- observium - lists.observium.org

Images in alerts
by Anders Johansson 29 Jan '16

29 Jan '16

Hi, I've seen that alerts include an image, base encoded in the actual html file, but the image is never displayed. Now I'm using that Redmond build software to read mails, perhaps that's why it's not working? Anyone else with outlook who can see the graph included in the alerts? //Anders

3 2

db.log errors
by Anders Johansson 29 Jan '16

29 Jan '16

Hi, I've on a fresh install of observium, from the latest SVN (not the stable) I'm seeing errors in the SQL log, mostly duplicate entry of various kinds: [2016/01/29 06:07:11 +0100] poller.php(17259): Failed dbQuery (#1062 - Duplicate entry '17-2-984be1747168-4934' for key 'dev_vlan_mac_port'), Query: INSERT INTO `vlans_fdb` (`device_id`,`vlan_id`,`port_id`,`mac_address`,`fdb_status`) VALUES ('17','2','4934','XXXXXXXXXX','learned') But also: [2016/01/28 16:01:05 +0100] (5756): Failed dbQuery (#1054 - Unknown column '' in 'field list'), Query: SELECT `` FROM `slas` WHERE `device_id` = '24'; [2016/01/28 16:01:05 +0100] (5756): Failed dbQuery (#1054 - Unknown column '' in 'field list'), Query: SELECT `` FROM `pseudowires` WHERE `device_id` = '24'; [2016/01/28 16:01:05 +0100] (5756): Failed dbQuery (#1054 - Unknown column 'device_id' in 'where clause'), Query: SELECT `alert_test_id` FROM `alert_tests` WHERE `device_id` = '24'; [2016/01/28 16:01:05 +0100] (5756): Failed dbQuery (#1054 - Unknown column 'device_id' in 'where clause'), Query: SELECT `maint_id` FROM `alerts_maint` WHERE `device_id` = '24'; [2016/01/28 16:01:05 +0100] (5756): Failed dbQuery (#1054 - Unknown column 'device_id' in 'where clause'), Query: SELECT `group_id` FROM `groups` WHERE `device_id` = '24'; I guess the 2:th errors are just possible to ignore if logic has changed, but the first ones are a bit worrying, perhaps there is a mismatch in the MySQL? (I'm on RHEL 6.7) //Anders

1 0

Observium: Pre-auth and security questions
by Nate Mellendorf 29 Jan '16

29 Jan '16

Tom, Thank you for your input. This has been a bit of a learning experience for me. After researching and playing around with Apache, I was able to enable basic authentication using htpasswd. When I attempt to access Observium, I'm prompted for credentials as expected. Once I login with the creds I've configured, I land at the Observium form based authentication page. I'm trying to pass the username and password provided to htpasswd, and send them to Observium on the backend. As you noted earlier, It seems like I should be able to do this with the remote user variable. However, I can't seem to get it to work. I've listed my current virtual host config below. I enabled a2enmod headers and restarted Apache with no luck. I'm curious if you know if there's something I'm missing. I'll keep digging and working away at this, but I thought I'd provide an update to the mailing list. Other users may find it helpful if we sort it out. Many thanks, <VirtualHost *:80> DocumentRoot /opt/observium/html/ CustomLog /opt/observium/logs/access_log combined ErrorLog /opt/observium/logs/error_log <Directory "/opt/observium/html/"> AuthType Basic AuthName "Restricted Content" AuthUserFile /etc/apache2/.htpasswd Require valid-user Options Indexes FollowSymLinks MultiViews AllowOverride All Order allow,deny allow from all RewriteEngine on RewriteCond %{ENV:REMOTE_USER} (.+) RequestHeader set X-Forwarded-User %{ENV:REMOTE_USER}e </Directory> </VirtualHost> - NM -----Original Message----- From: observium [mailto:observium-bounces@observium.org] On Behalf Of observium-request(a)observium.org Sent: Saturday, January 16, 2016 6:11 PM To: observium(a)observium.org Subject: observium Digest, Vol 66, Issue 96 Send observium mailing list submissions to <mailto:observium@observium.org> observium(a)observium.org To subscribe or unsubscribe via the World Wide Web, visit <http://postman.memetic.org/cgi-bin/mailman/listinfo/observium> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium or, via email, send a message with subject or body 'help' to <mailto:observium-request@observium.org> observium-request(a)observium.org You can reach the person managing the list at <mailto:observium-owner@observium.org> observium-owner(a)observium.org When replying, please edit your Subject line so it is more specific than "Re: Contents of observium digest..." Today's Topics: 1. Re: Observium: Pre-auth and security questions (Tom Laermans) ---------------------------------------------------------------------- Message: 1 Date: Sun, 17 Jan 2016 01:10:43 +0100 From: Tom Laermans < <mailto:tom.laermans@powersource.cx> tom.laermans(a)powersource.cx> To: Observium Network Observation System < <mailto:observium@observium.org> observium(a)observium.org> Subject: Re: [Observium] Observium: Pre-auth and security questions Message-ID: < <mailto:569ADC03.1000002@powersource.cx> 569ADC03.1000002(a)powersource.cx> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Hi Nate, We support trusting Apache with the auth (ie mod_auth_kerb, mod_auth_ldap, htpasswd, etc) by using its supplied REMOTE_USER variable - this works with at least the LDAP and MySQL backends; if your SSO setup could fill in these fields, you should be good. This bypasses our login forms of course. I use SSO with Kerberos (AD) tickets, handled by mod_auth_kerb. We also have an http-auth backend, but I don't think that will do what you want it to. There's also a CAS backend, fairly new, I have no idea how to use it but I don't think it could work with your netscaler setup. Tom On 16/01/2016 23:52, Nate Mellendorf wrote: > > Good evening everyone, > > I?ve been trying to configure Observium with a forms based SSO solution. > > My reasoning for this, is that I?d like to minimize the attack surface > for Observium when published to the Internet. > > As Observium supports groups, I thought it would be extremely > beneficial for clients to view their throughput at anytime from anywhere. > > I was curious if anyone in the community is using pre-authentication, > or if you?re publishing Observium directly to the Internet. > > I?m not as familiar with Apache and PHP, so hardening the service > through pre-auth seemed like a good first step. > > Unfortunately, I can?t quite get pre-auth to work. Observium uses > forms based authentication, which is hard to capture on the platform > I?m using. > > Here?s a link, if you?re curious on how I?m trying to capture it: > > <http://fritsesblog.blogspot.com/2015/04/link-to-netscaler-form-sso-kb> http://fritsesblog.blogspot.com/2015/04/link-to-netscaler-form-sso-kb. > html > > If I could get Observium to use basic authentication, I think I could > get it to work. Do we know if this is possible? A better question, is > pre-auth even necessary here? > > Aside from HTTPS, iptables, firewalling, and locking down SSH/root, > what other steps do you take to secure your Observium server? Do you > think that allowing Internet access is unwise at this time? > > Thank you for any input on insight into this. This is a concern of > mine that I?m trying to address. > > Your suggestions and opinions are very much appreciated. > > Regards, > > - NM > > > > _______________________________________________ > observium mailing list > <mailto:observium@observium.org> observium(a)observium.org > <http://postman.memetic.org/cgi-bin/mailman/listinfo/observium> http://postman.memetic.org/cgi-bin/mailman/listinfo/observium

3 2

does anyone else use http-auth ? . [SEC=UNCLASSIFIED]
by Peter.Hine＠familycourt.gov.au 29 Jan '16

29 Jan '16

thanks Peter Hine Senior Technical Support Engineer (Servers) FCoA ITS peter.hine(a)familycourt.gov.au ********************************************************************** The information contained in this e-mail (including any attachments) is for the exclusive use of the addressee. If you are not the intended recipient please notify the sender immediately and delete this e-mail. It is noted that legal privilege is not waived because you have read this e-mail. **********************************************************************

1 0

unset locations and missing location on drop down [SEC=UNCLASSIFIED]
by Peter.Hine＠familycourt.gov.au 29 Jan '16

29 Jan '16

ver: CE 0.16.1.7533 The two attached pictures show that i have 11 devices with unset location, which is strange as i've not added any equipment. when clicking on the location UNSET, i get the second picture, which is "No devices found". the other thing to note is when selecting the location drop down, it only shows up to Townsville. I have one more, Wollongong. So it appears to be showing $count locations not $count+1 (+1 for the UNSET entry) Wollongong is not listed out of alpha order. Selecting Wollongong from the Locations menu correctly shows equipment in the results, but still doesn't list Wollongong in the Locations drop down. (Embedded image moved to file: pic60288.gif) (Embedded image moved to file: pic64895.gif) thanks Peter Hine Senior Technical Support Engineer (Servers) FCoA ITS peter.hine(a)familycourt.gov.au ********************************************************************** The information contained in this e-mail (including any attachments) is for the exclusive use of the addressee. If you are not the intended recipient please notify the sender immediately and delete this e-mail. It is noted that legal privilege is not waived because you have read this e-mail. **********************************************************************

2 5

Sensors changing precision/scale
by Michael 29 Jan '16

29 Jan '16

Has anybody encountered devices that change their scale/precision whenever they feel like it? We have some that now behave this way after a recent software upgrade. We think it's a vendor bug (in this instance, Bluecoat), but might be prudent to catch the changing precision value during the poll. Currently it looks like the precision is detected once and stored in the db. Then subsequent polling is only adjusted based on the original precision value. I've attached a graph and some walks showing the behaviour...

2 1

device urls by hostname not id. [SEC=UNCLASSIFIED]
by Peter.Hine＠familycourt.gov.au 28 Jan '16

28 Jan '16

Vers: CE 0.16.1.7533 I've found that editing html/includes/entities/device.inc.php, line 478 return generate_url(array('page' => 'device', 'device' => $device ['device_id']), $vars); -> return generate_url(array('page' => 'device', 'device' => $device ['hostname']), $vars); produces urls that are hostname based. The questions are: was this the right place ? was there a variable somewhere i had to turn on to make this happen ? thanks Peter Hine Senior Technical Support Engineer (Servers) FCoA ITS peter.hine(a)familycourt.gov.au ********************************************************************** The information contained in this e-mail (including any attachments) is for the exclusive use of the addressee. If you are not the intended recipient please notify the sender immediately and delete this e-mail. It is noted that legal privilege is not waived because you have read this e-mail. **********************************************************************

3 4

CE 0.16.1.7533 graph errors
by Roland Hill 28 Jan '16

28 Jan '16

Hi, Firstly, a big thanks to the Dev team for releasing the latest CE version; very much appreciated. Since the upgrade my "Custom traffic graphs" just have the "Error drawing graph" message. Secondly, I also note the SNMP Statistic graphs on all devices have the same message. As I just use Observium on my home network "because I can" none of this is critical for me but I'd thought I'd pass on my observations. Thanks again for the release (my DD-WRT devices now report correctly ;-)). -- Regards, Roland PGP Key 0xDA39319B = BCF0 1214 BAE9 5A3D 46FC 21A6 360D 9398 DA39 319B

1 0

Hostname change
by Christian Gerbrandt 28 Jan '16

28 Jan '16

Hi, when I setup Observium for the first time, I used a local only DNS setup. In the meantime, we created a corporate wide DNS setup for our Lab. Old devices are still available, but obviously show up with their old hostname. Is there an easy way to change the hostname of a device? Regards, Christian

2 1

device down alerts
by Serghei Golipad 28 Jan '16

28 Jan '16

Guys, I've disabled ICMP checks yet I'm still getting device down alert "ping failed". Is there something special I need to do to fix this? Cheers PLEASE CONSIDER THE ENVIRONMENT BEFORE PRINTING THIS EMAIL. Kelway (UK) Ltd is a Company registered in England and Wales. This email is sent for and on behalf of Kelway Holdings Limited. Kelway Holdings Limited is the UK holding company for Kelway (UK) Limited trading as Kelway. The registered office for Kelway Holdings Limited (Company Number 05872067) and its UK group undertakings is 10 Fleet Place, London, EC4M 7RB. VAT Registration 902 1949 39. Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than Kelway or the sender of its existence. For more information about Kelway please visit www.kelway.co.uk

2 1