Application Statistics

Question

I have noticed that the Availability Statistics which display on the Node Details screen are inaccurate, I have a server that has been rebooted 4 times in the last two weeks and yet the Availability still shows as 100%.

This of course brings in to disrepute the availability stats for all my servers which will be a blow to my boss who purchased this tool amongst other things for the ability to record Availability Stats.

Has anyone else come across this discrepancy and if so have you been able to resolve it, I assume this stat is based on the response from a ping which on my configuration is sent every 2 mins, I am a bit loath to set that to occurr any more often in case it causes a response issue.

Any ideas?

kreases · Answer

I do already have SNMP running on all my servers but I don't know how to pick off reboots in the event log and get them to be used to record Availability figures.

ecklerwr1 · Answer

One way is to use an snmp agent on the server.  A free one is net-snmp.  Another option is to forward the event logs as syslog messages to orion.  Solarwinds has one:

http://solarwinds.s3.amazonaws.com/solarwinds/Release/Components/LogForwarder-v1.zip

Log Forwarder for Windows can be installed on your Windows servers and will forward Windows event log messages to your Orion Syslog Server. This version replaces the old Windows Event Forwarder and adds support for Windows Vista and Windows 2008, filtering of events before forwarding, and a silent MSI installer for remote software distribution.

Another is one I added in the contect exchange that works well:

Eventlog to Syslog v4.1Release 4.1Last revised January 20, 2010

This program is written in C and provides a method of sending Windows Eventlog events to a syslog server. It works with the new Windows Events service found in Vista and Server 2008 and can be compiled for both 32 and 64-bit environments. Both compiled binaries are here for download.  Designed to keep up with very busy servers, it is fast, light, and efficient. The program is designed to run as a windows service.

Changes in v4.0:§ Added ability to ignore specific events§ Added a status file for monitoring service operation§ Added event’s timestamp to outgoing messages§ Added compatibility with the Vista/Server 2008 Windows Events service§ Added ability to send to two Syslog servers simultaneously§ Fixed a possible memory exception with bad message definitions§ Fixed a bug where utility would not search all message filesBoth of these allow you to filter or ignore specific events so you only get the messages sent to Orion that you want to see.  Once the information is in Orion you can go into Report Writer and create a new report of one of these types:

Event Log, Syslog messages, or Alerts.

You can define custom alerts based upon many conditions.  There's more than one way to skin the cat.  From my experience you just need to experiment with the various options and craft a solution that works best for you.  The report writer takes a little practice but after you make a couple reports it gets easier and more intuitive.  Also the experience you gain going through the process makes doing the next customization that much easier.  Also Thwack is a resource I couldn't imagine getting along without :}

kreases · Answer

I think I would have the same problem with APM however the option to send event log messages as traps sounds like a good option but I wouldn't know how to go about doing that. Also assuming I could get the event log messages how do I go about getting this in a report.