Problem with missing check results

[niebais]

Centos 64 bit version 6.5
Nagios XI 2012R2.9

I am working with a company and have a really strange error that I can't get to go away in the logs:
[1415511621] Warning: Check result queue contained results for service '<DESCRIPTION HIDDEN>' on host '<HOSTNAMEHIDDEN>', but the service could not be found! Perhaps you forgot to define the service in your config files?

The services don't exist in Nagios at all, but we keep seeing these in the logs.
Here's what I have tried so far: 1) Rebooted the server (customer did that one)
2) I tried killing all processes and restarting
3) removed all files in hosts and services (config files) and reconfigured nagios
4) Repaired the DB and reconfigured Nagios to try and fix the problem.

So far nothing has worked. It keeps having the same issue, but I'm not even sure how it is getting these old queue results.

What next?

[BanditBBS]

Have you looked in the crontab to see if NSCA or something else is running and sending the results as passive checks?

[abrist]

Bandit is correct. Check the remote host's crontab for any nsca/etc passive jobs. The only time you will see these errors in the logs is when a remote host is indeed sending passive results.

[niebais]

Interesting...We use Mod gearman in the environment, but I wasn't aware of any passive results with this system. I'll check on that as well.

[lmiltchev]

It could be also NRDS (if you set this up). Check what's in the nagios' crontab by running:

Code: Select all

crontab -u nagios -l

[niebais]

No, it doesn't have NRDS as well. It really is kind of strange. I'll keep digging in if I can find the root cause.

[abrist]

Any luck in the hunt?

[niebais]

The problem just "went away" as mysteriously as it appeared. I haven't seen it since. Wish I had more information on that one.

[scottwilkerson]

I would agree that it sounds like passive results coming in either via NRDP, NSCA or something writing to the checkresults directory. This would include items being sent from another XI server as an "outbound transfer"

[niebais]

In this case, everything was definitely 100% active or it could be related to mod gearman somehow. Unfortunately, I don't see that issue anymore and it went away. Anyway, mark this closed for now. I'm not sure what to do