LabTech Support Forums

LT - System MAC Address Changed

This forum is for discussion of monitor related issues.

Moderator: jware.connectwise

LT - System MAC Address Changed

Postby timothy.garner-it » Mon May 07, 2012 12:46 pm

We are having some issues with this one.
Laptops of course are going to alert with this monitor (wired and wireless NIC cards).
I don't want to exclude laptops from this monitor because it has potential (It is a good monitor).

I would like to see if we could come up with a way to document both MAC addresses for laptops so that this monitor does not alert for known MAC address and only alerts on newly found MAC addresses.

Does anyone else have feedback for this monitor "LT - System MAC Address Changed"?
Thank You,
Timothy Garner
User avatar
timothy.garner-it
Full Member
Full Member
 
Posts: 106
Joined: Wed Aug 24, 2011 12:05 pm

Re: LT - System MAC Address Changed

Postby ian.integra-xp » Thu May 17, 2012 7:14 am

I've just disabled it. We have a client with some 150 laptops. They work offsite constantly and use ethernet, wifi and 3G usb modems. Every day almost every single one was generating an alert - totally unmanageable.

While its kind of interesting, I'm not sure of the utility. The only things its going to detect are

- Someone manually setting the MAC on their driver
- Someone changing the NIC

The first might be interesting. I'd say 95%+ of IT people don't know this is possible and don't understand the implications.
The second gets picked up by the hardware changes monitor.

so, whats it for really? If its to work, it needs to be more sophisticated in any case.

Ian
-- Ian Murphy
ian.integra-xp
Hero Member
Hero Member
 
Posts: 571
Joined: Tue Nov 15, 2011 12:29 pm

Re: LT - System MAC Address Changed

Postby ismanager.infotechmsp » Thu Jul 19, 2012 7:01 pm

Timothy, You mentioned that this monitor has potential for Laptops. Would you mind elaborating?

I would have to agree with Ian. I am not seeing the value of this Monitor OTHER THAN what is stated in the alert Message.

"Please ensure that this machine was not cloned with an agent already installed on it. If you find that you have 2 or more machines that are now reporting in with the same ID then follow this procedure to correct the issue."

There is NO online documentation that I could find for this monitor as well.

Granted we do quite a bit of imaging and it is in our checklist to address imagining issues (Machine Name, SQL Desktop, other Machine Specific Settings, etc and includes LabTech).

Outside that single issue (notifying that a Tech screwed up who did not follow directions) I am to the point of disabling the monitor as well. Just too noisy for percieved little value.

Does someone see something I do not.

Daryl
ismanager.infotechmsp
Newbie
Newbie
 
Posts: 30
Joined: Mon Jun 04, 2012 12:05 pm

Re: LT - System MAC Address Changed

Postby ismanager.infotechmsp » Sat Sep 15, 2012 3:32 am

I have found a couple ways to have this Monitor NOT execute for Laptops; as opposed to just deleting it altogether.

1. Change the Group the Monitor is assigned to. By default Ignite assigns this Monitor to the Group ‘Service Plans’. One could remove the Monitor from this Group and assign it to both the Groups ‘Windows Desktops’ and ‘Windows Servers’. NOTE: We do not currently use LT for Linux nor MACs.

OR

2. Add the text [ and Computers.BiosFlash NOT Like '%Portable%'] to the Configuration Tab Additional Condition. See attached screen shot. Full code below:
Code: Select all
h_computers.olddata Not Like  h_computers.newdata and h_computers.olddata <> '0:0:0:0:0:0' and h_computers.newdata <> '0:0:0:0:0:0' and Computers.BiosFlash NOT Like '%Portable%'

Hope this helps!
Daryl
Attachments
Monitor LT - System MAC Address Changed - Additional Condition.jpg
Screen Shot - Monitor LT - System MAC Address Changed - Additional Condition
(134 KiB) Downloaded 1 time
ismanager.infotechmsp
Newbie
Newbie
 
Posts: 30
Joined: Mon Jun 04, 2012 12:05 pm

Re: LT - System MAC Address Changed

Postby gbelanger.exosource » Tue Sep 18, 2012 12:42 am

Disabled because pretty much useless. Also, workstations sometimes have WIFI adaptors as well.

If you had two cloned system running at the same time (which would be kinda stupid, but it *could* happen) then the same "agent" would be reporting two different MAC at the same time. A more successful "sensor" would look for repeated MAC changes within a short timeframe. Until then, I'll take my chances.
gbelanger.exosource
Newbie
Newbie
 
Posts: 25
Joined: Mon Jun 25, 2012 12:39 am

Re: LT - System MAC Address Changed

Postby jross » Wed Oct 03, 2012 7:52 pm

So the consensus appear to be to delete this monitor?
I have it flagging for Virtual servers and workstations, I had it come up with a bunch of workstations where the Mac hadn't actually changed, but appears to have occurred when the Labtech agent updating.

I edited to only run on Workstations a while ago, but still getting a fair bit of noise out of this one.
jross
Newbie
Newbie
 
Posts: 16
Joined: Tue May 24, 2011 9:39 pm

Re: LT - System MAC Address Changed

Postby jjackson.summitcomp » Fri Jan 25, 2013 12:03 am

We have a ticket created for a System Mac Address Changed on a server for a MAC that certainly does not belong to, nor is associated in any way with the server or site. If the check is to be useful first and foremost it needs to be accurate.
Thanks,
Jeff
jjackson.summitcomp
Newbie
Newbie
 
Posts: 36
Joined: Wed Dec 12, 2012 2:45 pm

Re: LT - System MAC Address Changed

Postby jjackson.summitcomp » Fri Jan 25, 2013 10:31 am

I have to recant my post about Mac addresses changing. The agent did in-fact report a new Mac address along with a few other Hardware changes including BIOS, etc... when we were doing image test restores under a VirtualBox on a different piece of hardware. DOH!!

I guess I'll have to disable the LT Agent prior to bringing Virtual Machines online in the future.
Thanks,
Jeff
jjackson.summitcomp
Newbie
Newbie
 
Posts: 36
Joined: Wed Dec 12, 2012 2:45 pm

Re: LT - System MAC Address Changed

Postby oziaee.cspro » Fri Dec 23, 2016 1:47 am

HI If Just want to edit the configurations to monitor mac address change only for servers. Can you please let me know the query I will use after "And"
oziaee.cspro
Newbie
Newbie
 
Posts: 2
Joined: Fri Dec 16, 2016 11:12 pm

Re: LT - System MAC Address Changed

Postby oziaee.cspro » Fri Dec 23, 2016 2:12 am

I think I got it right... below is the code which worked for me.

REPLACE(h_computers.olddata,'-',':') Not Like h_computers.newdata and h_computers.olddata <> '0:0:0:0:0:0' and h_computers.newdata <> '0:0:0:0:0:0' and Computers.OS Like '%Server%'
oziaee.cspro
Newbie
Newbie
 
Posts: 2
Joined: Fri Dec 16, 2016 11:12 pm


Return to Monitors

Who is online

Users browsing this forum: No registered users and 1 guest