- observium - lists.observium.org

IPMI Errors?
by Adam Ward 03 Apr '19

03 Apr '19

Hey Observium Team, I am not sure if IPMI on standard SuperMicro mainboards can be scraped for ECC errors and other SEL-type errors? Am I going to have to ship syslog data somewhere and act on it? We just had a DIMM throwing correctable errors but that doesn’t really show up anywhere in IPMI/SNMP as far as I can see, even after checking the SM MIBs. How do others accomplish similar monitoring? Adam Ward Systems Engineer Shamrock Trading Corporation Office Phone/Fax: (913) 310-2247 Email: award(a)rtsfinancial.com<mailto:award@rtsfinancial.com> Website: www.shamrocktradingcorp.com<http://www.shamrocktradingcorp.com/> This e-mail communication (including any attachments) is intended only for use by the individual or entity named above and is considered confidential. If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you should immediately stop reading this message and delete it from your system. Any unauthorized reading, distribution, copying or other use of this communication (or its attachments) is strictly prohibited.

2 4

Apache Vulnerability
by Adam Armstrong 02 Apr '19

02 Apr '19

Seems a lot of people will need to upgrade Apache today. "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected." https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211 adam. Sent from Mailbird [http://www.getmailbird.com/?utm_source=Mailbird&utm_medium=email&ut…]

1 0

Low dbm sensor alerts for shutdown interfaces
by Andrew Lemin 31 Mar '19

31 Mar '19

Hi, Has anyone else seen the issue where after enabling an alert checker for transceiver optics with sensor_value greater @sensor_limit and sensor_value less @sensor_limit_low, alerts are still received for shutdown interfaces? For example, on a cisco switch when running ‘show interfaces transceiver detail’, we can see; Optical High Alarm High Warn Low Warn Low Alarm Receive Power Threshold Threshold Threshold Threshold Port (dBm) (dBm) (dBm) (dBm) (dBm) Te1/1/25 -40.0 1.9 -1.0 -9.9 -13.9 Te2/1/1 -40.0 1.9 -1.0 -9.9 -13.9 Etc.. Te1/1/25 admin down down Te2/1/1 admin down down Etc The sensors page shows the correct thresholds etc, but shows the interface in Red (and hence is generating alerts through the checker), rather than grey (as the port is shutdown and has no fibre connected – hence -40dbm.). [cid:image001.png@01D4E0C6.4F698990] The same port on the Ports page does show the interface as being grey/shutdown [cid:image002.png@01D4E0C6.4F698990] Have no idea how to resolve this and stop getting transceiver alerts for shutdown interfaces? This sounds like a potential bug? Thanks, Andy.

5 10

Windows Agent?
by Hamilton, Kent 29 Mar '19

29 Mar '19

I'm curious how hard it will be to add a windows agent like the existing Linux agent. I have written a PowerShell listener that responds on 36602 with the output from whatever scripts are in a specific directory with the data formatted in the expected format for Observium. Currently I have scripts that return the installed packages, ioping, vmwaretools, and working on a few others (IIS, MSSQL, Exchange). I have yet to started looking at the Observium side of things other than glancing at includes/polling/unix_agent.inc.php and a few of the scripts in includes/polling/unix_agent/*. Any help out there for this? ________________________________ This e-mail and any documents accompanying it may contain legally privileged and/or confidential information belonging to Exegy, Inc. Such information may be protected from disclosure by law. The information is intended for use by only the addressee. If you are not the intended recipient, you are hereby notified that any disclosure or use of the information is strictly prohibited. If you have received this e-mail in error, please immediately contact the sender by e-mail or phone regarding instructions for return or destruction and do not use or disclose the content to others.

1 0

Bug Question - UPS Interface Issue
by Adam Ward 28 Mar '19

28 Mar '19

Adam/Team, I have a few new UPS systems that are Eaton 5PX units with their management card. I have others that function fine, but the last two I have installed, the port parsing isn’t working, and every poller run generates a new interface name somehow. See attached image. If I stop polling for the port, the issue goes away. It’s not critical, but I am wondering how to even go about troubleshooting this issue. How do I go about debugging this with support? Open a Jira ticket? Adam Ward Systems Engineer Shamrock Trading Corporation Office Phone/Fax: (913) 310-2247 Email: award(a)rtsfinancial.com<mailto:award@rtsfinancial.com> Website: www.shamrocktradingcorp.com<http://www.shamrocktradingcorp.com/> This e-mail communication (including any attachments) is intended only for use by the individual or entity named above and is considered confidential. If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you should immediately stop reading this message and delete it from your system. Any unauthorized reading, distribution, copying or other use of this communication (or its attachments) is strictly prohibited.

1 0

"Draw Error" with Custom OIDs
by Gordon Cheng (gocheng) 28 Mar '19

28 Mar '19

Hi Observium team: We are having Draw Error issue generating graphs from two Custom OIDs (connection counts and translation counts) for Cisco firewalls. These are the two OIDs which are working with snmpwalk: sjc-observium-1:/opt/observium# snmpwalk -v 2c -c '<snipped>' SJC-FW07-INTERNET .1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6 SNMPv2-SMI::enterprises.9.9.147.1.2.2.2.1.5.40.6 = Gauge32: 2521 sjc-observium-1:/opt/observium# snmpwalk -v 2c -c '<snipped>' SJC-FW07-INTERNET .1.3.6.1.4.1.9.10.77.1.2.1.0 SNMPv2-SMI::enterprises.9.10.77.1.2.1.0 = Gauge32: 1349 sjc-observium-1:/opt/observium# Our Observium is currently running 19.1.9656 (rolling) as a troubleshooting step (my colleague has another system and it works for them with 9656). We have the same issue when running 9712 earlier. [cid:image001.png@01D4E4B1.F132CE50] [cid:image002.png@01D4E4B1.F132CE50] [cid:image003.png@01D4E4B1.F132CE50] [cid:image004.png@01D4E4B1.F132CE50] Doesn't seem like there are any error logs: sjc-observium-1:/opt/observium/logs# grep -i xlate_count * sjc-observium-1:/opt/observium/logs# grep -i conn_count * sjc-observium-1:/opt/observium/logs# grep -i "1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6" * sjc-observium-1:/opt/observium/logs# grep -i "1.3.6.1.4.1.9.10.77.1.2.1.0" * sjc-observium-1:/opt/observium/logs# We would like to see if there is any suggestion to further troubleshoot the issue. Any input is greatly appreciated. Thanks. - Gordon

2 2

Re: [Observium] Low dbm sensor alerts for shutdown interfaces
by Adam Ward 28 Mar '19

28 Mar '19

Andrew- I noticed this too, it was like if the SFP was inserted, it’d still throw an error because the transceiver tx/rx limits were technically still out of spec. There needs to be logic to check for the interface status first, then disable the thresholds/alerts if down. I had just considered removing optics for ports that were shut, but kinda annoying for sure. Adam Ward Systems Engineer Shamrock Trading Corporation Office Phone/Fax: (913) 310-2247 Email: award(a)rtsfinancial.com<mailto:award@rtsfinancial.com> Website: www.shamrocktradingcorp.com<http://www.shamrocktradingcorp.com/> From: observium <observium-bounces(a)observium.org> on behalf of Andrew Lemin via observium <observium(a)observium.org> Reply-To: Observium <observium(a)observium.org> Date: Friday, March 22, 2019 at 10:46 AM To: Andrew Lemin via observium <observium(a)observium.org> Cc: Andrew Lemin <AndrewL(a)4d-dc.com> Subject: [Observium] Low dbm sensor alerts for shutdown interfaces Hi, Has anyone else seen the issue where after enabling an alert checker for transceiver optics with sensor_value greater @sensor_limit and sensor_value less @sensor_limit_low, alerts are still received for shutdown interfaces? For example, on a cisco switch when running ‘show interfaces transceiver detail’, we can see; Optical High Alarm High Warn Low Warn Low Alarm Receive Power Threshold Threshold Threshold Threshold Port (dBm) (dBm) (dBm) (dBm) (dBm) Te1/1/25 -40.0 1.9 -1.0 -9.9 -13.9 Te2/1/1 -40.0 1.9 -1.0 -9.9 -13.9 Etc.. Te1/1/25 admin down down Te2/1/1 admin down down Etc The sensors page shows the correct thresholds etc, but shows the interface in Red (and hence is generating alerts through the checker), rather than grey (as the port is shutdown and has no fibre connected – hence -40dbm.). [cid:image001.png@01D4E0C6.4F698990] The same port on the Ports page does show the interface as being grey/shutdown [cid:image002.png@01D4E0C6.4F698990] Have no idea how to resolve this and stop getting transceiver alerts for shutdown interfaces? This sounds like a potential bug? Thanks, Andy. This e-mail communication (including any attachments) is intended only for use by the individual or entity named above and is considered confidential. If you are not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you should immediately stop reading this message and delete it from your system. Any unauthorized reading, distribution, copying or other use of this communication (or its attachments) is strictly prohibited.

8 12

ThinClient Wyse detected as "Generic Device"
by Ing. Hugo Rodriguez 28 Mar '19

28 Mar '19

Hi Observium team, Please, I need your help with a issue Description Thinclients Wyse Model Tx0 units are being discovered as a generic device. Output from snmpwalk for the device is attached. Environment Observium CE 18.9.9420 (5th September 2018) OS Linux 4.9.0-8-amd64 [amd64] (Debian 9.6) Apache Apache PHP 7.0.33-0+deb9u3 (OPcache: ENABLED) Python 2.7.13 MySQL 10.1.37-MariaDB-0+deb9u1 (extension: mysqli 5.0.12-dev) SNMP NET-SNMP 5.7.3 RRDtool 1.6.0 Fping 3.15 (IPv4 and IPv6) Thanks Hugo

1 0

Observium Enterprise Multi Poller/Syslog Servers
by Ron Culler 26 Mar '19

26 Mar '19

I know you can set multiple pollers to query the devices but is it possible to also enable syslog on each poller as well? I would like to have multiple syslog servers for load and redundancy. Thanks Ron

3 3

Change device IP?
by Kaiser, Erich 26 Mar '19

26 Mar '19

What is the best way to go about changing the IP I am using to monitor the device without loosing all the graph data?

3 4