Page 1 of 2
PING WARNING - DUPLICATES FOUND!
Posted: Tue Feb 16, 2016 6:22 pm
by mike4vr
Hi,
Long time Core user and brand new to XI. We just purchased a license and are in the process of porting over our configs. I keep seeing something along the lines of:
Code: Select all
PING WARNING - DUPLICATES FOUND! Packet loss = 0%, RTA = 4.06 ms
for multiple hosts. It pops up and then goes away. What is this and how do I get rid of it?
Re: PING WARNING - DUPLICATES FOUND!
Posted: Tue Feb 16, 2016 6:45 pm
by Box293
Do you have multiple NICs with NIC bonding on your XI server?
This article seems to be close to your issue:
https://geekpeek.net/ping-warning-dupli ... nd-nagios/
Re: PING WARNING - DUPLICATES FOUND!
Posted: Wed Feb 17, 2016 12:08 pm
by mike4vr
Thank you for the response. I did have a look at that before posting the question. We do not have multiple NICs.
Re: PING WARNING - DUPLICATES FOUND!
Posted: Wed Feb 17, 2016 2:08 pm
by rkennedy
Can you run a couple commands and post the result for us to review?
Re: PING WARNING - DUPLICATES FOUND!
Posted: Wed Feb 17, 2016 3:50 pm
by mike4vr
Sure.
Code: Select all
# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 1002 0 0 eth0
default NAGXI-1-1.NET 0.0.0.0 UG 0 0 0 eth0
Code: Select all
# ifconfig
eth0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:XXX.XXX.XXX.XXX Bcast:XXX.XXX.XXX.XXX Mask:XXX.XXX.XXX.XXX
inet6 addr: XXXX::XXX:XXXX:XXXX:XXXX/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:229059897 errors:0 dropped:0 overruns:0 frame:0
TX packets:11317380 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:21026463076 (19.5 GiB) TX bytes:5743564846 (5.3 GiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:2277261 errors:0 dropped:0 overruns:0 frame:0
TX packets:2277261 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:589753927 (562.4 MiB) TX bytes:589753927 (562.4 MiB)
Private information has been sanitized in the response.
Re: PING WARNING - DUPLICATES FOUND!
Posted: Wed Feb 17, 2016 10:13 pm
by Fred Kroeger
I've recently had the same message pop-up at one of my sites and basically Nagios is reporting the data it receives.
To test this, just ping the device from the command line - this isolates Nagios :
Code: Select all
# ping 192.168.31.10
PING 192.168.31.10 (192.168.31.10) 56(84) bytes of data.
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=1.67 ms
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=2.85 ms (DUP!)
64 bytes from 192.168.31.10: icmp_seq=1 ttl=62 time=7.69 ms (DUP!)
tracroute also displays some strange results.
So based on the fact that I'm not getting this problem with any of the other 250 devices I'm monitoring - I pushed this back to the Network Team to indentify the root cause.
regards... Fred
Re: PING WARNING - DUPLICATES FOUND!
Posted: Thu Feb 18, 2016 11:38 am
by mike4vr
The problem I am having is only on Nagios XI with multiple hosts getting the "DUPLICATES FOUND" on ping. We have multiple Nagios Core installs and have never seen this pop up. We'll see it for one or more hosts per check, then it will go away and other hosts will pop up. It isn't isolated to one monitored host. It's very sporadic.
Re: PING WARNING - DUPLICATES FOUND!
Posted: Thu Feb 18, 2016 2:09 pm
by tmcdonald
What XI version are you on?
All I can think of is a messed up arp table, something somewhere allowed the same IP to get assigned to multiple MACs, hence the duplication. Though if this is sporadic it will be hard to pinpoint. In theory we could have an event handler to run an arp check when this occurs, but that's not something I have readily-available.
Re: PING WARNING - DUPLICATES FOUND!
Posted: Thu Feb 18, 2016 2:12 pm
by rkennedy
To help answer this -
Is the core machine on the same subnet as the XI machine?
Can you run a ping for a while and see if you see the same results as Fred mentioned?
Are you using a DHCP server in your environment?
I have a feeling this is network related, but we'll have to take a look based on those questions.
Re: PING WARNING - DUPLICATES FOUND!
Posted: Thu Feb 18, 2016 3:10 pm
by mike4vr
rkennedy wrote:To help answer this -
Is the core machine on the same subnet as the XI machine?
Can you run a ping for a while and see if you see the same results as Fred mentioned?
Are you using a DHCP server in your environment?
I have a feeling this is network related, but we'll have to take a look based on those questions.
Is the core machine on the same subnet as the XI machine?
For some, yes. For some others, no. The problem happens on multiple machines on the same and other subnets.
Can you run a ping for a while and see if you see the same results as Fred mentioned?
I did run a long ping on one of the hosts it repeated the warning for and did not see what Fred mentioned.
Are you using a DHCP server in your environment?
No. They are all static.
We have been running Core for years and just recently migrated over to XI. We have never seen this with Core. In fact, we are still running Core, since XI is, currently, unreliable because of this.