysis.cfg entries don’t seem to matter, they can be status= startup= or startup= status= or just status= and in all cases I get the color change but not the message change.

However, if I restart the server when the state has changed then the next client data send changes the messages, however if I then change the state of the services the message doesn’t change with the color again until I restart the server. I tested this on 2 different servers (1 running BBWin and 1 running XymonPSClient) and the results are below.

State was stopped, Analysis.cfg is,

        SVC AdobeARMservice startup=automatic status=started
        SVC CentennialClientAgent status=started
        SVC CentennialIPTransferAgent status=started startup=automatic

Services started and this is seen

green AdobeARMservice is stopped/automatic - want started/automatic
green CentennialClientAgent is stopped/automatic - want started/automatic
green CentennialIPTransferAgent is stopped/automatic - want started/automatic

State was started, Analysis.cfg is this,

        SVC Connect_Direct_v4.6.00 startup=automatic status=started
        SVC Spooler startup=automatic status=started
        SVC RemoteRegistry startup=automatic status=started

Services stopped and this is seen,

red Connect_Direct_v4.6.00 is started/automatic - want started/automatic
red Spooler is started/automatic - want started/automatic
red RemoteRegistry is started/automatic - want started/automatic

Restart server and the following are displayed for the 2 sets

green AdobeARMservice is started/automatic - want started/automatic
green CentennialClientAgent is started/automatic - want started/Any
green CentennialIPTransferAgent is started/automatic - want started/automatic

red Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
red Spooler is stopped/automatic - want started/automatic
red RemoteRegistry is stopped/automatic - want started/automatic

Restart bottom 3 services and I get,

green Connect_Direct_v4.6.00 is stopped/automatic - want started/automatic
green Spooler is stopped/automatic - want started/automatic
green RemoteRegistry is stopped/automatic - want started/automatic

Restart server and next time client data is received I get

green Connect_Direct_v4.6.00 is started/automatic - want started/automatic
green Spooler is started/automatic - want started/automatic
green RemoteRegistry is started/automatic - want started/automatic

both hosts just have the ip address, host name and “# CLASS:win32” in hosts.cfg

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Neil Simmonds
Sent: 05 February 2014 14:47
To: xymon at xymon.com
Subject: Re: [Xymon] Bug in handling of Windows services

I’ve been doing some further testing on this and as far as I can tell, I was wrong about this being a bug in Xymon, it is just very particular about the analysis.cfg file (and the bug is actually in the documentation).

If I can’t narrow the problem down any further Henrik, I’ll send the data across to you. At the moment I’m thinking it’s the order of the values status= and started=. The documentation says status= first and then optionally started= however initial testing leads me to believe it’s the other way round.

However I’m seeing some funnies when testing so I’m going to plot out a testing strategy and then run a full set of tests. Once I’ve done that I will post the conclusions to the board

Regards,
Neil.

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of user-ce4a2c883f75@xymon.invalid<mailto:user-ce4a2c883f75@xymon.invalid>
Sent: 05 February 2014 11:55
To: xymon at xymon.com<mailto:xymon at xymon.com>
Subject: Re: [Xymon] Bug in handling of Windows services

Den 2014-02-05 12:51, Neil Simmonds skrev:
I believe there is a bug in the way Xymon handles Windows service data. I’ve always used BBWin agents and had the issue when a Service is in a stopped state that Xymon actually reports,

Service is started/automatic - want started/automatic

This is with the analysis.cfg line of

SVC Service status=started startup=automatic

I’m currently testing the WinPSClient and have found that I also get the same erroneous message with that. This suggests to me the Xymon is icorrectly handling the data from the client.
Can you send me a copy of the client data from such a case? And the configuration data (analysis.cfg, hosts.cfg entry) please.

Regards,
Henrik

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Conduct Authority
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

Name & Registered Office: EXPRESS GIFTS LIMITED, 2 GREGORY ST, HYDE, CHESHIRE, ENGLAND, SK14 4TH, Company No. 00718151.
Express Gifts Limited is authorised and regulated by the Financial Conduct Authority
NOTE: This email and any information contained within or attached in a separate file is confidential and intended solely for the Individual to whom it is addressed. The information or data included is solely for the purpose indicated or previously agreed. Any information or data included with this e-mail remains the property of Findel PLC and the recipient will refrain from utilising the information for any purpose other than that indicated and upon request will destroy the information and remove it from their records. Any views or opinions presented are solely those of the author and do not necessarily represent those of Findel PLC. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. No warranties or assurances are made in relation to the safety and content of this e-mail and any attachments. No liability is accepted for any consequences arising from it. Findel Plc reserves the right to monitor all e-mail communications through its internal and external networks. If you have received this email in error please notify our IT helpdesk on +44(0) 1254 303030

list Japheth Cleaver · Mon, 23 Mar 2015 19:40:08 -0700 ·

Gavin,

Apologies on this, as I'm getting up to speed.

I can confirm that I see the same thing with WinPSClient and a testing
version of 4.3.19. After a service start/stop the color updates but the
inline comment is incorrect.

Taking a closer look.


Regards,

-jc


On Mon, March 23, 2015 6:13 pm, Gavin Stone-Tolcher wrote:

Iâve done further testing on the Windows service reporting issue now
and found that the format of analysis.cfg
entries donât seem to matter, they can be status= startup= or startup=