On 4 December 2014 at 21:24, Juergen Fischer <jfische2 at csc.com> wrote:
Here in the 1st line you see "red ]hu ...". I reckon that this line was generated at the Xymon server and not at the client, because it contains the server side (central mode) interpretation of the client data.
That's a reasonable assumption. Does the "client" data for [disk] show the corruption also?
Another option is to use xymond_channel to match and show the client data for corrupt entries. Something like this (run as the xymon user):
xymond_channel --channel=client --filter='client' sed -n '/^\[df\]/,/^\[/p'
You can leave this running for as long as you need, until a corrupt message comes through on your console, and then check the output here to see if it was also corrupted. If this shows no corruption, then the message arrived at xymond without interference, and must have been corrupted by xymond_client.
If this shows corruption, it means that it's either xymond or before (ie BBWin). In this case, you might need to do a long-term packet capture to whether it was corrupt on the wire. Or you can run xymond with the "--dbghost=HOSTNAME" option to get a copy of all communications into /tmp/xymond.dbg.
J