Page 1 of 1

Phantom Unconfigured Objects

Posted: Thu Jan 25, 2018 12:42 pm
by blariv
hi,

running into an issue where there are a bunch of servers showing up but they are no longer online.

I cannot ping them and there are no dns records of them existing anymore. I cleared the and also tried deleting the corelog.newobjects file but the keep showing up.

just looking for a little direction.

Re: Phantom Unconfigured Objects

Posted: Thu Jan 25, 2018 5:02 pm
by npolovenko
@blariv, If you can't ping the servers that doesn't always mean they still aren't active. They could be behind a firewall, or ICMP discovery for them may be disabled. Or, whats more likely is their original IP addresses may have changed. Would you be able to check these servers or virtual machines at the source to make sure they're offline?
Also, how were these passive checks configured originally? And what kind of agent was used?

Re: Phantom Unconfigured Objects

Posted: Fri Feb 02, 2018 9:51 pm
by blariv
hi, lost this in the shuffle.

i am seeing the same named host show up, they are windows with nsclient NSCP-0.5.2.33-x64. it also seems that they are now coming in as duplicates w/ lowercase names while the ones originally imported are uppercase.

HOSTNAME is already imported and configured
hostname shows up in unconfigured

I did a mass remove/install of nsclient from .39 to the latest.

Re: Phantom Unconfigured Objects

Posted: Mon Feb 05, 2018 10:41 am
by npolovenko
@blariv, What kind of software did you use to mass reinstall nsclient? If you changed the case then new incoming checks will show up under new hosts. Hostnames are case sensitive.

Re: Phantom Unconfigured Objects

Posted: Mon Feb 05, 2018 3:01 pm
by blariv
powershell, the hostname field in the nsclient.ini is set to auto

Re: Phantom Unconfigured Objects

Posted: Mon Feb 05, 2018 3:38 pm
by npolovenko
@blariv, Could you provide us with the old and the new nsclient.ini for one of these hosts?

Re: Phantom Unconfigured Objects

Posted: Mon Feb 05, 2018 4:08 pm
by blariv
OLD
;# LOCAL HOST NAME
; The name of this host (if empty "computername" will be used.
hostname=


NEW

; NSCA HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer. auto Hostname ${host} Hostname ${host_lc} Hostname in lowercase ${host_uc} Hostname in uppercase ${domain} Domainname ${domain_lc} Domainname in lowercase ${domain_uc} Domainname in uppercase
hostname = auto

Re: Phantom Unconfigured Objects

Posted: Mon Feb 05, 2018 5:33 pm
by npolovenko
@blariv, I'm not very familiar with NSClient 5.x syntax but seems like the auto option would produce a lowercase hostname. If you want an uppercase hostname you'd need to use ${host_uc}. Maybe this wasn't the case in older versions of NSCLient.

Code: Select all

; HOSTNAME - The host name of the monitored computer. Set this to auto (default) to use the windows name of the computer.  auto	Hostname ${host}	Hostname ${host_lc} Hostname in lowercase ${host_uc}	Hostname in uppercase ${domain}	Domainname ${domain_lc}	Domainname in lowercase ${domain_uc}	Domainname in uppercase 
hostname = auto

Re: Phantom Unconfigured Objects

Posted: Tue Feb 06, 2018 9:04 am
by blariv
ok, ill give that a shot. you can lock this up

Re: Phantom Unconfigured Objects

Posted: Tue Feb 06, 2018 10:30 am
by npolovenko
@blariv, Sounds good. Locking the thread.