[Xymon] Can't clear ghost clients

[Root, Paul T]

Then you live with ghosts, or you firewall around them.

The best solution is obviously to try to get people to uninstall them. Or at least turn them off in services.

From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Steve B
Sent: Wednesday, March 12, 2014 6:45 AM
To: Adam Goryachev
Cc: Xymon at xymon.com
Subject: Re: [Xymon] Can't clear ghost clients

What if we are receiving ghost reports from a server we no longer have access to? I have about ten servers that have been taken out of my access list that still have a BBWIN installation reporting to my central Xymon server.  I know where they are coming from but I cannot stop the information coming from the host (in theory I could but then I have to ask some people across the world to go and uninstall something from their machines and this always takes a long time and it not always respected).
regards
Steve

On Wed, Mar 12, 2014 at 5:56 AM, Adam Goryachev <mailinglists at websitemanagers.com.au<mailto:mailinglists at websitemanagers.com.au>> wrote:
On 12/03/14 15:04, Kris Springer wrote:
I've got 6 ghost clients listed on my server webpage.  I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list.  The ghost names are from many months ago when I first setup the server.  I've since change the names.  I've attempted to clear the ghosts using the following commands but it doesn't clear anything.  Buzzard is one of the hostnames in question.
#cd /usr/lib/xymon/server/bin
#xymon 127.0.0.1 "drop Buzzard"

Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it?

ghosts are there *because* you do not have them in your config file. They are "generated" by clients reporting status with that name. You should be able to determine where these reports are coming from based on the names and/or source information on the ghost report. If the client stops reporting, it will be removed from the ghost report after 5 minutes (I assume this is actually the timeout value of the status which is usually 5 minutes).

Worst case, you can firewall port 1984 to block the incoming status reports, or use tcpdump to determine where they are coming from.

Hope this is useful/helpful.

Regards,
Adam
--
Adam Goryachev Website Managers www.websitemanagers.com.au<http://www.websitemanagers.com.au>

_______________________________________________
Xymon mailing list
Xymon at xymon.com<mailto:Xymon at xymon.com>
http://lists.xymon.com/mailman/listinfo/xymon

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20140312/42bfa293/attachment.html>