Linux agent question...

Question

So... If I am polling a node with a Linux agent and the "Status and Response Time" is check off on agent I assume that if the agent loses connection it will read the server as down... right?

Conversely if the "Status and Response Time" is check off on ICMP, would the server still read as UP even though the agent is not working...? Thanks.

aLTeReGo · Answer

If the node is reporting 'down' using Agent-based status polling but can still be 'pinged' from the poller it's monitored by, then it's possibly an issue with the Agent or the AMS. For example, if you stop the Agent service running on the endpoint, this will cause the same behavior. Similarly, if the OS locks up, you would potentially see a similar behavior as well.

I'm sure you've encountered instances in the past where you could 'ping' a device but it would not respond to RDP, SSH, etc.

You can certainly switch status polling over from Agent-based to ICMP, but that is likely just masking an underlying problem somewhere, as I imagine the agent is not returning statistics or other data if the AMS believes it is 'down'. My recommendation would be to ensure that you are running the latest release (2020.2.5 at the time of this post). You can also try changing the Agent mode between active and passive to see if that makes an appreciable difference. If neither of these resolves the problem, I strongly recommend opening a case with support so we can determine the cause of the agent and AMS communications issue.

cwjohnson3rd · Answer

Which would be true but that's not the case here. We deployed agents because that would have been easier that Systems going over 300+ servers and configuring snmp (what I was told). The issue comes into play that I will have a server go "down" because the agent is no longer in communication with the poller but in reality the server pings and is active. This is not widespread, but I wanted to see if this would be could be a thing.

aLTeReGo · Answer

How availability (up/down status) and response time are calculated does not differ depending upon which method is used (ICMP or Agent). The only difference is which protocol is used. In a lot of environments where the Agent is deployed, it's not possible to 'ping' the monitored node from the Poller it's managed by. Either because it's behind a NAT, across the internet, or in strict security zones that don't allow for ICMP echo request/reply packets.