I'm currently using SolarWinds Server & Application Monitor (SAM) to keep an eye on our servers in both our internal network and the DMZ where we host some public-facing servers. The internal network monitoring is seamless, but I'm facing intermittent WMI failures when accessing servers in the DMZ.
A few things I've noticed:
* Network Sonar Discovery sometimes fails to discover certain servers via WMI, defaulting to just ICMP for those servers. When I retry the discovery, I see a different pattern of successes and failures, and there's no clear reason why certain servers succeed when others don't.
* I've noticed that disk space alerts trigger unpredictably; they report "0 free space" or "0 volume size" because data retrieval fails intermittently. It seems I only get a resolution email when WMI starts functioning again and is able to report actual values.
I've reached out to support, and it's escalated to the engineering team. In the meantime, I'm looking for some insight on how to diagnose these inconsistencies. Could this be due to WMI timeouts? What are some strategies for troubleshooting this issue? Also, I've monitored the discovery traffic through the firewall between the internal and DMZ networks, observing various TCP instances with both 'aged-out' and 'tcp-fin' states, which seems unusual for TCP traffic. Any help would be appreciated!
3 Answers
Honestly, using WMI in a DMZ can be a pain. Have you thought about switching to the SolarWinds Agent? It only requires opening one TCP port, and it could save you a lot of headaches. WMI polling isn't the best fit for DMZ environments anyway. Just a suggestion!
It sounds like you might be running into WMI port exhaustion. Have you checked for any latency or bandwidth issues between your SolarWinds server and the DMZ? Sometimes, firewalls can get overloaded, causing timeouts and failures. Also, this article might help: [link].
Just a heads-up: I've seen similar access issues in the logs. Some devices are reporting 'Access Denied' for the WMI polls. Make sure that the accounts you are using have the necessary permissions, and verify there aren’t any firewall rules blocking WMI traffic. Double-check the credentials used for WMI access too!
I get that, but I generally prefer agentless setups unless absolutely necessary. WMI has been working fine for us until recently when these inconsistencies started cropping up. I'm trying to figure out what's changed.