I am getting a lot of InternalUnknownAgent Alerts under the SolarWinds Alerts filter. What are these alerts, are they serious, and how do I fix them? Couldn't find any info on them in the User Guide or in THWACK. Thanks in advance!
If I recall correctly, I've seen this happen when you install the agent, it reports to the LEM, and then sometime after that the agent's entry is deleted from the LEM appliance. When the agent reports after that, the LEM generates this error.
TTL is correct.
When agents first connect, they exchange certificates with the LEM appliance/manager. Going forward, they use these certs and a secure-only communication channel. If an agent is deleted from the LEM appliance/manager's listing, the manager forgets the certificates and the agent entirely, but the agent thinks everything is still hunky dory unless you also clean up the agent side at the same time. So, the agent's saying "hey guys, don't you trust me?" and only speaking on secure ports, and the manager is saying "I have no idea who you are" and refusing the connection. When that happens, it generates an InternalUnknownAgent alert to let you know something's up.
To fix it, go to the old agent and either uninstall/reinstall, or clear out the certificates (usually in c:\windows\system32 (or syswow64)\contegospop\spop) and restart the service.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.