SolarWinds database update

Quick question on SW logic.

If I am monitoring Windows nodes in SW via WMI, when a node is polled my understanding is SW initiates that poll, correct?

Second, is the data pulled from the node by SW or pushed to the SW server AND/OR does the node send the data directly to the database using the WMI credentials from SW?

Thx.

Find more posts tagged with

sql

npm

Polling

database update

Accepted answers

mesverrum

If WMI polling is used, SW engine initiates on wmi ports, 135 normally, the node responds toward the SW server on a random ephemeral port. SW server then processes the data and sends it to the SQL server

sturdyerde

Now if you are using SAM 2019.4 or newer, there are two different methods that you can use to poll for WMI data (now using the term CIM data may become more accurate).

I'll get into the weeds just for fun, but first agree of course that Marc's advice is correct--the SW engine initiates the poll, or query, and the endpoint sends the response back to the SW engine for processing. I think this extra explanation is necessary, because the UI isn't quite explicit enough about which protocols are being used to query WMI data in SAM.

When you edit a Windows component monitor in a SAM template, the fetching method setting provides two options: WMI or RPC. In truth, these are both used to pull WMI/CIM data. The difference is in the transport: the protocols and the ports being used.

The legacy method for remote management in the Windows world uses a combination of DCOM, the RPC endpoint mapper (on the remote machine), and the ephemeral RPC ports (between 1024 to 5000 and 49152 to 65535). This method has always made network and security engineers cry because of the huge swaths of ports that must be opened on firewalls.

The new approach that is referenced by the "WMI" option above uses the "less old" Win-RM method. It can be used for WMI queries and for remote management, and is always encrypted. It uses HTTP port 5985 or HTTPS port 5986, but again, is encrypted in either case. Only one port needed! This has actually been around since Windows Server 2008, if I am not mistaken, so it is hardly new. So great to see it as an option in SAM, and we're looking forward to having it baked into NPM next!

All comments

mesverrum

sturdyerde

Now if you are using SAM 2019.4 or newer, there are two different methods that you can use to poll for WMI data (now using the term CIM data may become more accurate).

feltonlewis

For anyone who else who may read this thread our environment is on 2020.2 FYI.

sturdyerde

BTW, please vote for this feature request, if you haven't already! https://thwack.solarwinds.com/t5/NPM-Feature-Requests/Support-Win-RM-for-node-details-polling-in-NPM/idc-p/599161