Host Interfaces Being Overwritten in Host Config When > 1 NIC Present

[sj200449]

Hi,

I have some strange behaviour I don't understand. When I have a Host with 2 NICs and associated DNS entries my simple Discover using ICMP Ping finds the host as 2 devices - sort of what I expect. The Discover Action is to add the host to discovered hosts group if it is found as a result of that rule AND Up. So far so good.

However, if I edit the default host device to add a secondary interface (also of type Agent), ensure the interface on the network I want to be the main one is marked as default and then once that is done remove the secondary host device discovered - hoping it won't refind it and add it again - after a while the default interface on the main host is overwritten with the secondary interface resulting in 2 matching interaces on it and loss of contact with agent

Is this normal and what am I not understanding or do people normally just tolerate having 2 host devices when a server has 2 (or more) NICs?

It seems to happen whether I use IP or DNS to configure the host device.

Sorry about the complex verbosity , hopefully I have explained this enough. It is all Zabbix 7.4.8

[irontmp]

Hi,

I have some strange behaviour I don't understand. When I have a Host with 2 NICs and associated DNS entries my simple Discover using ICMP Ping finds the host as 2 devices - sort of what I expect. The Discover Action is to add the host to discovered hosts group if it is found as a result of that rule AND Up. So far so good.

However, if I edit the default host device to add a secondary interface (also of type Agent), ensure the interface on the network I want to be the main one is marked as default and then once that is done remove the secondary host device discovered - hoping it won't refind it and add it again - cowgirl shirts for women after a while the default interface on the main host is overwritten with the secondary interface resulting in 2 matching interfaces on it and loss of contact with agent

Is this normal and what am I not understanding or do people normally just tolerate having 2 host devices when a server has 2 (or more) NICs?

It seems to happen whether I use IP or DNS to configure the host device.

Sorry about the complex verbosity , hopefully I have explained this enough. It is all Zabbix 7.4.8

Yes, this is expected in Zabbix. ICMP discovery treats each IP/NIC as a separate interface and will keep re-applying discovery results on every run. That’s why it can overwrite your manually set default interface and duplicate or swap interfaces when multiple NICs exist. Common practice is to either accept separate hosts per interface or avoid ICMP discovery for multi-NIC servers and use agent-based auto-registration or stricter discovery filters instead.

[cyber]

I still don't get why to use Discovery for agents... There is autoregistration and you could specify HostInterface in agent contig...

[sj200449]

Hi,

It is more there to catch host devices that appear on the network we didn't put there on purpose or have forgotten to place in zabbix (deploy is not automated completely with us). More so for the forgotten bit as Radius checks shouold prevent unauthorised devices really.

Regards,
Stephen.

[cyber]

Ranjdom thought... Install agent with ListenIP specified, so it will only use one of those IP-s. And instead of ping maybe use agent check, making sure, it is a host with an agent, before you add it...

[sj200449]

Hi,

That's an interesting idea. I'm beginning to question though , do sysadmins now tend to not run Discovery other than to initially populate a new Zabbix installation? We also have lots of different groups that can create machines within a specific VLAN, even if it's for testing for a few days, then destroy them for example, so no Radius checks down to MAC level... I need to chew this over a bit more and chat to colleagues, maybe we don't even want to monitor those depending on whaat we think monitoring is "for".

Thanks for thoughts.

-Stephen.

[cyber]

We never use Discovery for agents. Every deployed host comes with agent installed, it has proper config based on environment (prod/non-prod) and platform type (win/linux) and connects to correct proxy, gets autoregistered adnreceives baseline tempalte (cpu/mem/disk etc). When host is decommissioned, decomm workflow also removes host from Zabbix. Zero manual work.

[sj200449]

A situation I dream of Alas 'not my cat'

[irontmp]

Hi,

I have some strange behaviour I don't understand. When I have a Host with 2 NICs and associated DNS entries my simple Discover using ICMP Ping finds the host as 2 devices - sort of what I expect. The Discover Action is to add the host to discovered hosts group if it is found as a result of that rule AND Up. So far so good.

However, if I edit the default host device to add a secondary interface (also of type Agent), ensure the interface on the network I want to be the main one is marked as default and then once that is done remove the secondary host device discovered - hoping it won't refind it and add it again - cowgirl shirts for women after a while the default interface on the main host is overwritten with the secondary interface resulting in 2 matching interfaces on it and loss of contact with agent

Is this normal and what am I not understanding or do people normally just tolerate having 2 host devices when a server has 2 (or more) NICs?

It seems to happen whether I use IP or DNS to configure the host device.

Sorry about the complex verbosity , hopefully I have explained this enough. It is all Zabbix 7.4.8

Yes, this is expected in Zabbix. ICMP discovery treats each IP/NIC as a separate interface and will keep re-applying discovery results on every run. That’s why it can overwrite your manually set default interface and duplicate or swap interfaces when multiple NICs exist. Common practice is to either accept separate hosts per interface or avoid ICMP discovery for multi-NIC servers and use agent-based auto-registration or stricter discovery filters instead.

[sj200449]

Pretty clear answer - although I'm not sure I ever mentioned 'cowgirl shirts for women'.