4 Replies Latest reply on Dec 6, 2011 3:42 AM by ozan

    Problem at Solarwinds after Installation of Antivirus.




      We have an issue at one of our customers. They have installed an antivirus software called “Symantec”. Then they are getting some errors that you can check them at attached screenshots. As you can see at the pictures, they are still able to ping machines but errors stands still there. We need some help here about solving this issue. Thank you.


      Best Regards,


      Ozan öZDEMİROĞLU

        • Re: Problem at Solarwinds after Installation of Antivirus.



          Click on any one of their nodes and do list resources.

          My best guess is they installed Symantec AV and had the Network Threat Protection component activated which is the Teefer2 miniport.  This creates either a "virtual network interface" (Windows 2008 and 2008 R2) or appends "- Teefer2" to the end of the interface (Windows 2003) which is what Solarwinds is looking for.

          So here's what you need to do:

          1.) Ask them if they disabled Network Threat Protection.

          2.) List Resources on one of the nodes and notice if the Teefer2 miniport is grayed out.  If it's a 2003 box check to see if there is an interface with the same name minus the "Teefer2".

          3.) Delete and readd network interfaces as neccesary

          4.) Ensure the client knows that any you need to be notified of any changed/added/deleted drives and interfaces as they won't update on their own (unless you are doing scheduled discoveries)

          • Re: Problem at Solarwinds after Installation of Antivirus.

            To expand upon kb1lxm's answer, what you are seeing is due to the interface index value changing in the router/switch. One thing that can cause this is a reload of the device. Orion monitor interfaces by this value and if it changes, and will no longer receive SNMP information about the interface resulting in an unknown value.

            When Orion NPM does a rediscovery and attempt to remap the interface, it was unable to find a match in the database. If an interface changes both its index and name, we consider this a new or different interface. This new event is to tell you of this situation and have you take action. If you Interface has gone into the Unknown status, Orion NPM will no longer be able to gather statistics and status for it.

            The quick work around is to remove the Unknown interface and add in the newly named/indexed interface.