如何找出上报localhost的异常collectd客户端IP地址？

Got it, let's track down that misconfigured client. Here are a few straightforward methods to identify its IP address:

• Check the collectd server logs
  Most collectd installations log incoming connections along with their source IPs. Start by reviewing your server's collectd logs—common locations are /var/log/collectd.log, /var/log/syslog, or /var/log/messages. Look for lines referencing the host "localhost" or incoming metrics; the source IP should be included in those entries. For example:

  [2024-05-20 10:45:00] plugin_network: Received packet from 192.168.1.78 with host "localhost"
  If your logs aren't showing enough detail, temporarily crank up the log verbosity: edit your collectd config (usually /etc/collectd.conf), set LogLevel debug, restart the collectd service, then check the logs again for granular connection info.

• Capture collectd traffic with tcpdump
  Collectd uses UDP port 25826 by default (adjust if you changed the port in your config). Run this command on your monitoring server to capture relevant traffic:

  sudo tcpdump -i any udp port 25826 -A
  

  Look through the output for packets containing the string "localhost" in their payload. The source IP will be listed at the beginning of each matching packet line (e.g., 192.168.1.78.51234 > your.server.ip.25826: UDP, length 150).

• Check your storage backend for metadata (if applicable)
  If you're using RRD files or a tool like Grafana with a collectd datasource, some setups store the source IP alongside metric data. For RRD files, you might need a tool like rrdtool to inspect metadata, but this is less reliable than logs or tcpdump. If you have a web UI, look for the "localhost" host entry and see if it displays the associated source IP.

• Temporarily block "localhost" data and spot the complaining client (if you have client access)
  If you can access all your clients, you can temporarily filter out "localhost" data on the server to trigger errors on the misconfigured machine. Add this filter to your collectd.conf:

  <Filter "drop_localhost">
      <Rule>
          <Match "host">
              Host "localhost"
          </Match>
          <Target "stop">
          </Target>
      </Rule>
  </Filter>
  

  Restart collectd, then check each client's logs for errors about failed metric delivery. The client throwing errors is the one you're looking for.

Once you have the IP, log into that machine and fix the collectd config—look for the Hostname directive (usually in /etc/collectd.conf or an included config file) and set it to a unique, meaningful name instead of localhost.

内容的提问来源于stack exchange，提问作者wl2776