RabbitMQ Tripping PowerShell Monitoring Alerts

Hi All

We are in the middle of installing Observability and with this new install we are receiving Alerts from our Trigeo monitoring about PowerShell running. We monitor all PowerShell usage on our network and get alerted whenever it is used. We don't have this issue in our current install of SolarWinds 2020.2.5. The process tripping the alerts is erl.exe. It looks to be part of the RabbitMQ module. The alerts are literally sending +20K emails a day.

Has anyone else run into the issue and how did you work around the alerts? If I disable the RabbitMQ service will I break something?

Thanks

Find more posts tagged with

Observability

rabbitmq

PowerShell

Accepted answers

All comments

marcrobinson

RabbitMQ is still part of the SolarWinds/Orion platform. I would not disable it. I have not run into your issue either. Do you have a method to whitelist it in Trigeo?

SolarWinds Platform 2023.2 System Requirements - look for traffic on port 5671.

adam.beedell

Rabbit's just queueing stuff

This'll be "you have powershell monitoring in your solarwinds platform somewhere. And that is probably fine"

eroche

Hi Marc

Thanks for your response, whitelisting is going to be our last resort.

@adam.beedell thank you also for the response, how would I disable Powershell usage in Solarwinds? We don't need it to monitor through PowerShell.

Thanks again

adam.beedell

Hmm... look in SAM, disable custom powershell monitors, disable all the appinsight templates, see how much it's reduced?

You could probably uninstall it but that sounds like a disaster waiting to happen

eroche

Ok thanks I will take a look and let you know how I make out.

eroche

So I am going to assume that since this is a new installation, with nothing defined yet, could the reason I don't see anything application monitoring. There is no way to just turn off monitoring through Powershell?

eroche

Not seeing any traffic on 5671.