[Q&A] Identify why requesting an inventory is not autorized

[keguira]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hello,

We have about 2000 computers in my compagny. We use different OS version (windows 10, 11, 7, XP).
Our current configuration is GLPI 10.0.7 and GLPI Agent 1.4 (we plan to migrate to 1.5 in the following weeks).
All agents are in "managed mode" without any plugin (no basic-authentication-server-plugin or proxy-server-plugin)

I can see that, sometimes, for some computers, if we try to manualy request an inventory from GLPI we receive a "not autorized" response.
It's totally random and can be, sometime, solved by rebooting the computer. Even a super-admin user receive this message.

I'm seeing nothing in the agent logs.
As i understand this, this is the response from the http server runned by the agent but i should not have it as the resquesting server is a mono-instance which url is the same as the domain configured in the agent under server (ex: https://my-glpi-server/marketplace/glpiinventory/)

Has someone encoutered this kind of behavior ? Did you find the root cause or have some clues to invastigate ?

[g-bougard]

Hi @keguira
the agent is maintaining a cache of trusted ips. This feature authorizes people to change the GLPI server ip or set dns name in httpd-trust for more or less dynamic hostname. If for some reason you have dns issues on a computer, I think you may experience such comportment. If this happens again, can you simply try to restart the name resolving service (don't have its name in mind) and try to reconnect to glpi-agent after a minute ?

[keguira]

you mean restarting which service ? the one in charge on a computer to resolve a DNS ?

I know we have some internal DNS issues. I also know that our users do not shutdown their computer even once a week (or never) even if we recall them to do each night.
I'll try to do this test next time i can put a finger on a computer with this issue.
I'll keep you updated.

[g-bougard]

Indeed,just restarting the service may not be the right thing to do. You should probably clear the dns cache with ipconfig /flushdns and ping the glpi server hostname to check it answers with the expected ip. If the ping fails, you'll have to investigate more deeply for dns resolving issues from this system.

[keguira]

ok, so after multiple tests and more digging, it's indeed a problem with domain resolution.
Here is a log on computer startup (changed my real domain for a dummy one here) :

[Thu Jun 29 11:16:16 2023][info] GLPI Agent service starting
[Thu Jun 29 11:16:16 2023][error] unable to get address for 'glpi.mydomain.com': nodename nor servname provided, or not known
[Thu Jun 29 11:16:16 2023][error] unable to get address for 'glpi.mydomain.com': Hôte inconnu.
[Thu Jun 29 11:16:16 2023][info] [http server] HTTPD service started on port 62354
[Thu Jun 29 11:16:17 2023][info] GLPI Agent memory usage: WSS=3743744 PFU=105291776
[Thu Jun 29 11:16:17 2023][info] target server0: next run: Thu Jun 29 20:26:07 2023 - https://glpi.mydomain.com/marketplace/glpiinventory/

After 10 minutes, i still could not force an inventory even with /flushdns.

I restarted the service and this was ok.

I'll do more tests in the following days and i'll keep you updated after update in 1.5
I'll raise an issue if i can confirm it's not only on our network side.

[keguira]

I did some digging again. I was still having the same error message.

[Tue Sep 26 16:36:25 2023][debug] [target server0] Next server contact planned for Tue Sep 26 17:14:05 2023
[Tue Sep 26 16:36:25 2023][debug2] getAvailableTasks() : add of task Collect version 2.9
[Tue Sep 26 16:36:25 2023][debug2] getAvailableTasks() : add of task Inventory version 1.13
[Tue Sep 26 16:36:25 2023][debug2] getAvailableTasks() : add of task RemoteInventory version 1.2
[Tue Sep 26 16:36:25 2023][debug2] Preparing execution plan
[Tue Sep 26 16:36:25 2023][debug] Available tasks:
[Tue Sep 26 16:36:25 2023][debug] - Collect: 2.9
[Tue Sep 26 16:36:25 2023][debug] - Inventory: 1.13
[Tue Sep 26 16:36:25 2023][debug] - RemoteInventory: 1.2
[Tue Sep 26 16:36:25 2023][debug] target server0: server https://glpi.mydomain.com/marketplace/glpiinventory/
[Tue Sep 26 16:36:25 2023][debug] Planned tasks for server0: Inventory
[Tue Sep 26 16:36:25 2023][debug2] [http server] HTTPD service still listening on port 62354
[Tue Sep 26 16:36:25 2023][error] unable to get address for 'glpi.mydomain.com': Hôte inconnu. 
[Tue Sep 26 16:36:25 2023][error] unable to get address for 'glpi.mydomain.com': Hôte inconnu.
[Tue Sep 26 16:36:25 2023][debug] Trusted client ip/range: 127.0.0.1/32, ::ffff:7f00:1/128, ::1/128
[Tue Sep 26 16:36:25 2023][debug] Agent memory usage before freeing memory: WSS=18681856 PFU=124010496

I think it's a network issue.

I tried to modify the conf-reload-interval to reload conf and it does the trick : when the clock is ticking, it retries to check the domain and find it (most of the time) such as it allows my server to do the call. As cherry on the top, my users on VPN are added to the pool of users I can force to do an inventory.
I raised a ticket to my network team to investigate on this issue.
If I find more revelant information, i'll keep everybody in touch