Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Question on SolarWinds Events

Can someone explain to me or point me to a resource that will explain what the SolarWinds events are? How they are detected and what they mean? Specifically, I have the following event on a bunch of servers.

[Volume Name] on [Entity] has been removed from [Polling Engine]

The particular volumes in the event message are still on the Entity and are recording values.

Find more posts tagged with

Accepted answers

All comments

cahunt

Events are just that the events within your orion application. Anything that happens with the entities that you have chosen to manage. This would include status change, change in monitoring method, adding or removing entities, or changing settings(globally) or specific Entity settings.

In the case of the volume being removed, that is a message about someone deleting a volume.

If you want to see a username, check the 'audit events' to correlate.

And let us know if you need more insight into the data, or more data all together.

-CharlesH

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

hallstev5

I looked into the audit events for that a particular node that has the event "[VolumeName] on [Entity] has been removed from [Polling Engine]". I see no corresponding audit events. I don't believe that the volumes have been removed, because they are collecting monitoring data and have been without any breaks. I guess I would like to know what SolarWinds is looking at to determine that an event happened and validate that these are actual events that I need to look into and what is noise.

If the SolarWinds platform itself had a problem where the SQL database was not available for a period of time, would SolarWinds generate these events because the status of the drive goes from up/green, to unknown?

cahunt

The node may have been moved, is there a message for the volume being added to another poller?

If you put the events and/or audit events widget on the volume details page (if not already there) you should be able to see the full picture.

It should also show on the node details page if it was moved from one poller to another.

hallstev5

There are no messages for the volumes being added to another poller. I looked in the events database with the node id and It shows the following events:

Node Removed Event

4 Volume Removed Event

Interface Removed Event.

Node Down

Node Up

Node Rebooted

In another case:

4 Volume Removed Events

Node Removed

Interface Removed

4 Volume Removed Events

In none of these cases did the node switch polling engines. The node remained with the same polling engine. There are no volume added events or node added events. There is nothing in the audit database for this node during the times that these SolarWinds events were generated. I think that I am going to open a case with SolarWinds to understand how the events are triggered. I know for the dates for one of the events my SolarWinds platform was "down", in the sense that none of my pollers could write to the database for a few hours due to a SQL Server issue. I appreciate your responses and thank you for the help you provided me.

cahunt

If the Volume could not be reached it would incur a status change. The node, volume and any other entity should remain in the DB/system since it was not deleted and simply change status. graphs and charts would be affected for the entity, not the overall count of, or entities themselves.

If you are on a VM and the label changes I do believe the system would see it as a new volume; that you would have to perform a list resources, and then remove the old volume still present.