bug(ui): agents showing sysmon collections incorrectly #662

New issue

Closed

opened 2026-03-28 04:27:10 +00:00 by mfreeman451 · 0 comments

mfreeman451 commented

2026-03-28 04:27:10 +00:00

Owner

Imported from GitHub.

Original GitHub issue: #2036
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/issues/2036
Original created: 2025-11-30T22:03:15Z

checkers shouldn't show up as devices unless we are actually receiving metrics/collections from the host that the actual checker/collector is running on.

Currently we're turning service checks from agent/pollers into devices for sysmon, we have several devices in the device inventory UI that shouldn't be there:

{
  "_first_seen": "2025-11-30T03:56:19Z",
  "canonical_device_id": "sr:70c5563c-592f-458a-ab46-cb635fb01e3d",
  "canonical_hostname": "agent",
  "checker_host_id": "Mac.localdomain",
  "checker_host_ip": "172.18.0.5",
  "checker_service": "sysmon-vm",
  "checker_service_id": "sysmon-vm",
  "checker_service_type": "grpc",
  "collector_agent_id": "docker-agent",
  "collector_poller_id": "docker-poller",
  "last_update": "2025-11-30T08:40:36Z",
  "source": "checker"
}

{
  "_first_seen": "2025-11-30T03:56:19Z",
  "canonical_device_id": "sr:70c5563c-592f-458a-ab46-cb635fb01e3d",
  "canonical_hostname": "agent",
  "checker_host_id": "Mac.localdomain",
  "checker_host_ip": "172.18.0.5",
  "checker_service": "sysmon-vm",
  "checker_service_id": "sysmon-vm",
  "checker_service_type": "grpc",
  "collector_agent_id": "docker-agent",
  "collector_poller_id": "docker-poller",
  "last_update": "2025-11-30T08:40:36Z",
  "source": "checker"
}

The actual sysmon-vm is running on 192.168.1.218, and we correctly see a record in the device inventory for that:

{
  "_first_seen": "2025-11-30T16:55:34Z",
  "canonical_device_id": "sr:88239dc2-7208-4c24-a396-3f868c2c9419",
  "canonical_hostname": "192.168.1.218",
  "checker_host_id": "Mac.localdomain",
  "checker_host_ip": "192.168.1.218",
  "checker_service": "sysmon-vm",
  "checker_service_id": "sysmon-vm",
  "checker_service_type": "grpc",
  "collector_agent_id": "docker-agent",
  "collector_poller_id": "docker-poller",
  "last_update": "2025-11-30T21:58:16Z",
  "source": "checker"
}

those other two devices are likely from the agent or poller where it is running in a docker container and using an ephemeral IP, and then it is polling the actual sysmon-vm agent running on 192.168.1.218 over gRPC

the desired behavior we're looking for would apply to any external checker/agent/collector, like SNMP metrics, netflow, etc. Agents and pollers should show up as devices, but if we have say trapd configured, the system that is actually running trapd, should show up as a device. For SNMP metrics, if we have the agent and poller configured to collect SNMP metrics from 192.168.1.1 , that should get created as a new device.

Imported from GitHub. Original GitHub issue: #2036 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/issues/2036 Original created: 2025-11-30T22:03:15Z --- checkers shouldn't show up as devices unless we are actually receiving metrics/collections from the host that the actual checker/collector is running on. Currently we're turning service checks from agent/pollers into devices for sysmon, we have several devices in the device inventory UI that shouldn't be there: ``` { "_first_seen": "2025-11-30T03:56:19Z", "canonical_device_id": "sr:70c5563c-592f-458a-ab46-cb635fb01e3d", "canonical_hostname": "agent", "checker_host_id": "Mac.localdomain", "checker_host_ip": "172.18.0.5", "checker_service": "sysmon-vm", "checker_service_id": "sysmon-vm", "checker_service_type": "grpc", "collector_agent_id": "docker-agent", "collector_poller_id": "docker-poller", "last_update": "2025-11-30T08:40:36Z", "source": "checker" } ``` ``` { "_first_seen": "2025-11-30T03:56:19Z", "canonical_device_id": "sr:70c5563c-592f-458a-ab46-cb635fb01e3d", "canonical_hostname": "agent", "checker_host_id": "Mac.localdomain", "checker_host_ip": "172.18.0.5", "checker_service": "sysmon-vm", "checker_service_id": "sysmon-vm", "checker_service_type": "grpc", "collector_agent_id": "docker-agent", "collector_poller_id": "docker-poller", "last_update": "2025-11-30T08:40:36Z", "source": "checker" } ``` The actual sysmon-vm is running on `192.168.1.218`, and we correctly see a record in the device inventory for that: ``` { "_first_seen": "2025-11-30T16:55:34Z", "canonical_device_id": "sr:88239dc2-7208-4c24-a396-3f868c2c9419", "canonical_hostname": "192.168.1.218", "checker_host_id": "Mac.localdomain", "checker_host_ip": "192.168.1.218", "checker_service": "sysmon-vm", "checker_service_id": "sysmon-vm", "checker_service_type": "grpc", "collector_agent_id": "docker-agent", "collector_poller_id": "docker-poller", "last_update": "2025-11-30T21:58:16Z", "source": "checker" } ``` those other two devices are likely from the agent or poller where it is running in a docker container and using an ephemeral IP, and then it is polling the actual sysmon-vm agent running on 192.168.1.218 over gRPC the desired behavior we're looking for would apply to any external checker/agent/collector, like SNMP metrics, netflow, etc. Agents and pollers should show up as devices, but if we have say trapd configured, the system that is actually running trapd, should show up as a device. For SNMP metrics, if we have the agent and poller configured to collect SNMP metrics from 192.168.1.1 , that should get created as a new device.