Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Tracking connections to a server

Hi all,

I've just started using Orion/Solarwinds today and wanted to find out if I am on the right track.

I basically need to find out all hosts that authenticate to a domain controller in the past 24 hours.

Am I on the right track with the below? ie. Am I querying the correct table and using the correct column for the timestamp?

res = s.query('''SELECT

         DISTINCT(SourceHostname)

         FROM

         Orion.Netflow.Flows

         WHERE

         DestinationIP='%s'

         AND

         TimeStamp >= AddHour(-24, GETDATE())

         ''' % dc_ip)

Thank you

Find more posts tagged with

Accepted answers

All comments

tony.johnson

Hello,

Which Orion Platform modules do you have installed? From the query I gather you have Network Performance Monitor and Netflow Traffic Analyzer?

My assertion is that Netflow is not the correct tool for the task you described. It shows traffic traversing through an interface, source I.P, Dest I.P, Port and Protocol. While certainly beneficial to see bandwidth utilization and understand which hosts are talking to each other I do not believe it can provide accurate tracking of hosts which authenticated to your DCs

I would suggest looking at specific windows events to determine when authentication attempts are made. Server & Application Monitor is suited better to this task and also included Application Insight monitoring for Active Directory which can be seen here

https://oriondemo.solarwinds.com/Orion/APM/ActiveDirectoryBlackBox/ActiveDirectoryApplicationDetails.aspx?NetObject=ABAA:303