9 Replies Latest reply on Nov 23, 2015 4:54 PM by planglois

    NPM's NodeIPAddresses table is not up-to-date

    marunderwood

      I'm writing a report to find Nodes in IPAM that are not setup in NPM.  To do this, I'm joining the IPAM_Node table to NodeIPAddresses.  Some IPs that are missing are for Nodes with multiple IPs that are only setup in NPM under 1 id.  These shouldn't appear on my report.  However, these IP's are not listed in the 'All IP Addresses for ....' list in NPM (which I'm assuming comes from the NodeIPAddresses table).  So, how do I get all the IP addresses for a Node to be updated in NPM?  What triggers NodeIPAddresses to update?

        • Re: NPM's NodeIPAddresses table is not up-to-date
          zizi

          NPM polls for IP addresses as part of Node Rediscovery process. So content in NodeIPAddresses table should be updated every 30 minutes, by default (rediscovery interval for nodes). You can also force update by clicking on "Rediscover" on Node Details page or for multiple nodes in Web Node Management (More Actions -> Rediscover).

            • Re: NPM's NodeIPAddresses table is not up-to-date
              marunderwood

              My Orion Rediscover process is also set to update every 30 minutes.  So why are there 2 IPs linked to device Cisco model WS-C6509-E (core) that I cannot ping?  When I look at this same system name in IPAM, it shows 3 additional IPs that are not showing in NPM.   And I have 2 IPs in NPM that are not in IPAM.  So I have the following IPs showing in both modules as:

              NPM                    IPAM    

              .4                               .4        

              missing                     .7

              .9 (ping fails)        missing

              .10                        missing

              .17                            .17

              missing                    .24

              .25                            .25

              missing                    .31

              .186 (ping fails)     listed under system name SW01

                • Re: NPM's NodeIPAddresses table is not up-to-date
                  zizi

                  NPM is able to populate list of IP addresses using DNS server and SNMP or WMI. IP address poll for SNMP node executes these steps:

                   

                  1. Perform reverse DNS lookup on Node's IPAddress (from Nodes table) to get fresh DNS name
                  2. Perform forward DNS lookup on DNS name from step 1
                  3. Query ipAdEntIfIndex OID (1.3.6.1.2.1.4.20.1.2) and ipv6AddrStatus OID (1.3.6.1.2.1.55.1.8.1.5) to get all IP addresses assigned to Node via SNMP
                  4. Merge those two lists together, store result into NodeIpAddresses

                   

                  Please be aware that NPM does not perform "pings" on these IP addresses to validate them. SNMP may provide addresses which are not reachable from Orion polling engine. Orion uses ping to primary IP address only, that's the one stored as IP_Address in Nodes table.

                   

                  As it is hard to troubleshoot such issue offline, maybe better open a support ticket and provide output of nslookup <dns>, executed on polling engine, and a MIB walk of the affected node + Orion Diagnostics. You can use snmpwalk.exe tool, which is shipped with Orion (in C:\Program Files (x86)\SolarWinds\Orion).

                    • Re: NPM's NodeIPAddresses table is not up-to-date
                      marunderwood

                      Thanks zizi for your help thus far.  I'm not sure if I'm allowed to provide specific names/ip's, so I'll do my best.

                      I ran nslookup for the node from the polling machine, using the polling ip, and I'm getting "*** (domain controller name) can't find (ip):  Non-existent domain"

                      The full name of the node is core.****-llc.com, whereas **** is our internal website name.

                      I also ran snmpwalk.exe for the ip, and I found several ip's for OID(1.3.6.1.2.1.4.20.1.2) which don't agree 100% with NPM.  I assume it's because of the nslookup error, right?  I'll check with our DNS administrator to see if he has any ideas.

                       


                      Per DNS admin, this node is not in DNS.  Below are the IPs found in SNMPWalk.exe.  It appears NPM does match the SNMP info.

                      NPM                    IPAM                        SNMP                    subnet

                      .4                               .4                       found                                  B

                      missing                     .7                                                                  B

                      .9 (ping fails)        missing                  found                                 B

                      .10                        missing/fixed         found                                  A - IP now shows up in IPAM after adding the subnet

                      .17                            .17                      found                                  B - primary polling ip in NPM

                      missing                    .24                                                                 B

                      .25                            .25                      found                                 B

                      missing                    .31                                                                 B

                      .186 (ping fails)     listed under system name SW01  found      C

                      n/a                         n/a                         .51 (on first line; from a subnet not in either module)  D

                        • Re: NPM's NodeIPAddresses table is not up-to-date
                          zizi

                          Thanks for the quick reply. It is expected that NPM data should match list provided by SNMP agent. You can try to review IP address binding settings on the device itself and compare the list to the output from SNMP agent. As Orion relies on provided SNMP data, I'm afraid there is not much we can do, if those are corrupted. Polling via DNS may add more IPs into the list, when DNS server is not configured properly, for instance (obsolete static entries,etc).

                           

                          Btw. you may not be able to reach all mentioned IP addresses from Orion Polling machine box via ICMP ping. It is expected, as device may report private addresses.

                            • Re: NPM's NodeIPAddresses table is not up-to-date
                              marunderwood

                              Thanks.  I'm not sure I fully understand your reply (yet).  Now that you explained where NPM is getting its information, the piece I seem to be missing is how IPAM is gather its information which could cause the discrepancies?

                                • Re: NPM's NodeIPAddresses table is not up-to-date
                                  michal.hrncirik

                                  Hi marunderwood,

                                   

                                  NPM and IPAM polls are not in sync (for IPAM it typically takes longer than 10 minutes to scan for all statistics data - you may see your IPAM subnet scan scheduler.) However both NPM and IPAM are using the same technique how to obtain node details. You may try to prioritize your IPAM subent scan in order to re-fresh IPAM data. If they are still not consistent. I would try to use packet capture tool - like Wireshark on end-station and filter requests from NPM and IPAM IP address in order to validate that both are polling the same node. (if you have duplicate subents, IPAM can poll data from one subnet only).

                                   

                                  let us know if you tried above.

                                   

                                  Michal

                                    • Re: NPM's NodeIPAddresses table is not up-to-date
                                      marunderwood

                                      Hi!  (fyi.  I've been working with Network Topology Manager and its IP's agree with NPM.)  I added a subnet to IPAM that wasn't there, and now one of the missing IP addresses is showing up (.10).  However, another one (.9) is still not showing up.  The settings for this subnet are 'No DNS server', "update but not erase manually entered data", and 'disable neighborhood scanning".  Would the 'manually entered' cause extra IPs (.7, .24, and .31) for this device to show up in IPAM that are not in NPM?  How do I know if they were manually added?

                                       

                                      Since this device spans multiple subnets, would that have an impact?  I'll added the subnet info to the chart above.

                                       

                                      fyi.  I deleted the SNMP data from IPAM's .7 IP address (since it probably shouldn't be there) and rescanned the subnet.  The SNMP information re-populated.

                        • Re: NPM's NodeIPAddresses table is not up-to-date
                          planglois

                          I have a similar problem where some ICMP-only monitored devices are in the Nodes table, but do not show up in the NodeIPAddresses table.

                           

                          When I merge the 2 tables together to have a full inventory view of IPs seen by my nodes, I get multiple NULL values on the join.  Is there a way to trigger an update of the NodeIPAddresses table?