We have several recycled addresses and the nodes in SW were never updated.
Some addresses have also been used for different platforms (Windows vs Unix) and the original node names still show up.
Tried to edit my original post..
We have an environment (less than 900 machines) that has been around for several years
There have been several nodes setup (some as windows, some *nix).. that "were" monitored at one time.
Some have been shut down and removed, but the node was not removed from SW, the address that WAS used for that machine has been re-used on a different machine (sometimes they are the same OS and sometimes not).
The original address for some of these are showing as managed in SW, but with the old name.
Is there a way to re-verify the nodes that show in SW against the name/OS that the new node is reporting to identify differences in what the node in SW "thinks" it is vs what the node actually is?
I hope this makes sense..
There's an event you can use to figure out name changes. Literally says something like "Caption for NodeID4 changed from 'x' to 'y'", those only last as long as your event retention does though.Not sure what the best way to verify stuff would be otherwise, I guess that's pretty specific to your environment/history
You may want to start by running a report showing the IP, Caption, and DNS of all of the nodes in SolarWinds and then running an NSLOOKUP against all of the IP's and see where your discrepancies are and correct them. Once you have all of the names corrected you may want to rediscover all of the nodes and ensure the agents, WMI, SNMP, etc are working and then do any additional clean up after that.
Orion does a really bad job of cleaning itself up when a node gets replaced with a new piece of hardware. The conventional recommendation is to delete the node and add it in fresh any time you replace the underlying system so that you dont get a bad mix of old and new data. There a certain fields that are set upon the initial discovery and just wont automatically update ever again.
@bobmarley 's suggestion to run a report comparing Caption, IP, DNS, and SysName and look for anything that is obviously out of place is what I would do, but rather than fixing them I'd most likely gather up that list of IP's and delete them, then run a discovery and import them all back in again.
Thank you for the input, I will start that process now to see just how many we have that are off.
I agree totally, if you know the credentials and can delete and rediscover that would be the best route as you will be starting off with a clean environment.
