Oliver,
I feel your pain. I have seen this a lot of times in
my test box. At one point, I was seen about 4
messages a second, which filled up my event log
(initially set at 10000), in less than a hour. From
what I saw, it seem that there was a few unmanage
nodes printers that had a more than on ip address
defined for it in the DNS server. It was actually
problem with the folks administering the DNS;they fat
fingered the data, so there were two printers
associated with the same DNS name. Since the node
name in Netview is normally associate with a DNS or a
WINS name, it will try to query the DNS name. This in
turn return two ip addresses, and confused the hell
out of the netview box not mentioning other thing that
connects to it. To fix it temporarily, I actually had
to delete the printers and excluded in the seed file.
I have also seen this with a dual NICed NT Server.
The NT Server didn't have SNMP loaded on the server,
and one of the NIC was at the other side of a Choke
Router, so ping doesn't work. When Netview check with
the DNS server, it get the IP Address of the NIC on
the other side of the choke router. Because Netview
couldn't demand poll or SNMP walk the NT Server, it
never discover the other NIC. Now I have a wrong ip
address associated with the same WINS name, Netview
gets confused, and issue the trap.
It's also possible that you have some unmanaged
workstation that got a new DHCP lease. So check the
address of those nodes in Netview and see if you see a
conflict with the address you resolve using WINS or
DNS.
Hope this helps
Xu He
--- OGrant <OGrant AT PEC DOT COM> wrote:
> Platform: Netview 5.1/NT 4.0, sp3
>
> This one's under the heading of "annoying, not
> fatal" - I'm receiving the
> following Netview-internal trap: "nameserver
> returned duplicate name
> xxx.xxx.0.50 for interface xxx.xxx.96.1; interface
> xxx.xxx.96.1 will be
> deleted" - netview points to a router as the being
> the source of the
> problem, although I'm receiving the same trap from
> other devices (windows
> workstations, etc.) Over several days' time,
> netview has generated this
> trap from the router *11,000+* times.
>
> Issue: we're running WINS on our NT network, not DNS
> (the term "nameserver"
> suggesting DNS - correct?)
>
> Obviously a conflict occuring here - I've checked
> practically the entire
> network for an occurance of xxx.xxx.0.50, but none
> have appeared (thought
> being that a rougue device was once configured with
> this ip address, but
> then never properly re-configured -- perhaps it's
> continuing to broadcast
> this address somehow.)
> Checked my local hosts file, and removed all
> references to the router, and
> address xxx.xxx.96.1. - problem persisted, ruling
> out a local name
> resolution error.
> This Cisco 3620 router itself is properly configured
> with an interface of
> 96.1 - furthermore, a "show snmp" confirms that
> Netview, not the router
> itself, is generating the trap.
>
> - For those who've experienced a similiar problem,
> is this a symptom of a
> WINS database somehow being hosed/corrupted? Even
> though the router's
> obviously not a WINS client, I checked both primary
> and secondary WINS
> servers on the off-chance...both appear clean.
>
> I've even gone so far to run Etherpeek on my Netview
> server to do some
> packet-level analysis and hopefully gather some
> clues as to the source, but
> so far - nothing.
>
> Any ideas? A Netview/NT bug, perhaps? (I know, I
> know - upgrade to 5.1.1.
> But that's a another story.)
>
> Cheers,
> Oliver Grant
> Performance Engineering Corporation
>
===
Xu He
Consulting Services Engineer
Network Solutions, Inc
http://www.netsol.com/consulting
_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com
|
