This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

"NCM search" incomplete results?

So, I've been suspecting it for a while now, but I think I've finally confirmed that when you "Search NCM" it doesn't return all the results it can.

The way I confirmed it is this.  We have 3000 nodes in NCM, only a handful aren't Cisco IOS devices.   All of them are monitored via NPM, so they all have SNMP communities.   All but maybe 3-6 are using SNMP v2c, we're doing a bit of testing on SNMPv3 on the ones that aren't.   So, I did a search for "community" and it spit out a ton of results, 2058 lines worth.  The search parameters were pretty basic.     Search in all.  Search the last downloaded Config from each Node only.   Include all config types.   No date ranges or anything (which would be precluded by the "Search the last downloaded Config from each Node only" selection.

First off, with 3000 nodes in NCM, I would expect more than 2058 lines worth of output on a basic search like this.   I was expecting far over 3000 lines worth since each config searched takes up at least one line.

I copied and pasted those results into the VI editor, sorted the results.   Removed all the lines that didn't have a device name on them, which was pretty simple at this point, and ended up with 487 lines of different device names.

I would think I should have closer to the full 3000 nodes rather than just 487.    Maybe I chopped off a couple, but not nearly 2500 I would think?

So, question is, anyone else seeing this?   Is this a known problem?   Does anyone see a problem with how I did this, like in the search parameters or something?

  • I've only got 481 nodes in my NCM database and when I do a search on community I get a "hit" on all the configs.

    Maybe there's a bug with higher number of nodes in NCM. I would suggest to log a case with Solarwinds for it.

  • Hi Craig Norborg,

    I've found out you had already opened a support case. I agree with the advice from the support rep -- try to force re-indexing. If that doesn't help then someone from engineering will investigate the problem.

    Regards,

    Jiri

  • There definitely is still a problem, I just updated the case notes.  After re-indexing I get 248 nodes with the word "community" in them, less than 1800 lines of output from the search.  However,  I created a Compliance policy that checks all the nodes for the word "community" and I get nearly 3000 as expected.

    I was also not understanding how search works completely. 

    The wording on your NCM search page is very misleading… I think it needs to be changed, or better yet, the way your search works needs to be changed.   When it says “Search the last downloaded config from each Node only”, what it really means is “Search the last downloaded config for each type of config”.  

    Ie:  If I do a search and there is a “startup config” from 1/1/2014 and 50 more recent “running configs” from dates ranging from 1/2/2014 to 9/5/2014, your search will search the last startup-config from 1/1/2014 and the last running-config from 9/5/2014 and return results from both if it gets a match.   In general, I don’t think many network admins would want these results, the “startup-config” is stale, there have been multiple running-configs more recent for that device, it should NOT be included in results based on the wording given below.  I only want to see results from the “last downloaded Config for each node” as it states.  Now if I want to search the last startup’s, it’s nice having that option too, but not by default when the "Search the last downloaded config from each Node only" is set.



  • For those interested in this issue, it was confirmed in a tech support case that this is indeed a problem.  When you search your configs you get incomplete results if there are a high number of matches.

    There is now a voting topic on this, per solarwinds request, to get this issue fixed.

    https://thwack.solarwinds.com/ideas/4431