On 4 December 2014 at 21:24, Juergen Fischer <user-c6a426ede1b2@xymon.invalid> wrote:
Here in the 1st line you see "red ]hu ...". I reckon that this line was
generated at the Xymon server and not at the client, because it contains
the server side (central mode) interpretation of the client data.
That's a reasonable assumption. Does the "client" data for [disk] show the
corruption also?
Another option is to use xymond_channel to match and show the client data
for corrupt entries. Something like this (run as the xymon user):
xymond_channel --channel=client --filter='client' sed -n '/^\[df\]/,/^\[/p'
You can leave this running for as long as you need, until a corrupt message
comes through on your console, and then check the output here to see if it
was also corrupted. If this shows no corruption, then the message arrived
at xymond without interference, and must have been corrupted by
xymond_client.
If this shows corruption, it means that it's either xymond or before (ie
BBWin). In this case, you might need to do a long-term packet capture to
whether it was corrupt on the wire. Or you can run xymond with the
"--dbghost=HOSTNAME" option to get a copy of all communications into
/tmp/xymond.dbg.
J