How come I had the same node in NPM twice?!

During a recent inventory a few issues came out in the wash, one of them being duplicate entries in my NPM. The numbers didn't add up and after a bit of digging I discovered 5 x nodes with duplicate entries? 4 of these nodes all showed the same node name and IP, how come NPM didn't complain when someone tried to add a node with the same IP the second time?

Anybody encountered this before? If NPM can have the same node in twice would there be any reason to allow this?

Find more posts tagged with

network_monitoring

network_management

ip_addressing

duplicate_nodes

Accepted answers

All comments

RichardLetts

I use it to get quasi-support for VRFS -- the instances have different community IDs. this allows UDT to collect the ARP and bridge mac tables from those instances.

cgregors

I was instructed by Tech Support multiple times (in a pre 10.x version) that having duplicate IP addresses in the nodes table was a very very bad thing. They always would have me clean up the nodes table and remove the duplicates before proceeding. (Hi Destiny and Matt !)

Since then I've written an alert that trips when a duplicate IP address appears on the same polling engine. When manually entering nodes, that is the only way I know to get duplicate addresses is by putting them on different pollers. This is seems to be acceptable by NPM.

BUT, in our environment some of our System Admins (a short list) have choosen to use DHCP on the servers that are monitored. If you have enabled dynamic addressing on a node, and the node's IP address is under DHCP control, it is possible for DHCP to remap it to something you are already monitoring.

My alert trips about once a month and I have to go find the node that got re-addressed and fix it. It has become a "standard procedure" after doing it so long.

But back to your question: How did it happen?

I suspect the following:

Someone added a node that has multiple interfaces (router eh.)
They clicked the Dynamic Addressing box
A DNS lookup of the hostname (which occurs during routine rediscovery) reset the IP address to the one it found in DNS.
1. The DNS records for all the interfaces point to the same IP address.

Just guessing.

Chris.