<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">This generally means that the xymon server is still performing a test on this address.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Do you have any ext scripts or maybe cron scripts that still are running to look at this machine.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">What I generally do is add the machine back into the hosts.cfg file so it will show up and tell me what test is the issue. Fix that and remove the host again.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>Robert Herron<br>
<b>Sent:</b> Wednesday, October 15, 2014 3:25 PM<br>
<b>To:</b> xymon<br>
<b>Subject:</b> [Xymon] Help tracking down ghost client<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Xymon 4.3.17 on Oracle Linux 6<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I have a ghost showing up on the my "Ghost Clients" report and I can't figure out what's is happening. A quick search of the archive didn't turn up anything similar.<o:p></o:p></p>
</div>
<p class="MsoNormal">On the Ghost Client report:<o:p></o:p></p>
<div style="margin-left:30.0pt">
<p class="MsoNormal"><span style="font-family:"Courier New"">Hostname Sent from Candidate Report age<br>
<a href="http://mail07.example.com">mail07.example.com</a> 10.10.1.2 <a href="http://xymon.example.com">
xymon.example.com</a> 0:32</span><o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
This "mail07" [g]hostname doesn't exist in my hosts.cfg. It was removed when the host was decommissioned two months ago.<br>
<br>
The "sent from" address is my Xymon server. The "report age" counts up to just over 3 minutes, resets to 0, and starts incrementing again.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">This [g]host was a net-only testing host -- CONN, SMTP, and HTTP. There are references to the [g]hostname in analysis.cfg and alerts.cfg but those shouldn't cause this. The "mail07" string does occur in the
~/server/tmp/xymond.chk file but it seems to be ghost report. The xymond.chk line ends in "nGhost reports:\n 10.10.1.2 reported host
<a href="http://mail07.example.com">mail07.example.com</a>\n|||0|0". No other file in ~/server/etc contains "mail07".<o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">I added "--debug" to the xymonnet's CMD line and to the ~/server/ext/xymonnet-again.sh but "mail07" doesn't show up in either log.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Any thoughts on where to look next?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
Robert Herron<br>
<a href="mailto:robert.herron@gmail.com" target="_blank">robert.herron@gmail.com</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>