Sorry to resurrect this old thread, but I finally was able to grab the logs from the Xymon client during a purple alert. Usually, it would go back to green before I would notice, could switch gears, and began working on it.
Thanks, Timoth Williams, for pointing out the file uploading parts of the logs. Based on that, I found these lines in the xymonclient.log file: 2019-07-31 15:25:38 Connecting to host 163.153.163.90 2019-07-31 15:25:59 ERROR: Cannot connect to host monitor1.cairodurham.org (163.153.163.90) : System.Management.Automation.MethodInvocationException: Exception calling "Connect" with "2" argument(s): "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 163.153.163.90:1984" ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 163.153.163.90:1984
It looks like it was somehow resolving the FQDN (monitor1.cairodurham.org) to its external IP address instead of its internal IP address. I'm not sure why. I just checked the DNS settings and they're the same as another Windows 2012R2 server that isn't having this issue.
I changed the FQDN to the internal IP address and restarted the service. Everything went green almost immediately.
Any idea how it could resolve to the public IP address 2 - 4 each day but only for a few hours total each day?
Jaime Kikpole
Director of Technology & Innovations Cairo-Durham Central School District (518) 622-8543, x59500 cairodurham.org <http://www.cairodurham.org>
Technical Support: help at cairodurham.org go.cairodurham.org/techtips
[image: Google Certified Educator, Level 1][image: Google Certified Educator, Level 2] <https://www.credential.net/d24m9rrp>
-- This electronic message and any attachment(s) may contain confidential or legally privileged information protected by law from further disclosure and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agency responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachment(s). Please notify the sender immediately by return email or telephone and permanently delete this message and attachment(s) from your system.