Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

unknow machine trying to "discuss" with NCM

Hello,

I have a machine on my network (NetScaler) that produce error on NCM -> alerts: syslog encrypted (...) and unknown node (...).

From documentation it says to add the device to NCM but I don't want to monitor this machine.

It is there a way to automatically discard the alerts to keep a clean dashboard?

Find more posts tagged with

Accepted answers

All comments

bobmarley

Disable sending syslogs to the Orion system in the Netscaler and those message should stop.

ldelt

That's the thing to my knowledge it is not configured. I will ask the team of charge of that server just to be sure.

ldelt

Still looking for a solution. It is not netscaler, it is a nessus scan, is there a way to ignore the alert?

stevenstadel

It sounds like the device is sending syslogs to your NCM server. The device's syslog configuration needs to be changed to not send the syslogs to NCM. Can you include a screenshot of the error?

vinay.by

Hello @ldelt

2 things, you mentioned you just need NCM backup but you dont want to monitor the device

1. Add the device as external node in that case, and apply NCM configuration backup on the same - with this you will not monitor the device but your backups will continue.

2. If this syslogs that you are talking about, check what syslog messages are linked to this and apply a discard rule for those syslogs. With this even though you receive an unwanted syslog you can discard it on SolarWinds. Ideally the approach should be on the other side, rather than discarding it on SolarWinds you should get it stopped from the device end.

Hope this helps.

ldelt

except the goal of a nessus scan is to discover vulnerability so basically my security team said: "no, we can't do that, set a rule on your side to ignore the alert."

It is more an annoyance than a real issue. The problem is it raises a red flag and if we have another real issue people will not look at the dashboard anymore, it is human nature.