Security Compliance

Some agent nodes are duplicated and show as a non-agent node

This article resolves a duplicate node issue.

First published date

10/11/2018 7:43 PM

Last published date

3/15/2025 9:56 AM

Overview

In your SEM console, you see agent nodes that appear to have duplicate non-agent nodes (signified by a L-shaped grey icon) in the Nodes tab.

Product section

Security Event Manager

Cause

  • Usually, instances of one or more agents showing up as a non-agent node (or as both an agent and non-agent node) is due to having multiple network interfaces and/or IP addresses on the same host.
  • Because of the way computers or network devices may send from multiple names/addresses, the SEM will register the node hostname or IP-address that sent the event, and we view these in the Node List.
     
  • Docker based SEM Agent nodes - is due to multiple IP's (including the loopback IP) 127.0.0.1

Resolution

Warning:

  • Consult your System Administrator before performing the following procedure.
  • SolarWinds strongly recommends that you only edit the spop.conf file (or possibly the hosts file) as instructed. Any additional modifications may result in system performance issues or may create an error state.
  • Save a copy of the original spop.conf file (& hosts file) to your local drive as a backup file, in case you need to roll back later.
  • Linux \ AIX path to spop.conf /usr/local/contego/ContegoSPOP/
  • ForcedLocalAddress is the most succesful known method for AIX hosts.

 

​Connect to the affected host and perform the following steps:

  1. Stop the SolarWinds Log and Event Manager Agent service.
  2. Go to C:\Windows\system32\ContegoSPOP (32-bit) or C:\Windows\SysWOW64\ContegoSPOP (64-bit) and locate spop.conf.
  3. Open spop.conf in a text editor (prefer notepad or notepad++, but wordpad will also work).
  4. Add ONE of the following attributes below on a new line.
              [Should one of the following not work, try a different one as outlined in step 7.]
    1. ​To force the agent to use the hostname (as shown by typing hostname in a command prompt):
           [This option is preferable for web servers or computers with unique functionality.]
      UseLocalEnvironmentVariableForLocalHost=true
           [With this option, add the agents IP & hostname as the first line in it's own "hosts" file.]
      (c:\windows\system32\drivers\etc\hosts)
      1. For example: 
        10.1.2.3 server1 server1.t.test
    2. To force the SEM manager to use the hostname that the SEM detects for this host:
      UseManagerDetectionOfLocalHost=true
    3. To force the agent to use the hostname or IP address you specify (but only use one of the following, not both).
          [This option is preferable for laptops that may disconnect abruptly from a network,
           or switch back & forth between wireless and ethernet (hard-wired).]
      ForcedLocalAddress=server1 (use the hostname of the Windows computer itself)
      or
      ForcedLocalAddress=10.10.10.1 (use the primary IP address of the computer itself)
  5. Save and exit.
  6. Start the SolarWinds Log and Event Manager Agent service.
  7. After the agent reconnects, the duplicate node should be removed automatically.
    If it does not remove automatically, manually remove it from the list.
    If the duplicate node comes back, remove the attribute you tried, and try another one of the attributes above.