DX Unified Infrastructure Management

We found one of our Windows robots with multiple probes (cdm, dirscan, processes, logmon, ntservices, ntevl) all connecting to port 48017.  Our Windows admin looked at netstat and found it showing all these probes with that port.

The probes seemed to function OK, except I could not open their configs in IM.

We changed the first probe port to 48018 and they all got their own ports, but when we changed it back, they went back to 48017 again.

Anyone ever seen this behavior before?  If the OS allows each probe to believe it has the same port, is UIM OK with that?

Have not seen it before, and yes it does seem like it would be a problem. Best to leave it configured for first port 480018. By design each probe gets its own port.

If interested to see the process, set controller for log level 5 and then restart. The log will show the process of controller checking for the next available port as it starts up each probe and assigns them their own port.

I turned on the logs and found that they initially seem to get assigned ports such as 48009, but then get entries like this:

Mar 28 09:46:27:773 [10704] Controller: RREQUEST: port_register <-10.63.209.30/62439  h=115 d=31
Mar 28 09:46:27:773 [10704] Controller:  head   tout=20 addr=
Mar 28 09:46:27:773 [10704] Controller:  data   name=logmon port=48017
Mar 28 09:46:27:773 [10704] Controller: port_register (logmon) from 10.63.209.30/62439
Mar 28 09:46:27:773 [10704] Controller: portRegister - name=logmon, port=48017, ip=10.63.209.30, pid=0
Mar 28 09:46:27:773 [10704] Controller: FindNamePid logmon - 0
Mar 28 09:46:27:773 [10704] Controller: reserve_port (logmon) - updated from 48009 to 48017
Mar 28 09:46:27:773 [10704] Controller: SREPLY: status = 0(OK) ->10.63.209.30/62439
Mar 28 09:46:27:773 [10704] Controller:  head   mtype=200 status=0 seq=0
Mar 28 09:46:27:773 [10704] Controller: RREQUEST: _close <-10.63.209.30/62439  h=107 d=0
Mar 28 09:46:27:773 [10704] Controller: sockClose:0000000000A95020:10.63.209.30/48000

It sounds like you might have the robot in proxy mode ?

that will cause all probes to use the same port.

Certainly not on purpose    How do I check that?

check the robot.cfg for the following

proxy_mode = 1

if that is there set it to 0 and restart the robot.

proxy_mode does not exist in our config file, nor does the word proxy exist in our level 5 log file.

you will need to open a support case to have them look at the robot.cfg controller.cfg and your controller.log files to see what might be going on here.

Probably best to provide an output from netstat both with the robot stopped and with the probe running showing the issue.

I usually use netstat -ano.

ok, thanks