What nodes don't have their disk volumes monitored?

Re-asking this question from over 5 years ago since it did not flill my need

"A disk on one of my servers ran out of disk and no alert triggered for it. I went to the node and clicked on List Resources where I saw that the volumes were not selected. Which leads me to my question.

Is there a query I could run to list all nodes where disk volumes are not selected? I'll poke around in the database to try and figure it out but I'm hoping someone can save me some time. Thanks!"

I have no idea how many Windows Fixed Disks were added and how long ago. It seems if the GUI is able to display a Windows Fixed Disks that are unchecked. a query or report should be able to do the same. I cannot manually check multi hundreds of servers. Is there such a SQL or SWQL query or report to accomplish this?

  • Morning,

    I don't think a direct SWQL query is possible, but you can create a partially automated solution using a PowerShell script like below:

    PowerShell

    # Import SolarWinds Orion PowerShell module

    Import-Module SolarWinds.Orion

     

    # Define SWQL query to get Node IDs with Volumes

    $SWQLQuery = "SELECT n.NodeID FROM Nodes n WHERE n.EntityTypeName = 'Node'"

     

    # Execute SWQL query and store results

    $UnmonitoredNodes = @()

    $NodesWithVolumes = Invoke-SwqlQuery -Query $SWQLQuery

     

    # Loop through retrieved nodes

    foreach ($Node in $NodesWithVolumes) {

      $NodeID = $Node.NodeID

      # Simulate manual check (replace with actual volume check logic)

      # This example assumes a simple check for existence of a specific volume name

      $VolumeName = "Volume1"

      $HasVolume = Get-SwqlQuery -Query "(SELECT TOP 1 1 FROM Volume WHERE NodeID = $NodeID AND DisplayName = '$VolumeName')"

     

      # Check if volume exists for the node (modify logic as needed)

      if (!$HasVolume) {

        $UnmonitoredNodes += $NodeID

      }

    }

    # Display results (modify as needed)

    if ($Unmon monitoredNodes.Count -gt 0) {

      Write-Host "Following nodes potentially have unmonitored volumes:"

      foreach ($NodeID in $UnmonitoredNodes) {

        Write-Host " - $NodeID"

      }

    } else {

      Write-Host "All nodes appear to have monitored volumes (based on the check)."

    }

    The script first retrieves a list of nodes with volumes using an SWQL query. Then, it goes through each node and performs a basic check (you can modify this check based on your needs). In the above, the script checks for a specific volume name. If the chosen volume isn't found for a node, it's added to a list of potentially unmonitored nodes which the script will then display, which hopefully answers your question.

    Cheers,

    Russ

  • With Russ/' solution, i'd try and add a section using/referencing discovery results in the #Simulate manual check section
    If you've got the virtualization layer for your stuff consistently you can pull the VirtualMachineVolumes section, which means unmonitored volumes could just be an OUTER JOIN on that table, maybe.

    In pratice probably a few methods

    Auto-scans-auto-adds usually the way to go eventually

  • Just a heads up, the system user can delete volumes from monitoring.  I believe this occurs when the volume is modified by the hypervisor and it has a new ID. Can be detected and alerted against by looking for the Auditing event message that starts with "User SYSTEM deleted volume"

  • I believe my situation is different in that newly added volumes by admin that does not realize they need to check the boxes.

  • I get an error trying to import SolarWinds.Orion - not found:

            Import-Module : The specified module 'SolarWinds.Orion' was not loaded because no valid module file was found in any module directory.

    and SwisPowerShell does not seem to have the Invoke-SwqlQuery:

            Invoke-SwqlQuery : The term 'Invoke-SwqlQuery' is not recognized as the name of a cmdlet, function, script file, or operable program. Check

  • I have a script example in my github repo that grabs all your cisco devices and builds a new discovery for them and imports everything it finds.  It would be pretty trivial to update it to do windows instead of Cisco devices.

    https://github.com/Mesverrum/MyPublicWork/blob/master/DiscoveryByScript

    There is also another example where i discover all kinds of devices and then filter the results before importing just what I want from each device type.

    github.com/.../DiscoverFilterImport.ps1

  • I am having credential issues trying to it. I have tried my domain su account I use to run SolarWinds. I also tried the domain SolarWinds service account but get:

    PS C:\WINDOWS\system32> get-swisdata $swis "SELECT TOP 1 servername FROM Orion.Websites"
    get-swisdata : The server has rejected the client credentials.
    At line:1 char:1
    + get-swisdata $swis "SELECT TOP 1 servername FROM Orion.Websites"
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-SwisData], SecurityNegotiationException
    + FullyQualifiedErrorId : System.ServiceModel.Security.SecurityNegotiationException,SwisPowerShell.GetSwisData

  • I found this link:

     Get-SwisData Credentials failing when local 

    and when I changed to $Swis = Connect-Swis -Hostname $env:COMPUTERNAME -Certificate, it worked (on the Orion server)