Non Existent Unconfigured Objects

[blariv]

hi,

weird one. I have a bunch of windows and linux servers that keep reporting into unconfigured objects. their names do not respond to ping and there are no DNS records for them in our environment.

nagios.log

[1523366264] Warning: Passive check result was received for service 'check_cpu' on host 'AD-TRAINING-1', but the host could not be found!
[1523366264] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;AD-T RAINING-1;check_cpu;0;OK CPU Load ok.|'30m'=0%;95;98
[1523366264] External command error: Command failed
[1523366264] Warning: Passive check result was received for service 'check_driv e_size' on host 'AD-TRAINING-1', but the host could not be found!
[1523366264] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;AD-T RAINING-1;check_drive_size;0;OK: All drives within bounds.|'C:\ %'=77%;90;95 'C: \'=46.08GB;53.69;56.67;0;59.66
[1523366264] External command error: Command failed
[1523366264] Warning: Passive check result was received for service 'check_mem' on host 'AD-TRAINING-1', but the host could not be found!
[1523366264] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;AD-T RAINING-1;check_mem;0;OK: physical memory: 1.16G|'physical memory %'=28%;95;100 'physical memory'=1.16GB;3.8;4;0;4
[1523366264] External command error: Command failed
[1523366264] Warning: Passive check result was received for service 'check_svc' on host 'AD-TRAINING-1', but the host could not be found!
[1523366264] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;AD-T RAINING-1;check_svc;0;OK: All services are in their appropriate state.|
[1523366264] External command error: Command failed
[1523366264] Warning: Passive check result was received for service 'check_user _reboot' on host 'AD-TRAINING-1', but the host could not be found!
[1523366264] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;AD-T RAINING-1;check_user_reboot;0;Eventlog check ok|'eventlog'=0;1;1
[1523366264] External command error: Command failed

[scottwilkerson]

Here's what I would suggest, you can look in the httpd log for entries containing "POST /nrdp/" for the same time as your results to see if you can find the IP

Code: Select all

grep "POST /nrdp/" /var/log/httpd/access_log

A final solution would be to change your NRDP token, which will stop it for sure, however, you would also need to change the token on all the clients you know about.

[blariv]

is there a way to change the nagios log timestamp to something readable?

[scottwilkerson]

is there a way to change the nagios log timestamp to something readable?

It must remain a unix timestamp in this log.

If you turn on the following in the nagios.cfg (on by default)

Code: Select all

use_syslog=1

you can also see the messages in /var/log/messages that should have a readable time

[blariv]

ok, ill poke around. thanks and you can close this