Phantom Unconfigured Objects

[blariv]

hi,

running into an issue where there are a bunch of servers showing up but they are no longer online.

I cannot ping them and there are no dns records of them existing anymore. I cleared the and also tried deleting the corelog.newobjects file but the keep showing up.

just looking for a little direction.

[npolovenko]

@blariv, If you can't ping the servers that doesn't always mean they still aren't active. They could be behind a firewall, or ICMP discovery for them may be disabled. Or, whats more likely is their original IP addresses may have changed. Would you be able to check these servers or virtual machines at the source to make sure they're offline?
Also, how were these passive checks configured originally? And what kind of agent was used?

[blariv]

hi, lost this in the shuffle.

i am seeing the same named host show up, they are windows with nsclient NSCP-0.5.2.33-x64. it also seems that they are now coming in as duplicates w/ lowercase names while the ones originally imported are uppercase.

HOSTNAME is already imported and configured
hostname shows up in unconfigured

I did a mass remove/install of nsclient from .39 to the latest.

[npolovenko]

@blariv, What kind of software did you use to mass reinstall nsclient? If you changed the case then new incoming checks will show up under new hosts. Hostnames are case sensitive.

[blariv]

powershell, the hostname field in the nsclient.ini is set to auto

[npolovenko]

@blariv, Could you provide us with the old and the new nsclient.ini for one of these hosts?

[blariv]

OLD
;# LOCAL HOST NAME
; The name of this host (if empty "computername" will be used.
hostname=


NEW

; NSCA HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer. auto Hostname ${host} Hostname ${host_lc} Hostname in lowercase ${host_uc} Hostname in uppercase ${domain} Domainname ${domain_lc} Domainname in lowercase ${domain_uc} Domainname in uppercase
hostname = auto

[npolovenko]

@blariv, I'm not very familiar with NSClient 5.x syntax but seems like the auto option would produce a lowercase hostname. If you want an uppercase hostname you'd need to use ${host_uc}. Maybe this wasn't the case in older versions of NSCLient.

Code: Select all

; HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer.  auto	Hostname ${host}	Hostname ${host_lc} Hostname in lowercase ${host_uc}	Hostname in uppercase ${domain}	Domainname ${domain_lc}	Domainname in lowercase ${domain_uc}	Domainname in uppercase 
hostname = auto

[blariv]

ok, ill give that a shot. you can lock this up

[npolovenko]

@blariv, Sounds good. Locking the thread.