issue with Auto Agent Activation

Question

This was accidentally activated in our environment, now we have several thousand nodes being reported, most are unknown connection status and unknown agent as they do not have an agent installed and were initially not monitored with an agent (and no agent install was done) there are several thousand that have the same IP address (running an agent inventory report).

What is the best way to clean this out?

A query in the DB to clear this

Something in Solarwinds

Do I need to restore the Orion database (and would i also need to restore the other 2 databases (flow storage and OrionLog) from the same time?

Groppe · Answer

Thank you, I now have the SDK and will be looking into how to run a bulk delete

mr.castaneda · Answer

Hi @Groppe ,

Definitely do not restore your databases—that will wipe out recent polling history, alerts, and potentially cause sync headaches between Orion, NTA Flow Storage, and the Log database. You also don't need to run direct SQL deletes against the DB, as that can leave orphaned records.

Here is the cleanest way to stop and clean this up:

1. Disable Auto-Activation First

Stop new records from being created:

* Go to Settings > All Settings > Agent Settings (under Product Specific Settings).
* Turn off Automatic Agent Registration / Activation.

2. Bulk Delete from the Web Console

Clean Up the Agents:

* Navigate to Settings > All Settings > Manage Agents.
* Filter/group the list by Connection Status (e.g., Unknown or Disconnected).
* Increase the page size if needed, select the unwanted agent records in bulk, and click Delete.

Clean Up Orphaned Nodes (if created):

* Go to Settings > Manage Nodes.
* Group or filter by Polling Method: Agent or Status: Unknown.
* Select the phantom nodes and hit Delete. (Deleting nodes via the UI properly cascades and cleans up all related interface, volume, and poller tables).

3. Alternative for Large Volume (Orion SDK / SWQL)

If the web console struggles with paging through thousands of records at once, you can use the SolarWinds Orion SDK (PowerShell / SwisPowerShell) to script a clean bulk deletion via the API (SWIS) rather than touching raw SQL tables.

Hope this helps get your environment back to normal!