Trap Viewer to What ..?

Once again, I am confused.

We have two versions of Solarwinds running for very specific reasons. One is slightly older (I forget version right now but can find out) and traps happily come into the old Trap Viewer (TV). This system only manages a small environment and requires lots of hoops to be jumped to even consider an upgrade. The main platform we are running 2019.4 and TV on start says 'working in read-only mode' and I guess this is because TV has been deprecated, and it does NOT show any traps.

OK, so I think I get all that but I'm hoping someone can show me wrong, and the following is why....

On our older environment, I can configure TV to search for and find a specific trap (in this case an HA event from a firewall cluster) and then in the actions, I can extract certain info and push it off to a CLI app (msend) with relevant arguments, and it in turn pushes the trap as an alert into BMC fromwhere we generate an incident.

But I can't see how to replicate that into 2019.4 - this article talks about OLV being the all new and better version of TV but does that also mean I have to actively go out and install that now? Or is it already installed as a part of 2019.4? Because if so, I'm not seeing it as better

Find more posts tagged with

traps

viewer

Logs

Accepted answers

mesverrum

So the new product gives you the option to set up web based orion alert actions from trap data without resorting to SQL. The big gap that they seem to have missed was that they no longer parsed the varbinds into separate entries that you can pick through and use in your alert messages and actions. They replaced them with one big ${message} variable. I've posted some examples in the past of tricks i used to substring the data I wanted out of messages, but its a huge step backward for people who used traps for anything serious. Definitely struck me as a case where nobody who was on the team developing the replacement had ever really used the thing they were replacing or seen it being leveraged by someone who knew what they were doing

All comments

stuartd

So, partially answering my own question.... I found this reference to Orion Log Viewer.

It appears OLV is newer and better (their words) and in our 2019.4 environment should be a replacement for Trap Viewer but it still leaves questions unasnwered.

Reading and clicking around takes you to a feature comparison table which, as you'd expect, lists features and their availability. What it doesn't do is describe / define what they mean.

I could guess but need to actually know what they mean by "Live Mode" ?

Anybody know this?

cnorborg

I believe that "Live Mode" instead of giving you a snapshot in Orion of the traps, gives you a constantly updating resource. ie: the first if you left it on the page would wait until the page refreshed to show you new traps. The "Live Mode" shows you new traps as soon as they come in without having to refresh.

mesverrum

stuartd

@cnorborgthanks - also had one of the product managers post this as a response to my asking over on the Log Analyzer announcement thread.

jvb wrote:
Live Mode allows you to see the events in near real time as they are collected by Orion. So if you have filtered down to a specific node for example then you could press the Live Mode button and view events for that node in near real time. Very useful when troubleshooting or when adding new nodes and you just want to verify events are flowing.

stuartd

@mesverrum

Thank you. I have seen some of the posts you reference, and even bookmarked for possible later attention but I confess, a fair bit of what you talked about in them went over my very basic SQL head.

Like you, the one thing I took out of the new product, is as you say, the lack of being able to pick individual varbinds.

I've posted some examples in the past of tricks i used to substring the data I wanted out of messages,

I'll continue to dig through THWACK and see if I can find your tips about extracting this data.

And whilst I don't have the answer I was after, I do believe you response is the closest I'm going to get so also accepting it as the answer. Cheers.

mesverrum

I'd suggest voting up these feature requests since they all come back to the same root issue.
https://thwack.solarwinds.com/t5/LA-Feature-Requests/Log-Analyzer-Allow-searching-for-varbind-name-value-pair/idi-p/554301
https://thwack.solarwinds.com/t5/LA-Feature-Requests/Macros-for-Alerts-in-Log-Viewer-Analyser/idi-p/544060