Frequently Asked Questions About mon

$Id: new-faq.m4,v 1.1 2003/06/02 15:33:49 trockij Exp $ This is the FAQ (Frequently Asked Questions) for the "mon" service monitoring package. It contains both general and technical information about mon.

Section 1 - Overview

1.1 What is mon, and what is it supposed to do?

Section 2 - Where to get information

2.1 Where can I get everything that I need for "mon"?

Section 3 - How to piss off

Section 1 - Overview

1.1 What is mon, and what is it supposed to do?

It is a program.

1.2 Does "mon" require SATAN to run?

No, it does not. SATAN includes the "fping" and "tcp_scan" utilities, which the fping, tcp, and telnet monitors used to use. The dependencies on these SATAN modules have since been removed. fping is available as a separate package from mon, and can be found on kernel.org.

Section 2 - Where to get information

2.1 Where can I get everything that I need for "mon"?

Perl and Perl modules are available from your nearest CPAN archive.
"fping" is available from kernel.org.
The UCD SNMP library is available from ftp://ucd-snmp.ucdavis.edu/ .

2.2 Is there a monitor for (insert service here)?

Quite possibly. Check the mailing list archives, or the contrib area.

1.4 When I compile fping-2.2b1 under Linux, I get these errors:

fping.c:216: conflicting types for sys_errlist
/usr/include/stdio.h:221: previous declaration of sys_errlist
make: *** [fping.o] Error 1

Comment out line 221 in fping.c, since it's a re-declaration of an extern in stdio.h.

1.5When I run "mon" on Solaris, the daemon appears to start, but clients hang.

Chances are mon hasn't started at all, and the clients are connecting to something running on the old mon port of 32777. Check /usr/adm/messages for a message from mon which says "Could not bind TCP server port".

"mon" has been assigned a port of 2583 by the IANA. If you're running an older version of mon (0.37), then you should change the default port from 32777 to 2583 by editing the code in the server (change "$SERVPORT = 32777" to "$SERVPORT = 2583") and the clients.

1.6 How do I get satan-1.1.1 to work under Linux?

You need to apply the patches available from ftp://sunsite.unc.edu/pub/Linux/system/network/admin in order for satan to build and work properly. This is really worth doing, because fping is a huge win when you have a group that contains a large number of hosts.

1.6 Where can I get QuickPage?

QuickPage is freely available from www.qpage.org .

1.8 Is mon Y2K compliant? How about Time::Period?

All times are stored as time(2) values, which causes no problems with year 2000. All time calculations are done using these values (it would be much trouble to do them otherwise).

Time::Period uses the same mechanism.

For more information, see Year 2000 Compliance: Lawyers, Liars, and Perl

1.9 When I run mon on RedHat 5.x, I get lots of syntax errors.

The *.ph files generated by h2ph under RedHat 5.x (for Intel, at least) are broken. They have been fixed by Alan Robertson (alanr@bell-labs.com), and are included in his RPM of mon. This RPM is available from the main distribution site on ftp.kernel.org.

1.10 When I run 'mon' on Linux/Redhat 5.0 it complains about "setlogsock"

Redhat 5.0 comes with perl-5.004-1. The 'setlogsock' system call was added in perl-5.004-3. To solve this get perl-5.004-6.i386.rpm from the Redhat 5.1 distribution and upgrade with the command "rpm -Uh perl-5.004-6.i386.rpm".

1.11 How do I send an alert only after a service has been down for more than n minutes?

The "alertafter" parameter in a period definition can do (something like) this. For example:

watch newkernel
	service telnet
	    interval 8m
	    monitor telnet.monitor
	    period wd {Sun-Sat}
		alert mail.alert mis
		alertafter 3 30m
		alertevery 2h

This effectively means, "alert after 3 or more failures that happen within 30 minutes."

In the case of pinging a host, here's a neat hack:

watch hostgroup
	service fping
	    interval 6m
	    monitor fping.monitor -r 4 -t 60000
	    period wd {Sun-Sat}
		alert mail.alert mis
		alertevery 1h

This makes fping return a failure for a host that doesn't answer in 4 pings, with 60 seconds between each ping.

1.12 Can I include hostgroups inside of hostgroups?

On Mon, 12 Jan 1998, Thomas Mike Michlmayr (mike@cosy.sbg.ac.at) wrote:

> hi!
>
> i'm trying to setup mon here at our department, and one of the features i'm
> either missing or overlooking is the possibility to include hostgroups in
> a hostgroup.
> 
> is this deliberatly, or just something noone thought of?

This is deliberate. I've thought about it a good bit and I decided to not implement it in the mon config parser because it didn't make too much sense to me. The only function that sub-hostgroups would serve is essentially for clarity in the configuration file.

To do what you want, it would be trivial to make an m4-based configuration, in which you define your hostgroups like this:

define(`HOSTGROUP1',`host1 host2 host3')dnl
define(`HOSTGROUP2',`host4 host5 host6')dnl
hostgroup real_hostgroup HOSTGROUP1 HOSTGROUP2

and just do "m4 mon.cf.m4 > mon.cf" and you will end up with this:

hostgroup real_hostgroup host1 host2 host3 host4 host5 host6

trockij@linux.kernel.org