<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">What this means is that you have 2 or more machines reporting to the xymon server on the status of the particular host/test combination.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Looking at the first one:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:memUse reported by XXX.ZZZ.163.127 and XXX.ZZZ.120.197<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="color:#1F497D"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><span style="color:#1F497D">This says that xxx.zzz.163.127 and xxx.zzz.120.197 are reporting to your server the status of memUse on pwau801.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Do you have proxys? Is this a custom script that runs on a host or two and probes multiple machines?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">If you are using a proxy and the client is sending directly to the xymon server and to the proxy which is also sending to the xymon server, you will get this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>Mills,David (HHSC Contractor)<br>
<b>Sent:</b> Monday, December 01, 2014 4:03 PM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> [Xymon] Cause of listing for "Multi-source statuses" in "xymond" col?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our Xymon server (4.3.3) is getting swamped and we’re trying to figure out where the pain is coming from. One thing we’ve observed is in the “xymond” page for the Xymon server itself, there is a *very* long listing of hosts/tests under
the section titled “Multi-source statuses”. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Could someone tell me exactly what this section reports and what would be likely causes for entries in this section. Does inclusion in this listing imply duplicate status data is being sent to the Xymon server from these clients?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The large majority of entries cite both the host in question and a corresponding “vlan” we’ve set up (i.e. an alternate network route using an alternate interface) on these multi-homed clients. If I’m understanding these tests as reporting
statuses over both routes, to the server, don’t see that could be possible… ??<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Example of what we’re seeing:<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Multi-source statuses<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:memUse reported by XXX.ZZZ.163.127 and XXX.ZZZ.120.197<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:msgs reported by XXX.ZZZ.163.127 and XXX.ZZZ.120.197<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:ports reported by XXX.ZZZ.163.127 and XXX.ZZZ.120.197<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:procs reported by XXX.ZZZ.163.127 and XXX.ZZZ.120.197<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> pwau801:sar reported by XXX.ZZZ.120.197 and XXX.ZZZ.163.127<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:cpu reported by XXX.ZZZ.120.114 and XXX.ZZZ.160.36<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:disk reported by XXX.ZZZ.120.114 and XXX.ZZZ.160.36<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:files reported by XXX.ZZZ.120.114 and XXX.ZZZ.160.36<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:iostat reported by XXX.ZZZ.160.36 and XXX.ZZZ.120.114<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:memory reported by XXX.ZZZ.120.114 and XXX.ZZZ.160.36<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:memUse reported by XXX.ZZZ.163.76 and XXX.ZZZ.120.114<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> twau016:meta reported by XXX.ZZZ.163.76 and XXX.ZZZ.160.36<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> ...<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~*~<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Times New Roman","serif"">David Mills<br>
Systems Administrator</span><br>
<b><i><span style="font-family:"Times New Roman","serif";color:#1F33ED">Northrop Grumman</span></i></b><span style="font-family:"Times New Roman","serif""><br>
(512) 873-6665<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<center>This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately
notify the sender by reply e-mail and destroy all copies of the communication and any attachments.</center>
</body>
</html>