I have read through the forums for information on this issue, but nothing seems to quite fit. I have systems that are showing up and disappearing on their own in my 2017.3 console. When I look, they do show up in errorscan, but the previous admin tells me just to delete them and the systems will catch up later on. This does not seem to be the case since I can install the agent on a system and it shows up, then I can run a scan and it disappears. The details of this process are varied, but it happens to many machines several times a day. From what I have read on error scans, the systems will stay in inventory until their days to keep value has been exceeded. Mine is set to 30 days, yet I can see systems show up and disappear several times a day, so that does not seem to apply. Am I wrong in that error scans are produced and not processed when either the server or the database cannot process them in time? If that is the case, how do I go about determining which one? Are there other causes I should look at? Assistance is appreciated.
The scans sit in the LDSCAN folder until they are processed so there is no timeout for this. Errorscan is where scan files end up that are not accepted due to the delta date being wrong or some of the data cant be inserted into the DB. If the scan file is in ERRORSCAN then its contents will not be shown in the console. 10 simple checks to Troubleshoot Inventory - Devices not updating, Duplicated or Missing Scans
If you device is appearing in the console then the scan has been processed. The only 2 process that deletes computer automatically is the days to keep value you have set to 30 and this only happens at 11pm by default during maintenance and a possible Data Analytics rule that is archiving PC's to asset control. Are you licensed for Data Analytics? Can you see icons for this like the screenshot attached?
Yes, I do have data translation services available. I've been following rabbit trails on this all morning, from the ldappl3.ini file to the few 4100 errors in my event log. I have gotten 34 error scans in the last two hours, and that does not correlate with my event log, so that may be a dead end. I'll refrain from posting too much of my digging since I do not know what is relevant and I don't want to muddy the waters. It also seems like machines disappearing may have been inaccurate. People on my team have said they disappear, but I have only witnessed them not showing up, and it appears to only be virtual machines which do get reused and that is what led me to think they were getting blacklisted as duplicates. My understanding of this process is that eventually new IDs would be generated, though.
That is correct -- if people "re-use" the same VM's, we'll usually EITHER:
- Give them the old device ID, if we can match them & the option is enabled (see -- Explanation of how to use the "Devices" and "Duplicate ID's" option for Inventory,and how they work. )
- Blacklist a "known duplicate" device ID, and eventually the device will be told to generate a new ID (this can take up to 3 "contacts" and MAY scupper up scopes, depending on how they were set up).
- It's usually down to common mistakes (in the "oops, I didn't know" sense) that people make by including the EPM agent as part of the image on the VM without stripping out the unique ID's before using it as a template. Nothing that can't be fixed, but it tends to cause a bit of an issue like you're seeing more often than not.
- If in doubt, you can talk to support (assuming you have a support agreement) -- if you explain to them how things work on your side, and what you're seeing, they can give you pointers where to look / what to look for that's specific to your situation (it depends on how deep we'll need to dive here on community, and at some point things may become "a bit too private" to air on a public forum).
Chances are it's something pretty easy to fix, once it's found / figured out what logic "trap" it is that you ran afoul of, as it were.
Hope that helps a bit.