NetXMS Support Forum

Hi,

Yes, both are own by us. Still the same team behind the project, and the same company to fund it. At some point we merged .org with .com (well, it was redirected), now we decided that it's better to keep OSS and EE parts on separate domains for various reasons.

.org (.com too, but that's another story) is in a bit of a mess at the moment, I'm cleaning it up. But we decided that it's better to do something than just trying to improve indefinitely. Downloads and repos are the same.

Regarding netflow - we decided against custom implementation, instead we integrated with ntopng.

I recently noticed I have been going to Netxms.org and not Netxms.com during the autocomplete on my browser. Both sites are completely different with different versions being displayed and .org showing support for netflow/sflow in the feature list. I assume .org is owned by Netxms as well ?

Thank you very much for your quick reply. Our use case is: based on historical IP addresses (for example, IPs logged when users access critical systems), we want to look up the MAC address associated with that IP at that point in time, so we can identify the specific endpoint. We look forward to this new feature. Many thanks!

Hi,

MAC address is stored - it's the MAC Address column on your second screenshot. What is empty there is IP address.

Connection history is built from switch forwarding tables, so it always knows MAC, and takes IP from the node this MAC belongs to. 10.61.67.118 is not a node in NetXMS (Node and Interface columns are empty in the search result), so there is nothing to take it from. IP address search finds the pair differently, by reading ARP caches.

Resolving IP from ARP for hosts which are not nodes is not implemented, I've created feature request: https://github.com/netxms/netxms/issues/3760

If these hosts are added as nodes, new history records will probably have both IP and node filled.

Hi team,

In "IP/mac address search", we can get the full mapping of IP address, MAC address and switch port.
However, connection history log only stores IP and switch port, without the corresponding MAC address at that time.

Could you please improve this feature? We hope real-time search and history records can be consistent, storing and displaying complete client information for network forensics.

Thanks a lot!

Автоматически — нет. У сервера есть проверка собственной связи (Beacon.Hosts), но к потере связи она привязывает только SYS_NODE_DOWN. SYS_NODE_UNREACHABLE от нод через тоннель и за прокси, а также SYS_NODE_UP и ваши icmp ok не коррелируются. На это завёл тикет: https://github.com/netxms/netxms/issues/3753

Настройками шквал "Node up" убирается так:

• В Server Configuration задать Beacon.Hosts — два-три внешних адреса через запятую (не шлюз локальной сети, он при пропаже интернета продолжит отвечать) — и перезапустить сервер. При потере связи со всеми адресами сервер генерирует SYS_NETWORK_CONN_LOST, при восстановлении — SYS_NETWORK_CONN_RESTORED; стандартные правила держат на это время аларм с ключом NET_CONN_LOST.
• Добавить правило на SYS_NETWORK_CONN_RESTORED, выше стандартного "Terminate NetXMS server network connection loss alarm when connection restored": действие DoNothing, Delayed by 15m, timer key UPLINK_RECOVERY.
• Из правил 26, 32 и 34 вынести Normal MailAlarm (вместе с его "Do not run if timer ... is active") в отдельное правило, стоящее непосредственно перед исходным: те же source и event, флаг "Accept correlated events" как у исходного, "Stop event processing" не включать. В исходном остаются Terminate alarms, DoNothing и Cancel timers.
• В каждом из трёх новых правил — filtering script:
  
  Code Select Expand
  return FindAlarmByKey("NET_CONN_LOST") == null && CountScheduledTasksByKey("UPLINK_RECOVERY") == 0;

Отдельное правило нужно потому, что скрипт в фильтре исходного правила отключил бы вместе с письмом и закрытие аларма, и отмену таймеров.

Note: в течение 15 минут после восстановления связи письма "Node up" и "icmp ok" не отправляются вообще, в том числе от нод, которые в это время действительно поднялись. Алармы при этом закрываются как обычно.

Hi,

This is a bug on server side, not your configuration - I've created a ticket: https://github.com/netxms/netxms/issues/3752

That get-request is SNMPv3 engine ID discovery, which means QNAP sends informs rather than traps - for informs sender first has to ask the receiver for its engine ID. Since 6.1 server checks credentials of every packet coming to the trap port before it looks what kind of packet it is. Discovery request has empty user name by design, so it's rejected as "USM user name does not match" and never answered. Your other devices send plain v3 traps, which don't need discovery.

Until it's fixed, turn credential check off for this node only: add custom attribute SysConfig:SNMP.Traps.ValidateCredentials with value false to the NAS node. No restart needed, but it requires server 6.2.3 or later. I haven't tested this with QNAP.

Note: authenticated v3 messages are still verified with the node's keys, so user name, authentication and encryption in QNAP trap settings should match SNMP credentials of the node (or separate trap credentials on node's SNMP property page).

Hi,

most likely this is not a hang - installer is waiting for database initialization, which runs in separate console window. If initialization fails, that window shows the error and "PRESS ANY KEY TO CONTINUE", and it can end up behind the installer window. With SQLite it usually fails either because folder in "Path to database file" does not exist (file is created automatically, folder is not), or because database file is already there from previous attempt.

Log switch does not change anything here. On second run installer finds existing installation and "Initialize database" is not checked by default, so this step is just skipped - which also means database may still be not initialized. Is NetXMS Core service running and can you log in?

If not, please share what you entered as path to database file and last lines of C:\NetXMS\log\netxmsd.log.

Hi! We just published patch release 6 for version 6.2. Hopefully that will be last patch release before major release 7. Notable changes since previous patch release:

-   Box selection of elements on network maps
-   Configurable size of port boxes in port view dashboard element
-   Pie chart dashboard element can show actual values instead of percentages
-   Status indicator dashboard element uses object or DCI name as label when custom label is not set
-   Object context macros are expanded in dashboard web page element URLs; new macro form %~ URL-encodes expansion result
-   New web API endpoints for posting events and for managing mapping tables, persistent storage, and SNMP traps
-   New NXSL function FindDCIById; FindAllDCIs accepts null as node argument to search across all data collection targets
-   Server console command to recommission decommissioned node; decommissioned nodes can no longer be returned to managed state via NXSL, web API, parent object, or network discovery
-   Scheduled task operations and maintenance mode changes made from scheduled tasks are written to audit log
-   NXSL scripts run from scheduled tasks and AI assistant tools execute with user security context
-   LDAP diagnostic messages from libldap are logged on TLS and bind failures
-   File delivery policy files are hidden by default in server file store views; "Show hidden files" option added
-   Agent: user sessions on Linux are read from systemd-logind, utmp is kept as fallback
-   Agent: processes started in user sessions get environment of session user; external subagent loader no longer deletes master agent policy files at startup
-   Agent: new configuration parameter ExternalSubagentWatchdogExcludedUsers; watchdog skips sessions without logged on user
-   Agent: authentication and encryption requirements enforced for all commands; AI file operation tools restricted to configured root folder and master server
-   Windows server installer ships JSON templates; Windows client installer always runs Visual C++ runtime installer

Full list of closed issues:

-   #805 / NX-594 (Box selection on network maps)
-   #2328 / NX-2120 (Configurable size of boxes in port view on dashboard)
-   #2680 / NX-2474 (Add option to show numeric value instead of % on bar chart)
-   #3649 (Autobind can re-link an object that is being deleted, leaving a dangling child reference in containers and templates)
-   #3651 (Interface Traffic SNMP template auto-applies together with agent template, duplicating traffic DCIs)
-   #3652 (Windows client installer runs vcredist only when the nxshell component is selected)
-   #3653 (DefaultDCIPollingInterval / DefaultDCIRetentionTime descriptions still say "for newly created DCI")
-   #3654 (Changing DataCollection.DefaultDCIPollingInterval does not resync agent cache mode DCIs)
-   #3655 (nxdbmgr -C on MS SQL creates user without rights to create tables)
-   #3656 (Windows agent: process enumeration skips last entry, Process.Count returns 0 for newest process)
-   #3662 (Unsynchronized read of DelegateObject object set (possible use-after-free))
-   #3665 (NXSL scripts run from scheduled tasks and AI assistant tools have no user security context)
-   #3666 (NXSL function SQLQuery leaks database connection on every call)
-   #3668 (missing label for dci in Status indicator)
-   #3669 (Feature Request: Expand Object Context Macros in Dashboard Web Page Elements)
-   #3670 (No size check on agent certificate mapping data, node save fails with 'value too long for type character varying(500)')
-   #3672 (Agent certificate mapping by public key overflows varchar(500) and breaks node persistence)
-   #3674 (Linux agent reports no user sessions on hosts without utmp (Debian 13, systemd 257))
-   #3675 (Agent: CMD_AI_EXECUTE_TOOL and CMD_AI_GET_TOOLS have no server class check and aifileops has no path restriction)
-   #3676 (Agent: RequireAuthentication / RequireEncryption not enforced for commands handled in receiver thread)
-   #3678 (Server crashes on login when group membership search path exceeds 256 entries)
-   #3680 (LDAP: log libldap diagnostic message on TLS/bind failures)
-   #3681 (Auto-link nodes on custom maps does nothing since 6.2.0)
-   #3682 (Threshold events generated on maintenance leave are correlated to the maintenance event and skipped by EPP)
-   #3683 (PostgreSQL driver: failed unbuffered SELECT leaves the connection busy, next unbuffered query fails with "PQsendQuery failed")
-   #3685 (v5migrate status: "Active workers" counts queued + running objects, "Pending objects" is a stale batch snapshot)
-   #3686 (V5 data migration worker holds a pooled DB connection for the whole object, including while paused or throttled)
-   #3687 (Config parameter Objects.Nodes.DefaultDecommissionExpirationTime is missing on fresh installs and is never readable by the client)
-   #3688 (NXSL NetObj::manage() bypasses the decommission guard, leaving a node that looks managed but is still scheduled for deletion)
-   #3689 (Add server console command to recommission a decommissioned node)
-   #3690 (SNMP GET: noSuchObject/noSuchInstance returned as empty value instead of unsupported (regression since 6.0.0))
-   #3691 (Zone deletion removes credential tables by object ID instead of zone UIN, leaves ssh_credentials)
-   #3692 (Object deletion leaves rows in dashboard_associations, object_ai_data, port_stop_list, cluster_resources, radios, dci_delete_list)
-   #3694 (DCTable deletion skips dct_threshold_instances; DCI deletion never cleans cond_dci_map)
-   #3695 (Discovery re-manages unmanaged node via Node::changeIPAddress() (sets status directly, bypassing setMgmtStatus))
-   #3696 (nxdbmgr upgrade 61.35->61.36 fails on PostgreSQL: GetDataCollectionTargets() selects from 7.0-only tables)
-   #3700 (Status poll re-manages individually unmanaged interfaces and network services on network path problem (resetStatus bypasses setMgmtStatus))
-   #3704 (MIB DISPLAY-HINT: multi-octet "d" fields are rendered one octet at a time, and separators are emitted before the field instead of after)
-   #3705 (Decommission with "Clear IP addresses" leaves node in address index: former IP reported as "already in use" until server restart)
-   #3706 (DCI deleted while busy (collection or instance discovery) is never deleted from database)
-   #3707 (Web client: downloads fail silently for file names outside Latin-1 (Content-Disposition not encoded))
-   #3708 (netxmsd crash: CMD_GET_DCI_VALUES on table DCI without last value dereferences null table)
-   #3711 (Scheduled tasks created from client (incl. scheduled maintenance) are not written to audit log)
-   #3712 (SYS_MAC_ADDR_CHANGED: interfaceName parameter missing for pseudo-interface)
-   #3714 (Show hidden files toggle for server file store; hide file delivery policy files by default)
-   #3715 (ProcessExecutor: no bounds check on argv[256] when building child argument list)
-   #3718 (Agent: external subagent loader deletes master agent policy files at startup)
-   #3719 (Agent: option to exclude user accounts from external subagent watchdog)
-   #3720 (Windows server installer does not ship JSON templates)
-   #3721 (MSSQL template has no auto-apply filter)
-   #3722 (null node in FindAllDCIs)
-   #3724 (Agent: external subagent watchdog stops at first session even if nobody is logged on to it)
-   #3725 (NXSL: sometimes 'while' loop compiled incorrectly)
-   #3733 (nxreportd ignores ReportingServer.ResultsRetentionTime (misspelled property name in housekeeper))
-   #3734 (Delayed incident creation from EPP drops description and truncates text at semicolons)
-   #3735 (Isolation forest anomaly detection looks back seconds instead of days (Timestamp unit mismatch in IsAnomalousValue))
-   #3736 (Formatted DCI value has a space between multiplier prefix and unit ("2.31 Gi B"))
-   #3737 (AI anomaly profiles are regenerated every second day: 24 h cooldown equals the daily task period)
-   #3738 (Asset management: unique attribute check rejects writing the asset's own current value)
-   #3739 (Asset management: date attribute validation accepts invalid dates (isValidDate logic inverted))
-   #3740 (Oxidized module: backup timestamps ignore the UTC offset reported by Oxidized)
-   #3741 (LLM provider type openai falls back to Ollama URL and model when URL/Model are omitted)
-   #3742 (AI tasks keep running after their owner's account is disabled)
-   #3743 (netsvc: TLS.Certificate.* option list starts at the StartTLS protocol argument)
-   #3746 (OTLP event forwarder: dropped events are not reflected in forwarder counters and status)
-   #3747 (AI: task prompt lacks opening <instructions> tag; show ai providers reports Mistral as Ollama)
-   #3748 (nxshell samples call removed method getAllChilds())

Hello all,

I'm new here so please be nice

I've just installed a netXMS server on my network (192.168.88.0/24). It works as intended with all nodes in SNMP V3 sending traps.
Now I'm trying to add my QNAP NAS that is on a separated network (192.168.89.0/24).

Using SNMPV1, it works. I received traps.
But if I try to activate SNMP V3, pulling is working, but the traps aren't.
The QNAP is first sending a "get-request" on port UDP 162
Frame 76985: Packet, 123 bytes on wire (984 bits), 123 bytes captured (984 bits) on interface \Device\NPF_{C16F6D7C-17E5-4278-B0F9-851AEB13E1D9}, id 0
Internet Protocol Version 4, Src: 192.168.89.9, Dst: 192.168.88.32
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
    Total Length: 109
    Identification: 0x0f6c (3948)
    010. .... = Flags: 0x2, Don't fragment
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 63
    Protocol: UDP (17)
    Header Checksum: 0xf999 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 192.168.89.9
    Destination Address: 192.168.88.32
    [Stream index: 15]
User Datagram Protocol, Src Port: 40299, Dst Port: 162
    Source Port: 40299
    Destination Port: 162
    Length: 89
    Checksum: 0x8a97 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 2066]
    [Stream Packet Number: 6]
    [Timestamps]
        [Time since first frame: 5.005006100 seconds]
        [Time since previous frame: 1.000912100 seconds]
    UDP payload (81 bytes)
Simple Network Management Protocol
    msgVersion: snmpv3 (3)
    msgGlobalData
        msgID: 1009582008
        msgMaxSize: 65507
        msgFlags: 04
            .... .1.. = Reportable: Set
            .... ..0. = Encrypted: Not set
            .... ...0 = Authenticated: Not set
        msgSecurityModel: USM (3)
    msgAuthoritativeEngineID: <MISSING>
    msgAuthoritativeEngineBoots: 0
    msgAuthoritativeEngineTime: 0
    msgUserName: <MISSING>
    msgAuthenticationParameters: <MISSING>
    msgPrivacyParameters: <MISSING>
    msgData: plaintext (0)
        plaintext
            contextEngineID: 80001f8880b35b0f3ea69ec76a00000000
                1... .... = Engine ID Conformance: RFC3411 (SNMPv3)
                Engine Enterprise ID: net-snmp (8072)
                Engine ID Format: Reserved/Enterprise-specific (128): Net-SNMP Random
                Engine ID Data: b35b0f3e
                Engine ID Data: Creation Time: Oct  8, 2026 15:46:14 Romance Daylight Time
            contextName: <MISSING>
            data: get-request (0)
                get-request
                    request-id: 59606151
                    error-status: noError (0)
                    error-index: 0
                    variable-bindings: 0 items
This get-request is ignored by netXMS
2026.10.08 16:12:27.977 *D* [snmp.trap          ] SNMPTrapReceiver: looking for SNMP security context for node 192.168.89.9 NAS Camera
2026.10.08 16:12:27.977 *D* [snmp.trap          ] SNMPTrapReceiver: received PDU of type 0 from 192.168.89.9
2026.10.08 16:12:27.977 *D* [snmp.trap          ] SNMPTrapReceiver: SNMP credential validation failed for trap from 192.168.89.9, dropping
2026.10.08 16:12:27.977 *D* [obj.macro          ] ExpandText(sourceObject=451 template='SNMP trap from %<sourceIP> rejected: %<reason> (SNMP version %<snmpVersion>)' alarm=0 event=1245 instance='(null)')
2026.10.08 16:12:27.977 *D* [event.corr         ] CorrelateEvent: event SYS_SNMP_TRAP_AUTH_FAILURE id 1245 source NAS Camera [451]
2026.10.08 16:12:27.977 *D* [event.corr         ] CorrelateEvent: finished, rootId=0
2026.10.08 16:12:27.977 *D* [event.proc         ] EVENT SYS_SNMP_TRAP_AUTH_FAILURE [170] at {0} (ID:1245 F:0x0001 S:1 TAGS:"") FROM NAS Camera: SNMP trap from 192.168.89.9 rejected: USM user name does not match (SNMP version 3)
2026.10.08 16:12:27.977 *D* [event.policy       ] EPP: processing event 1245
2026.10.08 16:12:27.977 *D* [event.policy       ] Event 1245 match EPP rule 55
2026.10.08 16:12:27.977 *D* [obj.macro          ] ExpandText(sourceObject=451 template='SNMP_TRAP_AUTH_FAILURE_%i' alarm=0 event=1245 instance='(null)')
2026.10.08 16:12:27.977 *D* [obj.macro          ] ExpandText(sourceObject=451 template='%m' alarm=0 event=1245 instance='(null)')
2026.10.08 16:12:27.977 *D* [obj.macro          ] ExpandText(sourceObject=451 template='' alarm=0 event=1245 instance='(null)')

If you have any idea about what is wrong in here, your help is welcome