PING WARNING - DUPLICATES FOUND!

[mike4vr]

Hi,

Long time Core user and brand new to XI. We just purchased a license and are in the process of porting over our configs. I keep seeing something along the lines of:

Code: Select all

PING WARNING - DUPLICATES FOUND! Packet loss = 0%, RTA = 4.06 ms

for multiple hosts. It pops up and then goes away. What is this and how do I get rid of it?

[Box293]

Do you have multiple NICs with NIC bonding on your XI server?

This article seems to be close to your issue:

https://geekpeek.net/ping-warning-dupli ... nd-nagios/

[mike4vr]

Do you have multiple NICs with NIC bonding on your XI server?

This article seems to be close to your issue:

https://geekpeek.net/ping-warning-dupli ... nd-nagios/

Thank you for the response. I did have a look at that before posting the question. We do not have multiple NICs.

[rkennedy]

Can you run a couple commands and post the result for us to review?

Code: Select all

route
ifconfig

[mike4vr]

Sure.

Code: Select all

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0   *               255.255.255.0   U     0      0        0 eth0
link-local      *               255.255.0.0     U     1002   0        0 eth0
default         NAGXI-1-1.NET 0.0.0.0         UG    0      0        0 eth0

Code: Select all

# ifconfig
eth0      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX
          inet addr:XXX.XXX.XXX.XXX  Bcast:XXX.XXX.XXX.XXX  Mask:XXX.XXX.XXX.XXX
          inet6 addr: XXXX::XXX:XXXX:XXXX:XXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:229059897 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11317380 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:21026463076 (19.5 GiB)  TX bytes:5743564846 (5.3 GiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2277261 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2277261 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:589753927 (562.4 MiB)  TX bytes:589753927 (562.4 MiB)

Private information has been sanitized in the response.

[Fred Kroeger]

I've recently had the same message pop-up at one of my sites and basically Nagios is reporting the data it receives.
To test this, just ping the device from the command line - this isolates Nagios :

Code: Select all

# ping 192.168.31.10
PING 192.168.31.10 (192.168.31.10) 56(84) bytes of data.
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=1.67 ms
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=2.85 ms (DUP!)
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=7.69 ms (DUP!)

tracroute also displays some strange results.
So based on the fact that I'm not getting this problem with any of the other 250 devices I'm monitoring - I pushed this back to the Network Team to indentify the root cause.

regards... Fred

[mike4vr]

The problem I am having is only on Nagios XI with multiple hosts getting the "DUPLICATES FOUND" on ping. We have multiple Nagios Core installs and have never seen this pop up. We'll see it for one or more hosts per check, then it will go away and other hosts will pop up. It isn't isolated to one monitored host. It's very sporadic.

[tmcdonald]

What XI version are you on?

All I can think of is a messed up arp table, something somewhere allowed the same IP to get assigned to multiple MACs, hence the duplication. Though if this is sporadic it will be hard to pinpoint. In theory we could have an event handler to run an arp check when this occurs, but that's not something I have readily-available.

[rkennedy]

To help answer this -
Is the core machine on the same subnet as the XI machine?
Can you run a ping for a while and see if you see the same results as Fred mentioned?
Are you using a DHCP server in your environment?

I have a feeling this is network related, but we'll have to take a look based on those questions.

[mike4vr]

To help answer this -
Is the core machine on the same subnet as the XI machine?
Can you run a ping for a while and see if you see the same results as Fred mentioned?
Are you using a DHCP server in your environment?

I have a feeling this is network related, but we'll have to take a look based on those questions.

Is the core machine on the same subnet as the XI machine?
For some, yes. For some others, no. The problem happens on multiple machines on the same and other subnets.

Can you run a ping for a while and see if you see the same results as Fred mentioned?
I did run a long ping on one of the hosts it repeated the warning for and did not see what Fred mentioned.

Are you using a DHCP server in your environment?
No. They are all static.

We have been running Core for years and just recently migrated over to XI. We have never seen this with Core. In fact, we are still running Core, since XI is, currently, unreliable because of this.