Question about working around to auto add devices that are currently flagged in Message Center as "Unknown Log Node" -> "Message from Traps dropped since [IP] is not monitored on engine [POLLER]"

I see in the documentation (Add unknown nodes to the SolarWinds Platform)  that "Messages received from an unknown network node are discarded until you add the device through Node Management. ".

Is there a way around this that doesn't involve manually adding nodes *after* messages come in? Like turning this feature off, allowing nodes to post SNMP/Syslog via subnet/IP range, or auto adding nodes when the message comes in (yes this one probably isn't a great idea)?

I just upgraded to 2024.1.0 and LogAnalyzer's behavior (it just now replaced the old SNMP/Syslog tools on the orion server) is a bit different than we are used to.  we have a lot of nodes sending SNMP/Syslog to the system that were not in the system and are not planned/wanted to be.  they were using it to alert on their traps/syslogs, vs "we need to have this added to Orion". I can see how it has to be added 'for licensing" or something, but I'm really just looking for a way to not have to manually add the nodes myself as other teams (who will not add teh nodes) configure their remote devices to send snmp/syslog to Orion. NOTE: They are not sending 'all the SNMP/syslog from their devices' just some filtered stuff, per some previous discussions years ago about how much of this traffic our system can handle).

Parents
  • Hi  ,

    So the change with the new Log Viewer / Analyzer is that everything is associated with the Node. So there is a system rule that discards messages from any device that is NOT in your Nodes table. I have found the best way around this is to add the device as an External Node. SolarWinds will not be polling out to the device via ICMP or SNMP but will be able to accept SNMPv2 Traps/Syslog messages.

    I hope this helps.

Reply
  • Hi  ,

    So the change with the new Log Viewer / Analyzer is that everything is associated with the Node. So there is a system rule that discards messages from any device that is NOT in your Nodes table. I have found the best way around this is to add the device as an External Node. SolarWinds will not be polling out to the device via ICMP or SNMP but will be able to accept SNMPv2 Traps/Syslog messages.

    I hope this helps.

Children
No Data