Ensign Ensign

Unknown agent ID and IP address

Hello all.

We're using HPOMW 9 to monitor many Windows, Unix, and Linux servers.

The policy “VP_SM-Server_EventLogEntries(11.0)  (forwards all entries with source HPOV-MS)” recently started generating the following odd event on a daily basis.

EventID: 0x00000400 (1024) - (MS526) Incoming address change information was not processed on server.
No managed node having an AgentId '87ce81e2-6502-7569-18ed-f37967b1c7e4' was found.
The change information contains the following IP address(es):

Below is the name associated with the IP address listed in the event.

# nslookup
Trying DNS
Name:    180-199-1-10.nagoya1.commufa.jp

We do not recognize that FQDN.

Our DNS server forwards that out to the Internet for a response but we have no idea how that IP address got tied to an OMW agent ID.

Did a quick google search on that domain name and found “nagoya1.commufa.jp is an IP address owned by Commufa and located in Nagoya, Japan”.

Our organization has nothing to do with that company or domain.

We used wbemtest and connected to root\hewlettpackard\openview\data namespace and executed the following query:

select * from ov_managednode where agentid = '87ce81e2-6502-7569-18ed-f37967b1c7e4'

Unfortunately, nothing was found.

Does anyone know how we could go about stopping this event?

How could we find what node used the agent ID referenced in the event?

Any help from the experts out there would really be appreciated.

Thanks in advance.


2 Replies

Hello Tom,

I hope you’re having a great day,

Could you please check if the fqdn and the coreID are the same in the ovconfget of the node with the issue? Also please check in the proprieties of the node have the same coreID and FQDN in the advanced settings in the tree node on the OMW console.

Any questions or doubts please let me know.

Best Regards

Ensign Ensign

Hello Adolfo.
As mentioned in my original post, we don't know which node that agent ID (and IP address) is associated with so we can't run ovconfget or check its properties.

That event is being generated by the “VP_SM-Server_EventLogEntries(11.0)  (forwards all entries with source HPOV-MS)” policy running on the HPOMW 9 management server.

We're guessing the agent was removed from a node but not cleanly removed from the management server or vice versa.

We need a way to determine what node used the agent ID referenced in that event.

As noted in the original post, we could not find it by executing wbemtest and checking the root\hewlettpackard\openview\data namespace.


The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.