How to alert when certain drivers do not match a defined baseline

shawnrhode

Version Info:

Orion Platform 2015.1.2

SAM 6.2.0

QoE 2.0

NPM 11.5.2

NTA 4.1.0

SRM 6.1.2

IVIM 2.1.0

We want to be able to monitor and alert on driver, firmware and patch/operating system version information for our ESXi hypervisors as well as for other items that might be covered under Patch Manager (which is Windows only). All of the information is in the system and we can create reports that have the information but cannot find a way to create an alert that has a value for each driver/firmware/software (whether that is set in a central variable we can easily manage or not is arbitrary) and if a given end system does not have the proper value, we want to alert on that so we can create an action for work and change management as well as reporting for the business to show that all the systems are in compliance, etc.

Is this possible to do in some way that I am overlooking?

Sincerely,

Shawn Rhode

Find more posts tagged with

Alert

firmware

drivers

Accepted answers

All comments

shawnrhode

Bump

mrs.alterego

jbiggley‌ - I know you've done some customizations on your alerts; any chance you know how to get an alert like this set up for this SolarWinds customer?

jbiggley

Hmm, that seems totally do-able, especially if the information is already in database. The downside is that your 'baseline' value will need to change periodically and you'll need to update your alert with the new baseline.

I'll need to go and take a look but you might need to do a custom SQL (or SWQL!) alert to get to the data. Sometimes the exact combination of data isn't presented through the UI.

I'll take a look and get back to you.

jbiggley

On the job!

shawnrhode

Doing a SQL/SWQL query is fine, we are already doing that for other things and it just wasn't clear if it was needed here or how it would work. One thing that would be nice is if we can use Global Variables that define the versions in a central place and then setup an alert per driver+Variable. That way, we query for a specific set of parameters and then check the variable and it doesn't match, throw the alert. Then, we just need to go the global variables section when we need to update the version of something. Make sense?

By the way, thanks for looking at this!

jbiggley

So VMware host patch version should be relatively straight forward. You can use a custom property to set your baseline (that way you only have to change your baseline value in one spot) and build a simple node alert checking against description. Description should come back as something like "VMware ESX 5.0.0 build-XXXXX' That's pretty easy to match against without any custom SQL/SWQL. If you wanted to get fancy you could make it a custom SQL/SWQL alert and trim out the version and build level. But that might be overkill

I don't have access to my DB right now, but firmware and patch levels will definitely need to be extracted from the asset inventory tables. Give me few days to poke around our DB when I get back to the office and I'll through together a query for you. We don't do anything like this currently, so I'm not even sure what the data in those tables looks like.

Let me know if the VMware idea above works for you.

jbiggley

@shawnrhode

I took a look in the DB and, yes, the data is there. No, it's not pretty.

AssettInventory_Firmware contains the version and release date, but there are often multiple entries for the same nodeID depending on the manufacturer and hardware in the server. For example, one of our servers has 6 entries in this table for everything from the BIOS firmware to HBAs. Depending on how many hardware flavours you have this might be an easy SQL query:

SELECT Caption

FROM NodesData

JOIN AssetInventory_Firmware ON AssetInventory_Firmware.NodeID = NodesData.NodeID

WHERE

Name = 'HP ProLiant System ROM' = 'XXX'

The OS Updates would be similar, but you could just check against the KB number. The SQL on that one escapes me right now as you would be doing some fancy footwork. The AssetInventory_OSUpdates is the table where you want to look.

AssetInventory_Driver would have all of the driver versions for you. That one might be a little easier. Again, you'll probably end up building an awful lot of alerts to make things work but I think it is do-able as well.

Does this help?