Yep, this changed with NPM 10.0. Check out the info below for more info:
This is due to the interface index value changing in the router/switch. One thing that can cause this is a reload of the device. Orion monitor interfaces by this value and if it changes, and will no longer receive SNMP information about the interface resulting in an unknown value.
The snmp-server ifindex persist setting means enabling the snpm ifindex on the device.
This may also apply:
This is a change we recently put in for 10.0. What has happened is that your interface has changed both ifDescription and ifIndex. Hence, when we go to try and remap the interface on the rediscovery interval we don't find a match in the database. If an interface changes both its index and name, we consider this a new or different interface. This new event is to tell you of this situation and have you take action.
Most likely your interface has gone into the Unknown status as we no longer are gathering statistics and status for it.
The quick work around is to remove the Unknown interface and add in the newly named/indexed interface. But with that you lose your history. To keep your history you have to be a little more brave and update the database directly.
Steps for this:
- Stop NetPerfMon service.
- Check the interface index and interface description match:
- SELECT InterfaceID, NodeID, InterfaceName, InterfaceIndex FROM Interfaces WHERE NodeID =
- Walk the IF MIB on the device using the SNMP MIB Browser.
- Compare the ifIndex with the InterfaceIndex in the table. Compare the ifDescription with the InterfaceName in the database. Both should be an exact match.
- Update your Interfaces table with the actual values.
- Restart your standard poller (NetPerfMon Service).
I have removed an interface from firewall configuration and I don't see it on Node Resources on Orion. However, node is still generating alert "interface xxx is in an unknown state" on node and "Interface Polling stopped. Could not remap interface. Check ifDescription changed" events.
Has anyone seen similar issue?
How do we fix it?
Are you saying that you removed the interface from the device or from Orion or both?
If you removed it from the device but not Orion, then remove it from Orion via the Node Management page, select Interfaces from the dropdown and delete the Unknown interface.
If you removed it from Orion and the events are still firing for a deleted interface, then make sure it is actually not in the interfaces table "SELECT * FROM Interfaces WHERE NodeID = XX" and restart the NetPerfMon service if it is actually deleted.
If that doesn't fix your issue, then open a support ticket so we can see what is going on.
What if you removed the interfaces from the device, but not orion. And they don't show up in the node management but they do show up in the system manager console on the server.
I had the same problem (removed a portchannel on the device.) I fixed it by re-created the portchannel, then removing it from the NPM before re-removing it from the device.
In case anyone stumbles accross this...
I had the same problem happening more and more, and it was legitimatly due to interfaces that had dissapeared. Then our VM team started updating VM tools on all the VM servers and it really started to throw this error bad. If the interface isnt removed from Orion before its removed from the device it throws this error. I eventually called support, they gave me the following sql script and it solved all my problems.
This removes the unknown interfaces from the database, if you dont what those interfaces violently yanked out of your enviroment then dont run this. I had to rediscover the affected nodes.
DELETE FROM Pollers WHERE NetObject in (SELECT 'I:'+CAST(InterfaceId AS VARCHAR) FROM Interfaces WHERE Status=0)
DELETE FROM Interfaces WHERE Status=0
You can remove interfaces from Orion by going to manage nodes>select the + to expand tree on device and select interfaces and then delete. When you remove it from list resources and they still exist.
Can this event be disabled? I don't see a default event in the Advanced Alerts dialog. With a large core router, this can create thousands of events during a network reconfig.