Setup:
We have a windows node that's set up to use WMI to monitor the server. For some reason the server does not have a static IP address so I put it in Orion as DHCP. To do this I have to put in the "DNS Hostname" in a special field in teh "Add Node" page, and then Orion presumably starts monitoring the node using DCHP to resolve the host. An interesting thing is that Orion appears to cache the IP address (in the "Polling IP Address" field, which is greyed out from editing) of the system within the node, presumably because it's required for it to store a node in the database, or maybe it's for caching so Orion doesn't have to constantly lookup the IP address of the host before it can pull information...even thought I would assume if I'm using DHCP it *should* do an lookup on the DNS name *every time* it has to contact the server using the IP to make sure the IP address it uses is current.
Issue:
The node went down and Orion threw an alert saying "Node X is down", just as we would expect it to. The node stayed down for days, then out of nowhere ( and without any changes noted in the Orion audit log) the node came "up" and then went down again and sent an alert with a different host name! I checked Orion and the node caption assigned to the host had changed, even though the DHCP hostname I had told it to use in the "DNS Hostname" field had not. It appears that Orion does not exclusively use the "DNS Hostname" you enter to monitor the host (at all times) when set to use DHCP to monitor the host. It appears there may be some condition where it uses the cached IP address to monitor the host, then (this seems very odd) changes the node caption of the DNS name when the IP address resolves to a different DNS host name.
Question(s):
Has anyone experienced issues like this when monitoring a host (or maybe just a Windows host via WMI) using DHCP? It seems simple to set up but is there a "correct" or "gotcha" way of doing it? I've read somewhere that Orion has some built in fast polling when nodes go down so it can report an "up" quickly and so it can hedge against a few lost ICMP packets and I was wondering if there's some other internal process that may be special for DHCP nodes that might explain the above behavior.
Thanks in advance!
