odd "Nagios->check_smtp->Watchguard SOHO->MS Exchange" problem

[Rogelio Bastardo]

I have an interesting Nagios question, and I'm wondering if it is a
problem with Nagios, Watchguard SOHO, or Exchange.

I am monitoring approximately 30 Exchange servers with no problem.
Since I cannot ping them (b/c they're behind firewalls), I typically
set the check_smtp plugin as the test to see if the host is alive.

All is well for all of them (running just about every firewall
imaginable, but mostly Cisco PIX), except for this Watchguard SOHO.
My friend said that he was experiencing problems with what he expected
was his firewall (Exchange queues and netstat showed nothing wrong),
and I suggested that he run Kiwisyslogger on the Exchange box to have
it view in real time what was going on.

He called me back and said that there were all sorts of bad packet
errors from my Nagios host.

e.g.

2007-08-03 09:58:21	Local0.Warning	192.168.1.254	IP: Packet discarded
from x.y.z.34 port 46302 to a.b.c.234 port 25 (TCP)(incorrect state)
@2007-08-03-10:58:28

I had him send me the syslog dump, and shortly after I killed Nagios,
mail started coming in ok and hasn't missed a beat. Looking through
the logs, I'm only hitting his Exchange server like once every couple
of minutes.

Any ideas on what the problem could be?  Unfortunately, I can't easily
replicate the problem, lest I risk disrupting their connectity again.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null