- observium - lists.observium.org

Authentication via FreeIPA
by Zarko Dudic 10 Oct '16

10 Oct '16

Hi there I want to be good citizens and check first Archives but this link was not found. http://postman.memetic.org/pipermail/observium/ Anyway, I try configuring Observium (*Observium CE *0.16.1.7533) to authenticate via LDAP, it's FreeIPA server using 389 Directory Service for ldap service. Unfortunately I can't make it to login. 1) The config.php reads: $config['auth_ldap_version'] = 3; // v2 or v3 $config['auth_ldap_server'] = "ca-ldap01.x.com"; $config['auth_ldap_port'] = 389; $config['auth_ldap_starttls'] = OPTIONAL; $config['auth_ldap_prefix'] = "uid="; $config['auth_ldap_suffix'] = ",cn=users,cn=accounts,dc=us,dc=x,dc=com"; $config['auth_ldap_attr']['uid'] = "uid"; // LDAP attribute containing user login name $config['auth_ldap_attr']['uidNumber'] = "uidNumber"; // LDAP attribute containing numeric user ID $config['auth_ldap_attr']['dn'] = "dn"; // LDAP attribute containing user's DN $config['auth_ldap_attr']['gidNumber'] = "gidNumber"; // LDAP attribute containing group id number $config['auth_ldap_objectclass'] = "posixaccount"; // objectClass to filter out valid users, use * for all objects under ldap_suffix tree $config['auth_ldap_groupmemberattr'] = "memberUid"; 2) Wireshark on Observium system gives: 1 0.000000000 observium-ip -> ldap-ip TCP 74 42240 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2573095638 TSecr=0 WS=128 2 0.006589311 ldap-ip -> observium-ip TCP 74 ldap > 42240 [SYN, ACK] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 SACK_PERM=1 TSval=327213350 TSecr=2573095638 WS=128 3 0.006626711 observium-ip -> ldap-ip TCP 66 42240 > ldap [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=2573095644 TSecr=327213350 4 0.006747394 observium-ip -> ldap-ip LDAP 144 bindRequest(1) "uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" simple 5 0.013069430 ldap-ip -> observium-ip TCP 66 ldap > 42240 [ACK] Seq=1 Ack=79 Win=14592 Len=0 TSval=327213357 TSecr=2573095644 6 0.603341264 ldap-ip -> observium-ip LDAP 80 bindResponse(1) success 7 0.603369077 observium-ip -> ldap-ip TCP 66 42240 > ldap [ACK] Seq=79 Ack=15 Win=14720 Len=0 TSval=2573096241 TSecr=327213947 8 0.603652020 observium-ip -> ldap-ip LDAP 149 searchRequest(2) "cn=users,cn=accounts,dc=us,dc=x,dc=com" wholeSubtree 9 0.610210283 ldap-ip -> observium-ip TCP 66 ldap > 42240 [ACK] Seq=15 Ack=162 Win=14592 Len=0 TSval=327213954 TSecr=2573096241 10 0.614501121 ldap-ip -> observium-ip LDAP 3377 searchResEntry(2) "uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" | searchResDone(2) success 11 0.614533639 observium-ip -> ldap-ip TCP 66 42240 > ldap [ACK] Seq=162 Ack=3326 Win=21248 Len=0 TSval=2573096252 TSecr=327213958 12 0.615170867 observium-ip -> ldap-ip LDAP 144 bindRequest(3) "uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" simple 13 0.628537773 ldap-ip -> observium-ip LDAP 80 bindResponse(3) success 14 0.635412239 observium-ip -> ldap-ip LDAP 73 unbindRequest(4) 15 0.635506320 observium-ip -> ldap-ip TCP 66 42240 > ldap [FIN, ACK] Seq=247 Ack=3340 Win=21248 Len=0 TSval=2573096273 TSecr=327213973 16 0.642012247 ldap-ip -> observium-ip TCP 66 ldap > 42240 [FIN, ACK] Seq=3340 Ack=248 Win=14592 Len=0 TSval=327213986 TSecr=2573096273 17 0.642029914 observium-ip -> ldap-ip TCP 66 42240 > ldap [ACK] Seq=248 Ack=3341 Win=21248 Len=0 TSval=2573096280 TSecr=327213986 3) Ldap logs read: conn=348 fd=83 slot=83 connection from observium-ip to ldap-ip conn=348 op=0 BIND dn="uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" method=128 version=3 conn=348 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" conn=348 op=1 SRCH base="cn=users,cn=accounts,dc=us,dc=x,dc=com" scope=2 filter="(uid=zarko)" attrs=ALL conn=348 op=1 RESULT err=0 tag=101 nentries=1 etime=0 conn=348 op=2 BIND dn="uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" method=128 version=3 conn=348 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=zarko,cn=users,cn=accounts,dc=us,dc=x,dc=com" conn=348 op=3 UNBIND conn=348 op=3 fd=83 closed - U1 conn=67 op=22 SRCH base="ou=sessions,ou=Security Domain,o=ipaca" scope=2 filter="(objectClass=securityDomainSessionEntry)" attrs="cn" conn=67 op=22 RESULT err=0 tag=101 nentries=0 etime=0 conn=15 op=1354 SRCH base="ou=group,dc=ignore,dc=me" scope=1 filter="(&(objectClass=posixGroup)(gidNumber=1001))" attrs="cn gidNumber userPassword memberUid" conn=15 op=1354 RESULT err=32 tag=101 nentries=0 etime=0 conn=15 op=1355 SRCH base="cn=users,cn=accounts,dc=us,dc=x,dc=com" scope=1 filter="(&(objectClass=posixAccount)(uidNumber=1001))" attrs="cn uid uidNumber gidNumber gecos description homeDirectory loginShell" conn=15 op=1355 RESULT err=0 tag=101 nentries=0 etime=0 4) Thanks in advance for any suggestion or troubleshooting tips. -- Thanks, Zarko

3 9

Question about PDF | CSV Reports
by Francisco José Sánchez Iruela 10 Oct '16

10 Oct '16

Hi All, Anyone know if Could I get a report billing (.pdf or .csv) at the end of each month for each customer (Bill) ?? Best regards, -- Francisco José Sánchez IruelaDepartamento de redes <http://www.cartagon.com/> *Tel.* 902 998 398 – (+34) 91 020 11 32 - *Extensión 2105* *Fax.* 902 998 374 – (+34) 91 362 46 46 *E-mail.* fjsanchez(a)cartagon.com Calle Urano 50, 28760, Tres Cantos. Madrid *Web.* www.cartagon.com <https://www.linkedin.com/company/cartagon> <https://twitter.com/cartagon>

1 0

Discover new devices problem
by zois roupas 10 Oct '16

10 Oct '16

Hello everyone, Great Documentation and so far it's a great tool. One question though because i can't find a way to get auto discover new devices to work. Everything works great when adding the device ./add_device.php <ip> public v2c but when running ./discovery.php -h new , 0 devices discovered. I guess it's not a problem with the SNMP cause it wouldn't work with the manual ip addition, right? So the next step was to check the hosts file from the observium server. so this is the config 192.168.1.2 test-01.home.com #(machine to discover) The sysName variable from the machine that i want to discover is Linux test-01 3.10.0-327.36.1.el7.x86_64 #1 SMP Sun Sep 18 13:04:29 UTC 2016 x86_64 x86_64 The firewall is disabled in both machines Sorry for the trouble but what am i missing here? Thanks for the time Zois

1 0

syslog integration issue
by Grégory Lemblé 10 Oct '16

10 Oct '16

Morning, I try to implement the syslog.php features inside our Observium instance. on debug mode, we got syslog info inside the logs/debug.log file. But on the web side, impossible to get any message from the syslog. I'm not sure which area i need to investigate to get it done. Some help will be appreciate. Many Thanks ----------- Observium Version Pro 0.16.10.8118 (Stable) ----------- rsyslogd 7.4.4, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No uuid support: Yes ----------- /etc/rsyslog.d/60-observium.conf: #--------------------------------------------------------- #send remote logs to observium $template observium,"%fromhost%||%syslogfacility%||%syslogpriority%||% syslogseverity%||%syslogtag%||%$year%-%$month%-%$day% %timereported:8:25%||%msg%||%programname%\n" $ModLoad omprog $ActionOMProgBinary /var/www/observium/syslog.php :inputname, isequal, "imudp" :omprog:;observium #& ~ & stop #--------------------------------------------------------- ----------- debug.log file: [2016/10/10 08:00:15 +0800] syslog.php(19124): hostname||1||4||4||auth:||2016-10-10 08:00:14|| User XXXXXXXXXXXX logout||auth [2016/10/10 08:00:15 +0800] syslog.php(19124): hostname||1||6||6||Security:||2016-10-10 08:00:15|| SSH login by public key from src IP XXXXXXX from src MAC XXXXX to USER EXEC mode using DSA as Server Host Key. ||Security ----------- config.php: $config['syslog']['debug'] = True; $config['enable_syslog'] = 1; // Enable Syslog $config['syslog']['fifo'] = FALSE; ------------- Front Web: No syslog entries found!Check that the syslog daemon and Observium configuration options are set correctly, that your devices are configured to send syslog to Observium and that there are no firewalls blocking the messages. See documentation <http://www.observium.org/wiki/Category:Documentation> and configuration options <http://www.observium.org/wiki/Configuration_Options#Syslog_Settings> for more information

1 0

Re: [Observium] Auto discovery
by Mikey van der Worp 07 Oct '16

07 Oct '16

To whom it may concern, Currently we are having some issues with Observium's Auto Discovery. The problem is that it currently only discovers about 10% of the network. Does somebody have a clue on how to fix this issue? We already disabled the option "require valid hostnames" at the auto discovery settings. Unfortunately after changing this option, it only discovered about 10 more devices. Also we do not have any problems with the CDP neighbours on our switches. Best regards, Mikey van der Worp -- Mikey van der Worp System Engineer Utelisys Communications B.V. Trinity Buildings Tower A, 7th floor Pietersbergweg 15 1105BM Amsterdam M +31 (0) 62 942 2052 T +31 (0) 20 561 8010 F +31 (0) 20 561 8021 www.utelisys.com<http://www.utelisys.com> - https://www.utelisys.com/

3 2

Unable to save sensor values
by Robert Williams 07 Oct '16

07 Oct '16

Hi, On devices with large numbers of sensors it appears that I'm unable to set custom limits any more. I'm sure there used to be something about a maximum number of rows to be updated (a SQL setting?) but I can't remember or find any reference of it. The path to the page is: /device/device=XXX/tab=edit/section=sensors/ I don't get any errors when applying, but, as soon as the page refreshes the old settings are back. In fact, any change on the sensors page fails (setting custom values, disabling alerts, enabled custom limits etc.). It works fine on all devices with lower numbers of sensors. These ASR9k have well over 150 I reckon, maybe more, it's hard to count. Anyway, can someone remind me of the SQL tweak for this? Or is this a bug? Cheers! Robert Williams Custodian Data Centre Email: Robert(a)CustodianDC.com http://www.CustodianDC.com

2 2

Restrict alerts to HA active F5 only
by Daniel Horth 06 Oct '16

06 Oct '16

Hi all I have an alert checker set up to monitor our F5 BIG-IP devices, alerting administrators if they forget to syncronise config after making changes. My alert looks like this: Device Match: * Entity Match: status_type equals f5-config-sync-state Test conditions (Require all): status_name notequals inSync status_name notequals standalone This is working great, however to reduce spamminess of alerts I am looking to only send the alert for the primary (HA active) device; when an additional status_type / condition match is true, i.e.: Entity Match: status_type equals f5-ha-state Test conditions: status_name equals active Is it possible to have alert checkers trigger based upon groups of entity matches like this? Am I approaching this in the wrong way? Thanks Dan

1 0

Syslog Alerts
by Brad Bendy 05 Oct '16

05 Oct '16

Hi, First off, the last few revisions have been killer, it's getting better every few weeks it seems, thanks! Ive setup some syslog alerts and I see under "syslog alerts" it will show a entry and "notified" will be no, then it appears after a few minutes this changes to yes and send the notification. It looks like it does not send the message until it sees more then X number of messages, It's sent after I get this in the logs: 2016-10-04 20:53:13Error (3)LAST message repeated 10 times 2016-10-04 20:52:47Error (3)LAST message repeated 7 times 2016-10-04 20:52:33Error (3)XNTPD NTP Server Unreachable Is this documented somewhere and Im missing it? Just trying to see when the message gets fired off. We were using some janky omprog code to send alerts that were "instant" but rather have Observium send them as it's much cleaner all around, but some alerts we want to get on the very first message and right away as they are critical. I noticed the syslog rules severity of a 8, im guessing eventually that will control how "sensitive" the alerts go out maybe? Thanks

1 0

CBQoS Issue & Temperature
by Talk Jesus 05 Oct '16

05 Oct '16

Hello First thing, does the attach show anything I need to be concerned about? The warnings, although 6 days ago I'm not understanding where they came from. These are new switches, all 3 fans installed and green lights. Airflow sufficient and cooled. Secondly, I have 3 ports showing a CBQoS error. I checked and see it's due to packet loss because of rate limiting policy set previously. Running Cisco 3650. I've removed the policies from each of the port's VLANs assigned over an hour ago and Observium is still showing as the policies in place? It polled ample times on all ports but not quite sure why it's still showing the policies and errors? I did notice at least that it showed no packet loss once I removed the policies, but the error bubble is still there and it still shows the policy name when viewing the CBQoS page for the ports. >From the Switch Switch2#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch2(config)#int gi2/0/14 Switch2(config-if)#no service-policy output speed25 % policy map speed25 not configured Switch2#sh platform qos policies port Policy: None in the list Switch2#show run interface gi2/0/14 Building configuration... Current configuration : 113 bytes ! interface GigabitEthernet2/0/14 description Server 19 switchport access vlan 19 switchport mode access end

1 0

alerts
by Célia LAMY 04 Oct '16

04 Oct '16

Hello, I created three alerts for all of my servers. I'm not getting the alerts both servers. For others it works. How to do ? I use Observium CE 0.16.1.7533. Cordialement -- Célia LAMY Service Informatique ACTES SUD Place Nina Berberova, 13200 Arles Tél : 04 88 65 90 25

5 6