Last Seen value not updating.

[ChrisParr]

How is the Last Seen value determined?

We have devices which are still live, but which are showing up in the "Device: Not seen in the last 90 days" report. This makes me very reluctant to turn on any of the auto-cleanup options.

If I check the scan errors tab on one of these devices I'm told that SNMP didn't complete, but as the MAC and IP addresses hasn't changed, it still responds to HTTPS etc. I'd have still expected the Last Seen value to update.

[Esben_D]

Well last tried is simply when the asset was last scan was attempted. But this value isn't always displayed on an asset summary page (only when a scan failed).

It all really depends on your definition of not seen. For Lansweeper not seen means no connectivity whatsoever, if asset even responds to a ping, that means it's still active somewhere.

[JacobH]

Yeah, it's confusing, but Last Tried is just as important for my reporting as Last Seen... *especially with Active Scanning.

Active Scanning attempts to scan anything that authenticates to a domain controller - regardless of if it is a windows machine or not. Example, if you have ESX hosts that are joined to AD, it will scan those with active scanning too...

So for me, I have a lot of VDI machines that can't get scanned due to a few reasons, however, LS attempts to scan them because they authenticated to a domain controller. The result is a blank 'WIndows' asset in red, OS is 'Not Scanned', etc... but the Last Tried value keeps increasing daily.

It's a great way for me to tell 'hey this box used to scan properly, but now it's not' or 'hey is this asset *really* inactive?

but yeah, confusing.

[ChrisParr]

So "Last Tried" only updates if Lansweeper gets at least a partial response to a scan attempt, "Last Seen" only updates on a successful scan attempt, and clean up only happens if "Last Tried" is older than the cut off you configure?

That's very confusing given the pre-built "Device: Not seen in the last X days" reports only show the "Last Seen" column by default, and the KB article https://www.lansweeper.com/knowledgebase/performing-automated-database-cleanups/ and automated cleanup settings both refer to "Last seen" rather than "Last tried".

It also doesn't match the behaviour we see with Windows PCs where the "Last Tried" value updates even if ping and RPC connections fail.

[Todd]

I agree this is very confusing.

[Esben_D]

If the device only respond to pings and SNMP is turned off, Lansweeper will keep updating the Last Tried value, since the asset will still be considered active, Lansweeper's cleanup options will not touch it.

If it gets manually deleted, a new asset page with a general Network Device asset type will be created with whatever information was available via HTTP or HTTPS (or other protocols which are open)

[ChrisParr]

So if a device was scanned using SNMP, but later a config change means that the device still responds to pings but no longer responds fully to SNMP, then even though it's still on the network it's Last seen value won't change and it could potentially be aged out?

What would happen when it ages out and is re-detected with just ping in a subsequent scan?

[Esben_D]

Last seen values will only update when a successful scan has completed. If an asset is attempted to be scanned, but the scan was unsuccessful, the Last Tried value will update instead of Last seen.

[JoeJoeJoe]

I have an issue where the device is pingable from the scan server but it is stuck in Non-Active state even though I have rescanned it multiple times.

It is reporting SSH and SNMP Scan issue, however it is having issues because we disabled SSH and SNMP. However the device is still on the network and it is active.

What is the definition of Active? is it pingable or scannable

[Jacob_H]

Hey JJJ:  The device needs to be successfully scanned, because the current scanner doesn't port scan nor fingerprint devices -  so, it can't guarantee that the device is the same device.  SNMP is generally required for monitoring systems such as Solarwinds Orion, PRTG, and ITAM apps such as Lansweeper, so what I usually do is restrict SNMP to respond only to approved IP addresses such as the monitoring server and Lansweeper server... and use SNMPv3 if possible.