This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

InternalUnknownAgent SolarWinds Alerts???

I am getting a lot of InternalUnknownAgent Alerts under the SolarWinds Alerts filter. What are these alerts, are they serious, and how do I fix them? Couldn't find any info on them in the User Guide or in THWACK. Thanks in advance!

  • Anyone have any idea about this? I recently put these PCs in after they had been offline for quite some time, could that effect it?

  • If I recall correctly, I've seen this happen when you install the agent, it reports to the LEM, and then sometime after that the agent's entry is deleted from the LEM appliance. When the agent reports after that, the LEM generates this error.

  • FormerMember
    0 FormerMember

    TTL is correct.

    When agents first connect, they exchange certificates with the LEM appliance/manager. Going forward, they use these certs and a secure-only communication channel. If an agent is deleted from the LEM appliance/manager's listing, the manager forgets the certificates and the agent entirely, but the agent thinks everything is still hunky dory unless you also clean up the agent side at the same time. So, the agent's saying "hey guys, don't you trust me?" and only speaking on secure ports, and the manager is saying "I have no idea who you are" and refusing the connection. When that happens, it generates an InternalUnknownAgent alert to let you know something's up.

    To fix it, go to the old agent and either uninstall/reinstall, or clear out the certificates (usually in c:\windows\system32 (or syswow64)\contegospop\spop) and restart the service.