Decommissioned systems showing in ghosts
list Colin Coe
Hi all I decommissioned (i.e. physically removed) a bunch of Cisco switches some time ago but I see that they are still showing in the ghost report. I've checked hosts.cfg and devmon's hosts db but can't find them. Any ideas on how to track down why they're still showing up? Thanks
list Adam Thorn
On 03/01/2023 03:08, Colin Coe wrote:
Hi all I decommissioned (i.e. physically removed) a bunch of Cisco switches some time?ago but I see that they are still showing in the ghost report. I've checked hosts.cfg and devmon's hosts db but can't find them.
The ghost report tells you which IP sent the message to xymon, so you should check there.
If you want to see the full message sent (which will let you see the full content of the status messages including which test is being reported), then on your xymon server:
xymoncmd xymon_channel --channel=status --filter=hostname.example.com tee /tmp/debug
Note that the final arguments ("tee /tmp/debug") can be anything which reads stdin, and the argument to --filter is a PCRE. If you leave off --filter you'll see every status message being sent to your xymon server which could be somewhat overwhelming! You'll need to leave the command running until whatever is sending the ghost reports has sent a message, of course, whereupon you can hit ctrl-c.
Adam
list Colin Coe
Thanks, I'll see if this gets me what I need.
▸
On Tue, 3 Jan 2023 at 19:08, Adam Thorn <user-f6b877930936@xymon.invalid> wrote:
On 03/01/2023 03:08, Colin Coe wrote:Hi all I decommissioned (i.e. physically removed) a bunch of Cisco switches some time ago but I see that they are still showing in the ghost report. I've checked hosts.cfg and devmon's hosts db but can't find them.The ghost report tells you which IP sent the message to xymon, so you should check there. If you want to see the full message sent (which will let you see the full content of the status messages including which test is being reported), then on your xymon server: xymoncmd xymon_channel --channel=status --filter=hostname.example.com tee /tmp/debug Note that the final arguments ("tee /tmp/debug") can be anything which reads stdin, and the argument to --filter is a PCRE. If you leave off --filter you'll see every status message being sent to your xymon server which could be somewhat overwhelming! You'll need to leave the command running until whatever is sending the ghost reports has sent a message, of course, whereupon you can hit ctrl-c. Adam