Submit a ticketCall us

Webinar: Web Help Desk for HR, Facilities and Accounting Departments
This webinar will focus on use cases for HR, Facilities and Accounting.

Having a unified ticketing and asset management system for all the departments in your company can provide end-users with a seamless experience and make things easier for your IT team. Yet, with different business tasks and objectives, many departments don’t fully understand the capabilities of Web Help Desk and how the software can be customized for effective use in their departments.
Register Now.

Home > Success Center > Log & Event Manager (LEM) > Resolve LEM Agent Issues related to InternalUnknownAgent and InternalDuplicateConnection

Resolve LEM Agent Issues related to InternalUnknownAgent and InternalDuplicateConnection

Created by Cory Farr, last modified by Abdul.Aziz on May 17, 2017

Views: 219 Votes: 2 Revisions: 7

Overview

You are receiving InternalUnknownAgent or  InternalDuplicateConnection events under the LEM Internal Events filter. Some or all of these agents will either not appear in the Node List or appear as offline in the Node List under the GUI-console, Manage > Nodes.

Environment

All LEM Versions

Cause

Agents will appear as  InternalDuplicateConnection  because of two possibilities:

1 - agent goes offline and LEM manager does not know. This can happen because of loss of network connectivity or port closure on the agent computer.

2 - agent computer was created by imaging. Imaged computers (with a new hostname) can be using the same certificate issued to the original image. These new imaged computers need the agent certificate cleared and the agent re-started.

 

Agents will appear as  InternalUnknownAgent  because of two possibilities:

1 - agent was removed from the GUI-console, Manage > Nodes, but agent software was never un-installed from the Windows/Linux/Unix computer itself, and it is still trying to connect.

2 - agent was installed without the proper permissions to connect to LEM manager. Be sure agents are installed with the "runas administrator", or because of increased security restrictions on Windows 8.1, 10, 2012-R2, you may need to include "win-7compatibility" mode, or even use the Local Agent Installer instead of the Remote Installer. Windows 2016 agent install currently requires the Remote Agent Installer before the agent will connect to the LEM. Further security restrictions either through GPO's or network firewalls can prevent any agent connection.

Resolution

Generate a list of  InternalDuplicateConnection and InternalUnknownAgent 

- If the LEM Reports application has been installed, run the Agent Maintenance Report for the last day or two, and export in PDF or Excel format.

- If the reports applications has not been installed, the same information can be generated under the GUI-console.

 

Generate a list of Duplicate agents from GUI/Web-console

  1. Use the LEM Web (or Adobe Air) Console to search for InternalDuplicateConnection.
    1. Select Explore > nDepth.
    2. Expand Events in the middle/left column, and search for  InternalDuplicateConnection.
    3. Drag the retrieved event type to the search bar at the top, select the timeframe for 1 day, and start the search.
    4. Expand the Refine Fields section in the top left corner and expand the DetectionIP section to view the hostnames of affected machines.
    5. If needed, export the results in CSV format from the gear on the far right.

 

Generate a list of InternalUnknownAgent from GUI/Web-console

  1. Use the LEM Web (or Adobe Air) Console to search for InternalUnknownAgent.
    1. Select Explore > nDepth.
    2. Expand Events in the middle/left column, and search for InternalUnknownAgent.
    3. Drag the retrieved event type to the search bar at the top, select the timeframe for 1 day, and start the search.
    4. Expand the Refine Fields section in the top left corner and expand the DetectionIP section to view the hostnames of affected machines.
    5. If needed, export the results in CSV format from the gear on the far right

 

Clear the security certificates for agents showing InternalDuplicateConnection

  1. Use the CSV document (spreadsheet list)  showing InternalDuplicateConnection and prepare to clear the certificate and restart the agent.
  2. Connect with each agent individually through Remote Desktop, or using "Windows Explorer" to delete files/folders and "Services.msc" or "SC.exe" command to restart the agent service.
  3. To clear the certificate, delete the 6 files (3- *.xml & 3- *.trigeo) from one of the following directories:
    C:\Windows\SysWOW64\ContegoSPOP\spop\ (64-bit)
    C:\Windows\system32\ContegoSPOP\spop\ (32-bit)
  4. Open the Windows Services menu (services.msc), scroll down the services list to the SolarWinds Log and Event Manager Agent service, and restart it. (or connect remotely using services.msc, or use the "sc" command, ie "sc \\server1 stop contego_spop" & "sc \\server1 start contego_spop" )
  5. The six certificate files will reappear within a couple of minutes, which indicates agent connection is complete.
  6. The agent will appear in the Node List, and remove any disconnected duplicates 'of this agent node' from the list.

(note: if this is a new agent install and minimal data has been received, you can do the following:

  • stop the agent service
  • delete the entire spop sub-folder "C:\Windows\SysWOW64\ContegoSPOP\spop\"
  • start the agent service
  • watch for this agent connection, and remove any disconnected duplicates from the agent list.
- If the node does not appear after several minutes, please contact SolarWinds Technical Support to take a closer look and see if the agent is having other issues.
 

Re-install the agents showing up as InternalUnknownAgent  

  1. Remove the existing agent from Program and Features. (or use the Remote Agent Un-installer, which also deletes the agent directory.)  http://downloads.solarwinds.com/sola...ninstaller.zip
  2. Remove the agent directory (C:\Windows\SysWOW64\ContegoSPOP\ or C:\Windows\system32\ContegoSPOP\ ) if still present.
  3. Remove the agent and any duplicate nodes from the agent Node List in the LEM GUI/Web-console (Manage > Nodes).
  4. If for some odd reason the agent won't un-install, try re-installing over the top, and try another un-install.
  5. Copy either the Local Agent Installer or the Remote Agent Installer from the customer portal.

    http://downloads.solarwinds.com/sola...tInstaller.zip

    http://downloads.solarwinds.com/sola...tInstaller.zip

  6. Copy the agent (remote or local) to the local hard drive in order to perform runas-admin (will not work over a network share).
  7. Right-click to select "runas administrator" for the install on Windows 7, 8, 2008 or 2012
    (If installing on Windows 2012-R2, 8.1, or 10, use only the local installer from the local hard drive, select both "Windows 7" compatibility and runas-administrator.)
    (If installing on Windows 2016, use the Remote Agent Installer from the local hard drive, and select both "Windows 7" compatibility and runas-administrator.)
  8. Configure the connectors for this agent (GUI/Web-console, Manage > Nodes, or place the agent into a Connector Profile, Build > Groups.
  9. Verify (or delete) any duplicates in the agent list.
  10. Open the LEM GUI/Web-console (Explore > nDepth) and perform an nDepth search, selecting Alert-Groups, select AnyAlert, drag the DetectionIP to the top search, enter server1* (hostname). Should see data received into the database.

- If the node does not appear after several minutes, please contact SolarWinds Technical Support to take a closer look and see if the agent is having other issues.

 

Last modified
07:26, 17 May 2017

Tags

Classifications

Public