Troubleshoot infrastructure coverage

Start with the source of a missing measurement. An empty inventory, a failed collector, an unsupported field, and a quiet host need different responses.

Check the collection chain

1. Clear search and grouping filters, and choose a window that includes the expected observations. Infrastructure defaults to the last 24 hours.
2. Find the relevant check in Configure → Test management. Confirm that it is enabled and assigned to a capable agent in the right location.
3. Inspect the latest test result and its timestamp. If a test policy restricts execution, check its current schedule and conditions.
4. Check Configure → Agents for reporting health, configuration issues, capabilities, and connectivity. Successful enrollment alone does not mean that the requested collector ran.
5. Allow for inventory processing after ingestion. Where a source is already present, use its own timestamp and coverage notices instead of the page’s load time.

A machine is missing or appears more than once

For a new machine, confirm a successful agent, SSH, SNMP, or discovery observation, then allow the next inventory pass. For an existing one, widen the time window and search by a hardware address or serial as well as its name.

Separate rows can mean the sources do not have enough reliable evidence to correlate. Compare Overview → What found this machine and Addresses and hardware, including network scope, source, and confidence. Reused private IPs across sites do not establish a shared identity.

Do not change network-scope labels just to make rows merge. Check that the labels describe the actual routing domains first. See machines and identity.

SNMP discovery found a target, but its detail is empty

Discovery, generated-check synchronization, device polling, and inventory processing are separate stages. Verify that the generated SNMP check has a successful poll, not just that the sweep found a responding address.

For failed polls, check reachability from the collecting agent, port, SNMP version, and credentials. For missing sections, check device MIB support, read permissions, optional collection switches, and the Poll budget notice. Skipped sections and truncated tables describe incomplete collection.

Rates require successive usable polls. Wait for another successful poll and check for a reboot or counter reset before interpreting a missing rate. See network devices and SNMP.

Host measurements or a process are missing

An installed agent reports its own health, but local resource details require a Host Metrics check. A remote SSH target requires Remote Host Metrics and the corresponding credential access. The source agent’s resources do not stand in for the target’s resources.

If a process disappeared from the top-process list, configure its exact executable name under Processes to monitor and check coverage. Falling out of a ranked list does not prove that a process exited. An unavailable rate after startup or reset does not mean zero utilization.

Some CPU, memory, or disk collection can be suppressed when SNMP is supplying that domain. Read the source notice and sample times. See host and kernel diagnostics.

Containers have IDs but no useful names

On Linux, cgroups can supply resource measurements while kubelet or runtime identity lookup is unavailable. Check Identity source, its endpoint, and permissions. An explicitly selected source reports its failure instead of silently choosing another.

If only the collector’s container is visible, check whether it can read the host cgroup hierarchy. On Windows or macOS, a reachable Docker-compatible Engine endpoint is needed for the statistics themselves. Look for truncation, filters, and Include stopped containers when the row count is surprising. See containers and Kubernetes.

A kernel or flow panel is empty

First distinguish no configured check, a disabled section, a refused probe, and an attached collector that sampled no relevant events. Inspect the machine’s Collector panel for exact probe names, kernel information, and reported loss.

For a missing TCP peer, also inspect ephemeral-port and subnet filters. A high-port service can be filtered along with temporary inbound client ports. Map-full losses and truncated flushes mean the list is incomplete; they are not packet loss on the network path. See passive network flows.

Wireless radios exist, but there is no experience score

Hearing an access point does not mean an agent associated with it. Coverage can exist without a graded link sample, especially on wired hosts with scanning adapters. Check the associated BSSID, sample count, and available RSSI/SNR fields.

Review physical access-point grouping if the wrong radios appear together. For no observations at all, check the adapter, scan permissions, capability report, and test results. See wireless and access points.

A floor plan has no samples or implausible positions

Verify the site key and agent tags, recent WiFi or BLE observations, and the exact identities attached to pins. Check that physical access-point groups contain the correct BSSIDs and are placed on the right floor.

Use known anchors for alignment. Calibrate the scale for room areas. Distinguish pinned locations from inferred placements and roaming estimates, and select the appropriate Experience or Coverage layer. Samples without enough radio evidence may remain unplaced. See floor plans and positioning.

Two views appear to disagree

Check the subject and aggregation first: a workload can span several hosts, flow totals can span several collectors, and a wireless score can include many agents. Next compare the selected window, actual sample times, source freshness, and coverage limits.

On a machine, use Ask Spear → Check telemetry coverage to inspect the sources in context. For unresolved problems, include the machine or check ID, source agent, selected window, timestamps, and recorded errors in a support request. Preserve the evidence before changing collection settings.