This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Odd Issue with PowerShell SAM Monitor on one Node

martian_monster over 1 year ago

Fun one off issue that I am not sure if it is the node or the monitor.

I have a PS monitor setup to check a folder for the existence of an XLS file. I have a Prod and Stage instance of this monitor that is setup on Prod and Stage servers. The monitors are setup identical the only difference is the name of the monitor.

Both monitors are set to Inherit account from node.

Both nodes have the same service account setup on them.

The Stage Monitor is currently responding with an Unknown status.

If I go into SAM and find the monitor to test when I test with the Stage Node it says "unknown user name or password"

The account that SAM should be using is the same account that the node uses to report on WMI and it is showing up.

I can go and find a different application monitor and add it to the Stage node and it will work like it should. I know the Solarwinds account works.

I tried adding the Prod monitor to the Stage server and it failed as well with 'unknown user name or password"

I removed the monitor and added it back and it is still showing as unknown.

This seems like I am missing something. Or maybe the node is having a Monday. Thanks - Dave

Top Replies

Parents

0 martian_monster over 1 year ago

This issue raised its head again today but it took out a server in the process.

To the best of my knowledge nothing changed on these nodes. I working on checking out what patches were applied this month to see if MS had its hand in this.

I logged in this morning and one of my nodes was showing two monitors as unknown and two monitors were green.

The unknown monitors are both PowerShell monitors and the ones that are still working are WMI monitors.

Server was completely locked this morning and I had probably 100's of wsmprovhost.exe on the node and they were all tied to the Solarwinds Service account on the server. I removed the monitor and will be rebooting the server. Any ideas of what direction I need to look to and figure out what is going on?
Cancel
Vote Up 0 Vote Down

Cancel
0 mesverrum over 1 year ago in reply to martian_monster

Can you paste a screenshot of the script component config?

Is it set to remote execution or local?
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to mesverrum

Set as Remote Host. Local host does not generate the correct data.

I think this is what you were looking for. I am very green when it comes to PowerShell and Solarwinds.
Cancel
Vote Up 0 Vote Down

Cancel
0 mesverrum over 1 year ago in reply to martian_monster

By chance do you know if this server is using the agent or do you poll it all via wmi?
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to mesverrum

Polling via WMI. I have a handful of Agents on nodes. I normally only do agents for Netpath.
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to martian_monster

Node is up and polling just fine via WMI.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 martian_monster over 1 year ago in reply to martian_monster

Node is up and polling just fine via WMI.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 mesverrum over 1 year ago in reply to martian_monster

We've kind of burned through the things that came to me top of mine when troubleshooting script executions. From the screenshot you it makes me think that you are actually getting connected because all the processes are spinning up, are there maybe a lot of files in those directories and Orion is timing out the connection before it gets a response. You might try remoting into the server and trying to run a version of the script locally to understand how it behaves. Then I'd probably take it a step back and try to psremote over from the polling engine to the other server and see if anything noteworthy happens. You might also consider taking a fishing trip through the logs, but i find that sam component logs are a real monster to dig through in many cases
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to mesverrum

I am trying to figure out if something was changed or udpated in PowerShell. The stage monitor started acting up earlier in September but it was not doing the same odd things that I found on Prod this morning. I know it is 'something' with PowerShell doing something with the node. Once I find that something I will make sure to post.
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to mesverrum

Port 5985 is open but Port 5986 is not. At this point that is the only thing so far that I can figure out.
Cancel
Vote Up 0 Vote Down

Cancel
0 martian_monster over 1 year ago in reply to mesverrum

I found this link - View online

Received an update from Support and made the following changes which appears to correct the issue. These changes were done on the APEs and the Primary server.

File: %SolarWinds Install Directory%\SolarWinds\Orion\SolarWinds.APM.Probes.dll.config

Backup the file above

Launch Notepad.exe in administrator mode and load up the file

Find the line: <add key="UseLegacyPowerShellImpersonation" value="false"

Change the line to: <add key="UseLegacyPowerShellImpersonation" value="true" />

Restart Orion Services

One of my polling engines was set to False and one was set to True. So I moved the node over to the polling engine that had it set to True. It Errors out but this time it times out. Not sure if it is progress or not. lol.
Cancel
Vote Up +1 Vote Down

Cancel