Ghost SNMP Poller

[weveland]

Good morning!

I've got a quick issue I can't seem to resolve. I have a switch being monitored in nagiosXI (2014R2.7) that had an incorrect SNMP community set. So I went through and changed the community on all of the services. Everything showed as OK but the switch was still reporting that it was being polled with an incorrect community. So I double checked and couldn't find anything wrong. So I got frustrated and deleted all the associated services and the device from nagiosXI. But it's still being polled???

I thought I was crazy. So I ran a TCPdump on the server looking for traffic destined to the switch. Sure enough it's still there every 5 minutes. Any thoughts why that would be? I already downloaded the configuration and grepped through it for the host or the IP address. I've restarted the nagios service and even checked for auto-discovery. I'm just beside myself at this point.

Here's a screenshot of the tcpdump output.

snmp.png

[ssax]

Most likely this is because there is still an /etc/mrtg/conf.d/YOURSWITCH.cfg file that will be polled every 5 minutes by the MRTG cron job, check in there for it and let us know if you do.

Thank you

[weveland]

Yes absolutely it is there. Any idea why it was left? Or did I do something wrong in the way I removed the device?

[ssax]

It looks like you need to remove them manually, I've created a feature request for you:

Code: Select all

NEW TASK ID 6503 created - Nagios XI Feature Request: Delete Host - Have it remove MRTG /etc/mrtg/conf.d files

[weveland]

Or maybe just a way to edit the SNMP value for a device and it's associated services/graphs.

[ssax]

You should be able to manually edit the file but yes, I agree.