3 Replies Latest reply on Sep 11, 2013 6:11 PM by nicole pauls

    InternalUnknownAgent SolarWinds Alerts???

    msterling

      I am getting a lot of InternalUnknownAgent Alerts under the SolarWinds Alerts filter. What are these alerts, are they serious, and how do I fix them? Couldn't find any info on them in the User Guide or in THWACK. Thanks in advance!

        • Re: InternalUnknownAgent SolarWinds Alerts???
          msterling

          Anyone have any idea about this? I recently put these PCs in after they had been offline for quite some time, could that effect it?

          • Re: InternalUnknownAgent SolarWinds Alerts???
            nicole pauls

            TTL is correct.

             

            When agents first connect, they exchange certificates with the LEM appliance/manager. Going forward, they use these certs and a secure-only communication channel. If an agent is deleted from the LEM appliance/manager's listing, the manager forgets the certificates and the agent entirely, but the agent thinks everything is still hunky dory unless you also clean up the agent side at the same time. So, the agent's saying "hey guys, don't you trust me?" and only speaking on secure ports, and the manager is saying "I have no idea who you are" and refusing the connection. When that happens, it generates an InternalUnknownAgent alert to let you know something's up.

             

            To fix it, go to the old agent and either uninstall/reinstall, or clear out the certificates (usually in c:\windows\system32 (or syswow64)\contegospop\spop) and restart the service.