Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Service randomly going into "Unknown" state on multiple servers

Hello all,

Just took over Orion adminsitration.. Trying to figure out why several devices just started having their service go into an "unknown" state and clear a bit later and just continually run into that cycle.

We're running SolarWinds Orion Core 2010.1.0, APM 3.5, NCM 6.1, NPM 10.0.0, NTA 3.6

I've checked and verified WMI and SNMP are active on the servers affected, when I do a test against a node it comes back with "testing node failed undefined status"

We've got two Databases, once for NPM and one for NCM/Syslog. NPM was recently cut down from 1.2TB to ~560GB, Database performance is pretty stable. Not seeing anything in the application logs on the NPM server

The unknown state issue just started a couple days ago out of nowhere, most of these servers have been monitored for well over a year.

Anyone have any ideas or place I can look for a resolution? I've already checked out the WMI troubleshooting pdf (www.solarwinds.com/.../APMWMITroubleshooting.pdf)

Thanks

Find more posts tagged with

Accepted answers

nathburn1

Adeimel, you're actually right, I figured this out about an hour ago.

Someone had added a secondary IP address to the server (After I asked if there were any changes made that day..) . We have a Secure environment for PCI Compliance and that environment relies on DNS for allowed SNMP devices, since there was a new IP address in the dynamic DNS for the host it was intermittently resolving to that. So since this new IP address was not added to the ACLs on the routers the TCP/UDP traffic was getting rejected.

After adding a secondary NIC and unchecking the box to update dynamic DNS with the interface, everything is working fine and I'm no longer getting pages about it.

Thanks for the ideas guys.

All comments

adeimel

I've run into a number of these, the troubleshooting depends on what the template is checking for.

what is the template pulling? via what method?

adeimel

and have you turned that templates debug logging on?

nathburn1

I have not, we only have APM 3.5 installed (Debugging is Version4 and later), we do have a current support contract and I was looking into upgrading each module but may not have time to do so. Was hoping to figure it out without adding more work.

We're polling for Snare (Snarecore.exe) Through an SNMP APM template I've also tried restarting the SNMP service on each server having the issue

Questionario

We have the same issue, with APM4 this got much better. one major reason for this was that we ran NPM on Windows 2008 R2 which as a WMI memory leak, this fixed some of the problems, most of our other unknown alarms relate to win 2008 r2 servers which cannot be polled and we assume that this will be fixed once the change to roll out that hotfix to all 2008 r2 servers has been done.

wmiprvse.exe goes above the normal ~50MB in this case and grew to several 100MB's in our case.