Can't clear ghost clients
list Kris Springer
I've got 6 ghost clients listed on my server webpage. I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list. The ghost names are from many months ago when I first setup the server. I've since change the names. I've attempted to clear the ghosts using the following commands but it doesn't clear anything. Buzzard is one of the hostnames in question. #cd /usr/lib/xymon/server/bin #xymon 127.0.0.1 "drop Buzzard" Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it? Thank you. Kris Springer
list Adam Goryachev
▸
On 12/03/14 15:04, Kris Springer wrote:
I've got 6 ghost clients listed on my server webpage. I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list. The ghost names are from many months ago when I first setup the server. I've since change the names. I've attempted to clear the ghosts using the following commands but it doesn't clear anything. Buzzard is one of the hostnames in question. #cd /usr/lib/xymon/server/bin #xymon 127.0.0.1 "drop Buzzard" Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it?
ghosts are there *because* you do not have them in your config file. They are "generated" by clients reporting status with that name. You should be able to determine where these reports are coming from based on the names and/or source information on the ghost report. If the client stops reporting, it will be removed from the ghost report after 5 minutes (I assume this is actually the timeout value of the status which is usually 5 minutes). Worst case, you can firewall port 1984 to block the incoming status reports, or use tcpdump to determine where they are coming from. Hope this is useful/helpful. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au
list Steve B
What if we are receiving ghost reports from a server we no longer have access to? I have about ten servers that have been taken out of my access list that still have a BBWIN installation reporting to my central Xymon server. I know where they are coming from but I cannot stop the information coming from the host (in theory I could but then I have to ask some people across the world to go and uninstall something from their machines and this always takes a long time and it not always respected). regards Steve On Wed, Mar 12, 2014 at 5:56 AM, Adam Goryachev <
▸
user-92fd6827f6ae@xymon.invalid> wrote:
On 12/03/14 15:04, Kris Springer wrote: I've got 6 ghost clients listed on my server webpage. I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list. The ghost names are from many months ago when I first setup the server. I've since change the names. I've attempted to clear the ghosts using the following commands but it doesn't clear anything. Buzzard is one of the hostnames in question. #cd /usr/lib/xymon/server/bin #xymon 127.0.0.1 "drop Buzzard" Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it? ghosts are there *because* you do not have them in your config file. They are "generated" by clients reporting status with that name. You should be able to determine where these reports are coming from based on the names and/or source information on the ghost report. If the client stops reporting, it will be removed from the ghost report after 5 minutes (I assume this is actually the timeout value of the status which is usually 5 minutes). Worst case, you can firewall port 1984 to block the incoming status reports, or use tcpdump to determine where they are coming from. Hope this is useful/helpful. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au
list Henrik Størner
▸
Den 2014-03-12 12:44, Steve B skrev:
What if we are receiving ghost reports from a server we no longer have access to? I have about ten servers that have been taken out of my access list that still have a
BBWIN installation reporting to my central Xymon server. I know where they are coming from but I cannot stop the information coming from the host (in theory I could but then I have to ask some people across the world to go and uninstall something from their machines and this always takes a long time and it not always respected).
Put them on a 'junk'
page in your Xymon setup with no alerts and a no-propagate on all status
reports.
Regards,
Henrik
list Steve B
Thanks for that Henrik, sounds like a good approach, will go for that.
▸
regards
Steve
On Wed, Mar 12, 2014 at 12:52 PM, Henrik Størner <user-ce4a2c883f75@xymon.invalid> wrote:
Den 2014-03-12 12:44, Steve B skrev: What if we are receiving ghost reports from a server we no longer have access to? I have about ten servers that have been taken out of my access list that still have a BBWIN installation reporting to my central Xymon server. I know where they are coming from but I cannot stop the information coming from the host (in theory I could but then I have to ask some people across the world to go and uninstall something from their machines and this always takes a long time and it not always respected). Put them on a 'junk' page in your Xymon setup with no alerts and a no-propagate on all status reports. Regards, Henrik
list Paul Root
You have machines in the ghost list because somewhere some machine is sending updates under those names. Put them back into your hosts.cfg so you can see what test it is that is getting sent. Then you can find that machine and fix it.
▸
From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Kris Springer
Sent: Tuesday, March 11, 2014 11:05 PM
To: Xymon MailingList
Subject: [Xymon] Can't clear ghost clients
I've got 6 ghost clients listed on my server webpage. I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list. The ghost names are from many months ago when I first setup the server. I've since change the names. I've attempted to clear the ghosts using the following commands but it doesn't clear anything. Buzzard is one of the hostnames in question.
#cd /usr/lib/xymon/server/bin
#xymon 127.0.0.1 "drop Buzzard"
Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it?
Thank you.
Kris Springer
list Paul Root
Then you live with ghosts, or you firewall around them. The best solution is obviously to try to get people to uninstall them. Or at least turn them off in services.
▸
From: Xymon [mailto:xymon-bounces at xymon.com] On Behalf Of Steve B
Sent: Wednesday, March 12, 2014 6:45 AM
To: Adam Goryachev
Cc: Xymon at xymon.com
Subject: Re: [Xymon] Can't clear ghost clients
What if we are receiving ghost reports from a server we no longer have access to? I have about ten servers that have been taken out of my access list that still have a BBWIN installation reporting to my central Xymon server. I know where they are coming from but I cannot stop the information coming from the host (in theory I could but then I have to ask some people across the world to go and uninstall something from their machines and this always takes a long time and it not always respected).
regards
Steve
On Wed, Mar 12, 2014 at 5:56 AM, Adam Goryachev <user-92fd6827f6ae@xymon.invalid<mailto:user-92fd6827f6ae@xymon.invalid>> wrote:
On 12/03/14 15:04, Kris Springer wrote:
I've got 6 ghost clients listed on my server webpage. I have a clean hosts.cfg file that definitely does not contain any of the names in the ghost list. The ghost names are from many months ago when I first setup the server. I've since change the names. I've attempted to clear the ghosts using the following commands but it doesn't clear anything. Buzzard is one of the hostnames in question.
#cd /usr/lib/xymon/server/bin
#xymon 127.0.0.1 "drop Buzzard"
Anyone have a clue as to how to clear old ghosts and/or where to find the pesky files that are causing it?
ghosts are there *because* you do not have them in your config file. They are "generated" by clients reporting status with that name. You should be able to determine where these reports are coming from based on the names and/or source information on the ghost report. If the client stops reporting, it will be removed from the ghost report after 5 minutes (I assume this is actually the timeout value of the status which is usually 5 minutes).
Worst case, you can firewall port 1984 to block the incoming status reports, or use tcpdump to determine where they are coming from.
Hope this is useful/helpful.
Regards,
Adam
--Adam Goryachev Website Managers www.websitemanagers.com.au<http://www.websitemanagers.com.au>;