[Xymon] Frequent purple alerts

[Timothy Williams]

I don't know about the DNS switching around, unless it is due to some DC
synchronizing stuff, and one has a manual entry the other doesn't? Two ways
to circumvent that is to use the IP in the Xymon Settings file <servers>
tag ( I think that is what you said you did), or add the internal IP to the
server HOSTS file; both of which requires future editing if the IP of the
hostname gets changed.

I should have mentioned that I use the tag
<clientlogretain>4</clientlogretain>  in my xymonclient_config.xml file to
save multiple versions of the logs to give me some time to look at them and
track changes from one file to another when I make a change.

Glad you are able to get it stable.

Tim Williams
VCU Computer Center


On Wed, Jul 31, 2019 at 4:33 PM Jaime Kikpole <jkikpole at cairodurham.org>
wrote:

> Sorry to resurrect this old thread, but I finally was able to grab the
> logs from the Xymon client during a purple alert.  Usually, it would go
> back to green before I would notice, could switch gears, and began working
> on it.
>
> Thanks, Timoth Williams, for pointing out the file uploading parts of the
> logs.  Based on that, I found these lines in the xymonclient.log file:
> 2019-07-31 15:25:38  Connecting to host 163.153.163.90
> 2019-07-31 15:25:59  ERROR: Cannot connect to host
> monitor1.cairodurham.org (163.153.163.90) :
> System.Management.Automation.MethodInvocationException: Exception calling
> "Connect" with "2" argument(s): "A connection attempt failed because the
> connected party did not properly respond after a period of time, or
> established connection failed because connected host has failed to respond
> 163.153.163.90:1984" ---> System.Net.Sockets.SocketException: A
> connection attempt failed because the connected party did not properly
> respond after a period of time, or established connection failed because
> connected host has failed to respond 163.153.163.90:1984
>
> It looks like it was somehow resolving the FQDN (monitor1.cairodurham.org)
> to its external IP address instead of its internal IP address.  I'm not
> sure why.  I just checked the DNS settings and they're the same as another
> Windows 2012R2 server that isn't having this issue.
>
> I changed the FQDN to the internal IP address and restarted the service.
> Everything went green almost immediately.
>
> Any idea how it could resolve to the public IP address 2 - 4 each day but
> only for a few hours total each day?
>
>
>
>
> Jaime Kikpole
>
> Director of Technology & Innovations
> Cairo-Durham Central School District
> (518) 622-8543, x59500
> cairodurham.org <http://www.cairodurham.org>
>
> Technical Support:
> help at cairodurham.org
> go.cairodurham.org/techtips
>
> [image: Google Certified Educator, Level 1][image: Google Certified
> Educator, Level 2] <https://www.credential.net/d24m9rrp>
>
>
> This electronic message and any attachment(s) may contain confidential or
> legally privileged information protected by law from further disclosure and
> is intended only for the individual or entity identified above as the
> addressee. If you are not the addressee (or the employee or agency
> responsible to deliver it to the addressee), or if this message has been
> addressed to you in error, you are hereby notified that you may not copy,
> forward, disclose or use any part of this message or any attachment(s).
> Please notify the sender immediately by return email or telephone and
> permanently delete this message and attachment(s) from your system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20190801/4d909841/attachment.htm>