Subject: Custom Notifies

From: Sagi Brody <[email-masked]>
Date: Tue, 15 Jul 2008 15:49:05 -0400 (EDT)

Hello,
	I currently use Argus to monitor a few critical services on my
network. The unack'd page is pretty important, and is often open on at
least one of my PC's at all times.

In addition to monitoring services FROM argus, I'd like to have some of
them notify argus when it sees a problem. There will probably be 3-4
different type of notifications a server would alert argus about.
However, I'll probably be using 1 generic "service Prog{.." type service
to execute a script to contact the server to check if sees anything is
down. I'd like the unack page to actually display details obtained from
the program. How can I do this?

I have tried to manually edit the msg: line in the actual notify file but
that seemed to have no affect.

Thanks,

----------------------------------------
Sagi Brody
Webair Internet Development, Inc.
Phone: 1 866 WEBAIR 1
Fax: 516.938.5100
http://www.webair.com
[email-masked]
AIM: webairsagi
ICQ: 146240554
----------------------------------------
We are interested in any feedback you might have about the service
you received. Please contact our technical support consumer care manager
directly 1.866.WEBAIR1 or e-mail [email-masked]
----------------------------------------

---

From: Jeremy Kister <[email-masked]>
Date: Fri, 18 Jul 2008 13:25:03 -0400

> the program. How can I do this?

not tested:

### on server being monitored:
echo "anotify	6969/tcp # for argus notifications" >> /etc/services
echo "anotify stream tcp nowait nobody /usr/bin/cat /usr/bin/cat 
/tmp/notify.argus" >> /etc/inetd.conf
kill -HUP `ps -ef | awk '/inetd/ { print $2 }'

### in argus config:
    Service TCP {
     hostname: remote_server_name_or_ip_address
     label: local_notifies
     port:  6969
     uname: local_notifies
     nexpect: ALARM:
     pluck:   ALARM:(.+)
     messagedn: %o{ip::hostname} says: [%v]
    }

argusctl hup

# after argus has reloaded, on the client machine, do something like

echo "ALARM: my head hurts" >> /tmp/notify.argus

# this should make argus send you a page that looks like
10000 1/Jul 00:00 - machine says: [my head hurts]

# and a few minutes later

rm /tmp/notify.argus

-- 

Jeremy Kister
http://jeremy.kister.net./

---

From: Sagi Brody <[email-masked]>
Date: Fri, 25 Jul 2008 10:59:12 -0400 (EDT)

Jeremy,
	Great suggestion, I've used this system and its working
perfectly!

Another question - Can I use any of the argus CLI tools to validate a
service?

I have an interface that allows me to add/remove/modify service
definitions, which then builds the argus config file. Instead of having to
reload argus to verify all the services are defined/working properly, is
there anyway I can pass a config snippet to argus and see if it detects
the service is up/down?

Thanks,

On Fri, 18 Jul 2008, Jeremy Kister wrote:

> _______________________________________________
> http://argus.tcp4me.com/
> [email-masked]
> http://www.tcp4me.com/mailman/listinfo/arguslist
>