we are facing a problem with autodiscovery in network segments, because occasionally there are responses to ping probes that do not come from existing hosts (we checked for MAC spoofing).
We already had this problem last winter/spring, but it disappeared completely and reappeared after moving to new networks. We do not have direct access to the Cisco infrastructure handling the networks, only via internal support.
All affected hosts have the following characteristics in common:
The responses originate from seemingly unused IP addresses
ARP shows “incomplete”
I am missing an option to only create new hosts if they also have a corresponding DNS entry.
Related to that: whenever I log into the web GUI, I have to accept all changes, including the “Martians” / automatically discovered hosts due to bogons (?). This is done via the automation user. I have not found any option to dismiss changes, which seems odd. As a result, I first have to accept these invalid entries and then remove them afterwards.
Any hints on how to improve or avoid this situation on the monitoring side would be appreciated.
Best regards,
Benjamin
(disclosure: proof read by AI with minor rephrasing not exceeding word pairs)
It think I was to optimistic. I don’t see how explicitly selecting a host really fixes that – I thought I could define a match on the host name, but apart from explicitly hosts there are only tags and labels?
Currently I would hope that the custom host check command is also called during autodiscovery (“Setup > Hosts > Host monitoring rules > Host check command”) and there isn’t separate, inaccessible logic?
In the Explicit Hosts name field you can also enter a regular expression when prefixing it with a tilde.
Read the inline help text available through the menu for more info.
Ok, I thought I wasn’t understanding the inline help (thanks for that. I only knew the tool tips and forgot about the toggle in the help menu). Then I did a search after banging my head against “invalid host name” today. … Werk #18300: Rulesets: Accept valid regex patterns in explicit host conditionscaugh … I guess I’ll wait for a few days and 2.4.0p27
After an update to 2.4.0p27 today, the match via “~1” + negation is working as intended (we do not have host names starting with 1).
Thank you very much!
Joking aside: that’s perfect, thanks!