When 2 + 2 makes 5

Summary: Learn about connected servers in the OMS dashboard.

If you have recently looked at our Operations Management Suite of cloud-based datacenter management tools, you may have seen something that surprised you.

If you look at the Settings dashboard in the OMS portal, you can select to view the connected sources, and you’ll see a list of the number of Servers that you have connected to your OMS workspace.

Although it isn’t underlined, # SERVERS CONNECTED is also a hyperlink, but that’s not the surprising bit. Instead, you may get a surprise when you click the link and find that you don’t have many computers connected after all.

So what is going on? Why don’t these two views add up?

The answer lies in what they are querying and how the agents were added to the workspace.

The Log Search query in full is …

MG:"00000000-0000-0000-0000-000000000001" | Measure Max(TimeGenerated) as LastData by Computer | top 500000 | Sort Computer

…which groups the data by the computer name property.

The # SERVERS CONNECTED groups the data by the computer ID property, that is, what you would see in the following Log Search.

* | measure count() by SourceComputerId

These values will often be the same, as when you install an OMS agent and add that computer to a workspace. A unique GUID is assigned to that computer and is used to associate all data sent by that computer. When you read that computer to the workspace after you remove and reinstall an agent, the computer will get a new GUID.  As a result, the # SERVERS CONNECTED display will now count that computer twice because it is looking for unique GUIDs and not just the computer name.

So, if you had two computers in your OMS workspace and then added two more, you could get 5 if you reinstalled the agent on one of them. These numbers will equalize again eventually after the older data for the # SERVERS CONNECTED is removed. (How long this takes depends on your account subscription and whether it is Free, Standard, or Premium).

It is also possible that when grouping the data by the computer property, some collected data stores the NetBIOS name in the Computer field, and some other data type stores the fully qualified domain name (FQDN). Each of these will show up in the query as a different computer.

Finally the other way that you will see this discrepancy is if the Computer property has been updated in different entries by using different cases, that is, COMPUTER1 versus computer1.

Because Log Search is case sensitive, these will show up as two different computers.

If you would like to see us work on changing the case sensitivity behavior for the computer field, please do vote up this user voice entry here.

A better way to see how many agents you have attached to your workspace is to use the Agent Health assessment. It will provide a much more detailed breakdown of your connected agents, their versions, their responsiveness, etc.

 

So, if you haven’t added this yet, go take a look now. I am sure you will like what you see there.

I hope that clears things up in case you were wondering if we could count properly. We can, although we may not be counting what you think we’re counting.

Brian McDermott
Senior Escalation Engineer