- observium - lists.observium.org

Observium LDAP Integration
by Valerie Lim 26 Apr '22

26 Apr '22

Hi I am currently using professional v22.4.11952 for Observium. I am unable to authenticate my Observium via my LDAP server (Windows Server 2019). When 'ldap' is applied, authentication doesn't work. php module required for Observium has already been installed. Below is my config.php configuration: // Authentication Model $config['auth_mechanism'] = "ldap"; // default, other options: ldap, http-auth, please s> $config['auth_ldap_binddn'] = "cn=Administrator,cn=Users,dc=domain01,dc=com"; $config['auth_ldap_bindpw'] = "xxxxxxx"; $config['auth_ldap_attr']['uid'] = "sAMAccountName"; $config['auth_ldap_attr']['uidNumber'] = "objectSid"; $config['auth_ldap_attr']['cn'] = "name"; $config['auth_ldap_objectclass'] = "user"; $config['auth_ldap_version'] = 3; $config['auth_ldap_server'] = "server01.domain01.com"; $config['auth_ldap_port'] = 389; $config['auth_ldap_starttls'] = FALSE; $config['auth_ldap_prefix'] = "cn="; $config['auth_ldap_suffix'] = ",ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_group'] = array("cn=grouping,ou=acclivis,DC=domain01,DC=com"); $config['auth_ldap_groupbase'] = "cn=grouping,ou=acclivis,DC=domain01,DC=com"; $config['auth_ldap_groupmembertype'] = "nondn"; $config['auth_ldap_groupmemberattr'] = "member"; unset($config['auth_ldap_groups']); $config['auth_ldap_groups']['test']['level'] = 10; Is there something I missing out on my LDAP configuration? Please advise. Thanks Best Regards Valerie Lim

2 1

Cloud networks monitoring option in Observium
by Jan Horacek 26 Apr '22

26 Apr '22

Good morning guys, I want to ask you if there is any development thread which will introduce cloud services monitoring into observium. I don`t mean the classic monitoring way of vhost via SNMP, but over API calls directly from the cloud tools. We are currently transferring our network capabilities from the standard setup to CloudWan and looking for the monitoring options and our vision is to concentrate monitoring features in observium dashboards. I appreciate any hints or tips. Thanks

1 0

Aborted connection xxxxxx to db
by Ross [Eve IT] 21 Apr '22

21 Apr '22

Hello peoples, Hope you are all well! I know this is not specifically an observium issue, but was hoping someone could shed some light on the problem if they have also experienced it. This is on a new build, fresh install; Debian 11 using the automated observium script; Every time the cron job triggers, every 5 minutes, I get this warning. bservium' host: 'localhost' (Got an error reading communication packets) Apr 21 09:35:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 9:35:01 15776 [Warning] Aborted connection 15776 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 09:40:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 9:40:01 15880 [Warning] Aborted connection 15880 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 09:45:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 9:45:01 15985 [Warning] Aborted connection 15985 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 09:50:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 9:50:01 16090 [Warning] Aborted connection 16090 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 09:55:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 9:55:01 16194 [Warning] Aborted connection 16194 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 10:00:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 10:00:01 16300 [Warning] Aborted connection 16300 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 10:05:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 10:05:01 16404 [Warning] Aborted connection 16404 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) Apr 21 10:10:01 SoMuchForSubtlety mariadbd[13023]: 2022-04-21 10:10:01 16509 [Warning] Aborted connection 16509 to db: 'observium' user: 'observium' host: 'localhost' (Got an error reading communication packets) It doesn't seem to be affecting the application, Observium is graphing and monitoring just fine. Has anyone solved this issue? Kind regards, Ross.

2 1

relative times/dates
by David Milton 20 Apr '22

20 Apr '22

Hello, When trying to document events it’s more useful (at least to me) to see that something happened at 01:55 than it is to see it happened 9:23 hours ago. That doesn’t mean it’s not useful to know how long ago an event happened but it seems recently, knowing when the event happened is more important that knowing how long ago that was. Is there any way to disable temporarily or permanently the “relative” times in the event log and syslog? Thanks, Dave.

2 1

how does "ignore until" under device/alert settings work?...looking for a "in maintenance" mode for a device
by Tony Guadagno 20 Apr '22

20 Apr '22

Sorry if this is an obvious question but I have been playing with this and it does not behave the way I am expecting... under device properties/alerts there is an "ignore until" option as well as a "disable notifications" toggle.... [cid:image003.jpg@01D8530A.33555B80] If I set the "ignore until" to sometime in the future and I (for example) restart the device...I still get alerted. If I toggle the "disable notifications" , I do not get the notifications anymore...however, it stays disabled past the "ignore until" time How is this feature supposed to work? I am looking for a way to put a device in "maintenance mode" so that if I am upgrading etc...no alerts are generated and no notifications are sent.

5 11

add-on?
by McGranahan, Jamen (VU) 18 Apr '22

18 Apr '22

Is there an add-on or a separate module that will provide the DNS entries for each server? We have various servers running multiple websites and it would help us if we had one interface that contained this data along with everything else that Observium provides. Jamen McGranahan Associate Director of Library Technology & Digital Services Jean and Alexander Heard Libraries, Vanderbilt University 615-343-1614 | jamen.mcgranahan(a)vanderbilt.edu<mailto:jamen.mcgranahan@vanderbilt.edu> he/his/him [cid:image001.png@01D8531B.9A603B90]

1 0

Observium running in Ubuntu Server / How to ensure data at REST encrypted with AES256 / data encryption at rest
by Ryan Tee 18 Apr '22

18 Apr '22

Hi , Subject - Data encryption at REST ( AES256 ) How to verify and ensure data at REST encrypted with AES256 Observium running in Ubuntu Server. When at rest, data can be subject to malicious threats such as data theft or data corruption by obtaining physical access to the storage hardware. Do share us information if any comments for this. Thank you Regards Ryan **************************************** There are three states for digital data: data in use, data in transit and data at rest. * Data in use refers to active data stored in non-persistent volumes, typically RAM or CPU caches. * Data in transit is the state where data is transferred over a network, either private or public. * Data at rest means inactive data that is stored physically on persistent storage, i.e. disks, databases, data warehouses, mobile devices, archives, etc.

2 2

Observium @ Ubuntu - - TLS v1.2 and TLS v1.3 is for communications between webservers and database servers ( different systems and machines )
by Ryan Tee 14 Apr '22

14 Apr '22

Hi We are concerned security between Observium that running in Ubuntu systems ( 18.04 and 20.04 ) How to check and confirm TLS v1.2 or above had been configured as default , for communications between webservers and database servers ( different systems and machines ) Do share us information if any comments. Thank you. Regards Ryan

1 0

Re: [Observium] ping only device monitoring
by adama＠observium.org 13 Apr '22

13 Apr '22

No one else is reading because at some point I accidentally replied directly instead of to the list 😊 But I did now! Adam. From: Tony Guadagno <tonyg(a)guadagno.org> Sent: 13 April 2022 17:54 To: adama(a)observium.org Subject: RE: [Observium] ping only device monitoring Adam, I separate list that is independent would be good also…I hope others reading this will voice their support!!!!!!!!!!!!!!!!! Thanks From: adama(a)observium.org <mailto:adama@observium.org> <adama(a)observium.org <mailto:adama@observium.org> > Sent: Wednesday, April 13, 2022 12:52 PM To: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Subject: RE: [Observium] ping only device monitoring This is why we recommend the probe is attached to the Observium server’s own device entry in Observium. The ping-only host thing isn’t feasible in the existing devices paradigm, it would break the UI and a lot of other expectations about devices. Observium is 95% “showing data we got from SNMP”. The thing we’d likely create is a separate list of devices that didn’t support SNMP and didn’t actually interact with anything that currently exists in Observium, except probes, so we’d need a bunch of exceptions to the probe code to handle things with a device record and things without in the probes code. No one seems to ask much about it once we show them how to do the probes workaround, so we don’t look at it much. Adam. From: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Sent: 13 April 2022 17:22 To: adama(a)observium.org <mailto:adama@observium.org> Subject: RE: [Observium] ping only device monitoring Adam, I was able to get this all working, thanks for your help. Please excuse me if I am preaching to the choir but I do have some feedback. I want to start out by saying that I would love it if all devices supported SNMP, that would be ideal, but reality is that there are devices that will never have SNMP agents on them. In this particular case, it’s a banks ATM’s. For security reasons, SNMP will never be a feature for these devices. There are other examples as well, for instance, I also want to my ISP’s router so I can tell when I go down, are they down as well. So, ping only devices are abundant and persistent, they will not be going away. Setting up a probe will get me by, but there are several problems. The first is it seems you need to associate the probe with an existing host...so it looks like the probe is for that host (even though it is not). What happens if I delete the host...will the probes go away? Also, I have not yet seen a notification, but does the notification show the hosts name associated with the probe? If so, that will be confusing to techs who might not be aware they have to read further. What is really needed is the ability to add a device that is ping only and stand alone, not dependent on any other host. Obviously, all the info for that device would be unavailable except ping times but this would be much clearer. I think, given how important ping only devices can be, it should be a priority to get this right. Finally, let me say that I have worked in the past with MRTG and HP Openview and more recently with NagiosXI, PRTG and Shinken. Observium is BY FAR, the best of them. A ping only host is one of the few things that they all can do, but you cannot. Thanks for listening, if you want, I would be happy to put in a feature request. From: adama(a)observium.org <mailto:adama@observium.org> <adama(a)observium.org <mailto:adama@observium.org> > Sent: Wednesday, April 13, 2022 11:19 AM To: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Subject: RE: [Observium] ping only device monitoring Same way you alert on everything else, it’s just another entity type, similar to status with ok/alert status https://docs.observium.org/entities/#probes Adam. From: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Sent: 13 April 2022 16:17 To: adama(a)observium.org <mailto:adama@observium.org> Subject: RE: [Observium] ping only device monitoring Oh, so you just pick a host in the pulldown, but that gets ignored when you use -H? ok. is there a way to alert on a probe? From: adama(a)observium.org <mailto:adama@observium.org> <adama(a)observium.org <mailto:adama@observium.org> > Sent: Wednesday, April 13, 2022 11:12 AM To: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Subject: RE: [Observium] ping only device monitoring You just override the default arguments on the probe, the documentation should explain that. Host is *almost* always -H Adam. From: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Sent: 13 April 2022 15:48 To: Observium <observium(a)observium.org <mailto:observium@observium.org> > Cc: adama(a)observium.org <mailto:adama@observium.org> Subject: RE: [Observium] ping only device monitoring Adam, I have been looking at probes, but the thing I don’t understand is how to add a probe when the device is not listed in Observium. I tried to overwrite the pulldown, but it does not allow that. Is there a way to add a device to the list? From: observium <observium-bounces(a)observium.org <mailto:observium-bounces@observium.org> > On Behalf Of adama--- via observium Sent: Wednesday, April 13, 2022 10:44 AM To: 'Observium' <observium(a)observium.org <mailto:observium@observium.org> > Cc: adama(a)observium.org <mailto:adama@observium.org> Subject: Re: [Observium] ping only device monitoring This is mentioned in the probes documentation. Just create ICMP probes on the Observium-server entry (or the closest partitioned poller) We might do something specific at some point, but it’ll basically just be the same thing but with the probes separated into a different list. Adam. From: observium <observium-bounces(a)observium.org <mailto:observium-bounces@observium.org> > On Behalf Of Tony Guadagno via observium Sent: 13 April 2022 15:41 To: Observium <observium(a)observium.org <mailto:observium@observium.org> > Cc: Tony Guadagno <tonyg(a)guadagno.org <mailto:tonyg@guadagno.org> > Subject: [Observium] ping only device monitoring Hi, I know this has been asked and answered before, but I cannot find anywhere to search old threads, so I need to ask again…. How do I configure Observium to monitor a device with ping but no SNMP ability? Thanks Tony

4 3

wmi issues, need a syntax change
by Tony Guadagno 13 Apr '22

13 Apr '22

Hi, I am guessing that wmi polling is not used very much but I do use it and find it handy. If you do use it, you are probably aware that your event logs are filling up with this error: The server-side authentication level policy does not allow the user domain\wmiuser SID (S-1-5-21-99999-3660327915-2769000259-31856) from address 1.1.1.1 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application. I am getting 4 eventlog errors every polling interval (5 minutes) on every windows server. This is due to Microsoft enhancing security on wmi. (KB5004442-Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414) (microsoft.com)<https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-wind…>) There is a solution to this, you need to call wmi with pkt integrity enabled (wmic RPC_C_AUTHN_LEVEL_PKT_INTEGRITY support · Issue #41 · greenbone/openvas-smb (github.com)<https://github.com/greenbone/openvas-smb/issues/41>). So, for example wmic --user=domain.local\\user --password= //server.domain.local "select * from Win32_ComputerSystem" - throws the error in the target servers event log...also, this will start failing next year. However wmic --user=domain.local\\user --password= //ncacn_ip_tcp:server.domain.local[sign] "select * from Win32_ComputerSystem" will not throw the error wrapping the target server in ncacn_ip_tcp: and [sign] fixes the issue. So, would it be possible for you to enhance Observium to make the wmi calls this way? Thanks Tony

5 8