Hello,
Either it is NPM 11.5 or 12 , Can NPM detect and/or alert on duplicate IP addresses ?
I have not seen it have that capability. I believe the IPAM solution from Solarwinds can do that. We have that issue occasionally and IPAM is something we are looking at to assist.
@jkump
thx for your answer, yes IPAM can do it , I was asking about NPM itself , can NPM detect the IP conflict ! this is the question
I use Syslog alerting for this capability. I alert on syslogs with the message type "IP-4-DUPADDR".
Works beaut.
yes ok but still you have to configure the network device to generate syslogs
Yeah but isn't that something you'd do anyways?
not really, IPAM for example do it by itself
I like the syslog idea nice one superfly99
I think you get conflicts in solarwinds. I know I did when I had an IP address conflict (I used a small test server.)
@ shaun_9999 : you mean NPM detected the IP address conflict by itself ?
In essence yes. I am doing our new environment (1000 + nodes and counting) and if you try to add an already added node, it will prompt you that the node is already existing.
I'm not dismissing the idea that somewhere, in a galaxy far, far away somewhere there was been a glitch in the Matrix and solarwinds must have messed up and added a node with the same IP address. I'm guessing they might call it - xxx-xxx-xxx-01 Copy. Or something similar. Or it broke solarwinds.
That doesn't mean duplicate IP address, that means duplicate node. NPM doesn't detect duplicate IP addresses. You can tell by the fact you can't write a rule in Alert Manager for this.
Can I ask duplicate IP's on what type of machines? If they are Windows servers you can use SAM to monitor Event Viewer. Linux servers you can use NPM to monitor Syslog.
@Peter
It doesnt matter what type of device is, you can have a windows server with a certain IP then you add another node with Lynic device type but with the same IP ,, seems that NPM will just add the 2nd node without alerting you that there is an already existing node with the same IP
Sounds like some tech entered the gateway as the device IP.... I agree with superfly99, use syslog's to alert on this... to keep your DB size down after you alert on this instance you can setup the syslog server to dump your lower level entries.
Here is the process explained in another thread; RESOLVED: Configure Alert Based on Syslog Entry
Thanks to neilmborilla for that answer!
NPM will tell you if the node you are trying to add to the system is already being monitored. But it will not tell you that an IP is being used more than once on your network. Go syslogs for this.
Agreed, doing this via syslog is the right solution. All your devices should be reporting their syslog and trap information to NPM, even at the same time as NPM polls them for other info.
If it's only for cleanup purposes, you could use the SolarWinds Active Diagnostics to identify monitored nodes with duplicates IP.
This will not allow you to alert based on this, nor tell you straight which nodes are "conflicting" but it's a start. Expect to see duplicates for nodes with cluster-type IP (ie: HSRP, redundancy) and generic ip like 128.0.0.x (especially if you have Juniper stuff).
Edit:
Also while I was writing this message, I found this article on success center: Find duplicate IP address in NPM 12 Database . You could reuse the query and integrate that in alarms and/or web UI
The query in the article is made only on polling IP. To get further information directly from database, you'd need something like this:
SELECT i.NodeID, NodesData.Caption, i.IPAddress, i.InterfaceIndex, i.IPAddressType, i.SubnetMask FROM NodeIPAddresses AS i INNER JOIN NodesData ON i.NodeID = NodesData.NodeIDWHERE ( i.IPAddress IN (SELECT IPAddress FROM NodeIPAddresses GROUP BY IPAddress HAVING (COUNT(*) > 1) ) )
