[Xymon] Help tracking down ghost client

[Patrick Nixon]

Is there a new host on 10.10.1.2 that might be reporting into xymon?

On Wed, Oct 15, 2014 at 4:24 PM, Robert Herron <robert.herron at gmail.com>
wrote:

> Xymon 4.3.17 on Oracle Linux 6
>
> I have a ghost showing up on the my "Ghost Clients" report and I can't
> figure out what's is happening.  A quick search of the archive didn't turn
> up anything similar.
>
> On the Ghost Client report:
> Hostname              Sent from    Candidate            Report age
> mail07.example.com    10.10.1.2    xymon.example.com    0:32
>
> This "mail07" [g]hostname doesn't exist in my hosts.cfg.  It was removed
> when the host was decommissioned two months ago.
>
> The "sent from" address is my Xymon server.  The "report age" counts up to
> just over 3 minutes, resets to 0, and starts incrementing again.
>
> This [g]host was a net-only testing host -- CONN, SMTP, and HTTP. There
> are references to the [g]hostname in analysis.cfg and alerts.cfg but those
> shouldn't cause this.  The "mail07" string does occur in the
> ~/server/tmp/xymond.chk file but it seems to be ghost report.  The
> xymond.chk line ends in "nGhost reports:\n  10.10.1.2      reported host
> mail07.example.com\n|||0|0". No other file in ~/server/etc contains
> "mail07".
>
> I added "--debug" to the xymonnet's CMD line and to the
> ~/server/ext/xymonnet-again.sh but "mail07" doesn't show up in either log.
>
> Any thoughts on where to look next?
>
> Thanks.
>
>
> Robert Herron
> robert.herron at gmail.com
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20141015/9031f8c0/attachment.html>