This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to fix a misidentified device/node

I've researched high & low but cannot find how to fix a misidentified device/node. For example, I have several physical servers & VM's that are discovered as ASA's. No matter what I do, I cannot remedy. I'm sure I'm gonna feel dumb that it's something very easy but researching Thwack came up empty.

Thanks in advance!

  • Hello. Could you check please what "pollers" were assigned to those devices? Maybe your VM were assigned a Cisco poller or a custom one. Go to All Settings -> Manage Pollers

    pastedImage_0.png

    Since I am using a custom poller to pull data from my Palo Alto firewall it shows me the additional icon "Pollers" in the Management widget.

    pastedImage_1.png

    Best regards,

    Steffen

  • Thanks Steffen. So far I'm unable to make heads or tails regarding the polling. They are all out-of-the-box, no custom. It's just not making sense why there are switch & firewall pollers but some of these devices get swept up under the "Node Details" poller, as do servers. And then the original issue of why some servers are discovered as ASA's. My head is swimming emoticons_happy.png

  • I don't know if yours is the same problem I have had in the past, but I have had the Settings > Views > Views by Device Type settings be wrong on occasion.  If the drop down by the device you are monitoring is set to Cisco ASA, it might miss-identify, or really just display a Cisco ASA summary page instead of what should be listed as "(default)".  I have had this happen to some Cisco devices where that drop down was mysteriously on Wireless Controller, and more recently as Cisco ASA.  Changing it back to (default) helped me.

    pastedImage_0.png

  • I've manually corrected this same issue by forcing NPM to use a different template to discover/monitor/manage certain devices.  ASA's are notorious for being recognized as Wireless Controllers, and certain Cisco switches may be recognized by NPM as wireless controllers, for example.

    Edit your nodes that are not correctly identified and force them to use the appropriate template instead of letting SolarWinds automatically determine the right template.  I bet this will fix the issues for you.

    At the bottom of editing the node in NPM, find this area:

    pastedImage_0.png

    Change the device template manually to the appropriate one for the device.  Since I have a custom-tweaked ASA template, mine looks like this:

    pastedImage_1.png

    That fixes the issue in my environment.  I hope it does for yours as well.

    Swift packets!

    Rick Schroeder

  • First of all, thanks for the advice guys! I now see the problem. Following John's direction, I noticed that these Windows servers are being categorized as "Unknown." And those were set to "Node Details for ASA." Switching to "Node Details - Summary" didn't change the result of these servers being "Unknown."

    So, next step is to have "Unknown" devices discovered properly. Thoughts?

  • I had about a hundred Unknown devices and I finally got down & dirty to manually categorize them all.  Many were medical devices that Security doesn't want snmp strings on, but their operators want to know if the devices are offline.  I'd been monitoring them only with ICMP just fine, but I found happiness when I used a lovely SWQL script to put them all in their own Vendor categories.  Now things look tidy and I have no more Unknown devices.

    If you aren't using SNMP (or WMI or an Agent or another method) to fully discover a device, then you might be using ICMP to monitor it.  And that results in entries to your Unknown category.

    Follow the instructions here and you'll soon be showing all Unknown Nodes as nodes belonging to a specific Vendor:

    Assign a vendor to an ICMP node - SolarWinds Worldwide, LLC. Help and Support

  • Hey Rick, Just as a side note, this template only applies if the customer has NCM as that is the template used for CLI Access - The "Views by Device Type" is what is assigned by the system for that machine type. If the Node itself isn't being detected as a Windows Machine, then it would be a Poller issue or problems with WMI/SNMP etc.

  • Understood.  I selfishly assume everyone has NCM just because I can't live without it.  I know it's not free, not cheap.  But it IS worth it in my environment for managing/restoring configs quickly, for doing fast and massive updates when changes are required, and for ensuring all my gear passes industry and local Compliance requirements.

    Network Management isn't worth doing if you can't do it right; NCM does it right.  (Ok, that's just a shameless plug and I have no shame!)