[Xymon] Help tracking down ghost client

[Tres Finocchiaro]

I've had incorrect IPs reported when there were invalid settings in DNS.
Possibly another place to look if your server is configured to use DNS.

- Tres.Finocchiaro at gmail.com

On Wed, Oct 15, 2014 at 5:13 PM, Root, Paul T <Paul.Root at centurylink.com>
wrote:

>  This generally means that the xymon server is still performing a test on
> this address.
>
>
>
> Do you have any ext scripts or maybe cron scripts that still are running
> to look at this machine.
>
>
>
> What I generally do is add the machine back into the hosts.cfg file so it
> will show up and tell me what test is the issue. Fix that and remove the
> host again.
>
>
>
> *From:* Xymon [mailto:xymon-bounces at xymon.com] *On Behalf Of *Robert
> Herron
> *Sent:* Wednesday, October 15, 2014 3:25 PM
> *To:* xymon
> *Subject:* [Xymon] Help tracking down ghost client
>
>
>
> Xymon 4.3.17 on Oracle Linux 6
>
> I have a ghost showing up on the my "Ghost Clients" report and I can't
> figure out what's is happening.  A quick search of the archive didn't turn
> up anything similar.
>
> On the Ghost Client report:
>
> Hostname              Sent from    Candidate            Report age
> mail07.example.com    10.10.1.2    xymon.example.com    0:32
>
>
> This "mail07" [g]hostname doesn't exist in my hosts.cfg.  It was removed
> when the host was decommissioned two months ago.
>
> The "sent from" address is my Xymon server.  The "report age" counts up to
> just over 3 minutes, resets to 0, and starts incrementing again.
>
> This [g]host was a net-only testing host -- CONN, SMTP, and HTTP. There
> are references to the [g]hostname in analysis.cfg and alerts.cfg but those
> shouldn't cause this.  The "mail07" string does occur in the
> ~/server/tmp/xymond.chk file but it seems to be ghost report.  The
> xymond.chk line ends in "nGhost reports:\n  10.10.1.2      reported host
> mail07.example.com\n|||0|0". No other file in ~/server/etc contains
> "mail07".
>
> I added "--debug" to the xymonnet's CMD line and to the
> ~/server/ext/xymonnet-again.sh but "mail07" doesn't show up in either log.
>
>
>
> Any thoughts on where to look next?
>
> Thanks.
>
>
>
> Robert Herron
> robert.herron at gmail.com
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20141015/24595df0/attachment.html>