Interfaces randomly delete

Question

Well, it happened again... Orion NPM randomly deleted interfaces again, although this time it deleted over 4,000......!

I have had this happen before (version 11.5.3) where Orion would randomly delete interfaces then readd them. I looked in the audit log back then and all it said was 'system' deleted them. I created an alert to let me know if it happened again and it was working.

Until yesterday.

I noticed a few odd things yesterday morning where NetFlow was all of a sudden saying it was detecting NTA traffic on unmonitored interfaces. Strange but not that uncommon. I then did a deeper dive today and that's when I discovered the majority of my interfaces were removed. The Event log shows them removed so I have a rough time when it occurred but the audit log did not record this at all.

We upgraded to 12.4 at the first of the April and I totally forgot about the interface add/deletion issue thinking at the very least it was a random bug that might have been fixed in the newer version - guess not.

As soon as I get my database restored I will be opening a trouble ticket but has anyone else seen this behavior before?

Thanks!

x-orion · Answer

Hi,

That really weird . I recommend to check SNMP credentials. Success Center . Also, it`s might be the database didn't reflect changes in audit log, you can try reboot your SQL server and check audit events

* Login onto your Orion server and select Start-->All Programs-->SolarWinds Orion-->Advanced Features-->Database Manager
* From the Database Manager applet, click the Add default server option on the menu
* Expand the tree until you find the database name (i.e. SolarWindsOrion)
* Expand the Orion database and locate the AuditingEvents table
* Right-click on the AuditingEvents table and scroll until you find the nodes additions or deletions (ActionTypeID24 and 25, respectively)

nafees.khan · Answer

Hi,

Kindly try the workaround below.

# Navigate to https://VIKDCPVONAS220/Orion/Admin/AdvancedConfiguration/Global.aspx

# Search for *PollingEnabled *settings key under ADM

# Uncheck the checkbox (disable Application Dependency Mapping)

# Save the changes and let it run

superfly · Answer

I've been using Solarwinds for around 10 years and I've never seen this before.

Seeing it keeps happening between different versions for you, I think there's something weird just happening in your system. A quick google search revealed no other similar findings as yours. Sounds like there's something random running on your system such as a script that's been setup to delete stuff.

Hope you can find it. Maybe support can work out what's going on for you.