Page 1 of 1
Phantom Unconfigured Objects
Posted: Thu Jan 25, 2018 12:42 pm
by blariv
hi,
running into an issue where there are a bunch of servers showing up but they are no longer online.
I cannot ping them and there are no dns records of them existing anymore. I cleared the and also tried deleting the corelog.newobjects file but the keep showing up.
just looking for a little direction.
Re: Phantom Unconfigured Objects
Posted: Thu Jan 25, 2018 5:02 pm
by npolovenko
@blariv, If you can't ping the servers that doesn't always mean they still aren't active. They could be behind a firewall, or ICMP discovery for them may be disabled. Or, whats more likely is their original IP addresses may have changed. Would you be able to check these servers or virtual machines at the source to make sure they're offline?
Also, how were these passive checks configured originally? And what kind of agent was used?
Re: Phantom Unconfigured Objects
Posted: Fri Feb 02, 2018 9:51 pm
by blariv
hi, lost this in the shuffle.
i am seeing the same named host show up, they are windows with nsclient NSCP-0.5.2.33-x64. it also seems that they are now coming in as duplicates w/ lowercase names while the ones originally imported are uppercase.
HOSTNAME is already imported and configured
hostname shows up in unconfigured
I did a mass remove/install of nsclient from .39 to the latest.
Re: Phantom Unconfigured Objects
Posted: Mon Feb 05, 2018 10:41 am
by npolovenko
@blariv, What kind of software did you use to mass reinstall nsclient? If you changed the case then new incoming checks will show up under new hosts. Hostnames are case sensitive.
Re: Phantom Unconfigured Objects
Posted: Mon Feb 05, 2018 3:01 pm
by blariv
powershell, the hostname field in the nsclient.ini is set to auto
Re: Phantom Unconfigured Objects
Posted: Mon Feb 05, 2018 3:38 pm
by npolovenko
@blariv, Could you provide us with the old and the new nsclient.ini for one of these hosts?
Re: Phantom Unconfigured Objects
Posted: Mon Feb 05, 2018 4:08 pm
by blariv
OLD
;# LOCAL HOST NAME
; The name of this host (if empty "computername" will be used.
hostname=
NEW
; NSCA HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer. auto Hostname ${host} Hostname ${host_lc} Hostname in lowercase ${host_uc} Hostname in uppercase ${domain} Domainname ${domain_lc} Domainname in lowercase ${domain_uc} Domainname in uppercase
hostname = auto
Re: Phantom Unconfigured Objects
Posted: Mon Feb 05, 2018 5:33 pm
by npolovenko
@blariv, I'm not very familiar with NSClient 5.x syntax but seems like the auto option would produce a lowercase hostname. If you want an uppercase hostname you'd need to use ${host_uc}. Maybe this wasn't the case in older versions of NSCLient.
Code: Select all
; HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer. auto Hostname ${host} Hostname ${host_lc} Hostname in lowercase ${host_uc} Hostname in uppercase ${domain} Domainname ${domain_lc} Domainname in lowercase ${domain_uc} Domainname in uppercase
hostname = auto
Re: Phantom Unconfigured Objects
Posted: Tue Feb 06, 2018 9:04 am
by blariv
ok, ill give that a shot. you can lock this up
Re: Phantom Unconfigured Objects
Posted: Tue Feb 06, 2018 10:30 am
by npolovenko
@blariv, Sounds good. Locking the thread.