UDT best practices

determine which ports are user ports and monitor them using a filter in the network discovery tool.

Set your history retention to 3 days unless you have a need to go further back in time.

Would add in batches and determine the impact it causes rather than just adding everything.

make sure your arp tables are updated about the nodes attached to the ports otherwise you wont get MAC addresses and IPs

if using snmpv3 to access the switches and there are VLANs on them you may have to run commands on your switches to make the VLANs appear via SNMPv3

just some issues I have come across hope it helps

documentation.solarwinds.com/.../udt_getting_started_guide.htm

What devices?   All L2 and L3 devices.   L2 devices need to be monitored for MAC addresses on switch ports, it gets the MAC/IP address from the ARP tables on L3 devices.   On L2 devices (switches) only monitor end-user switchports, not uplinks.    Might need more pollers and to adjust retention intervals, but it probably can.   I recommend monitoring ports that aren't in use, at least if they potentially could be used.   ie: someone plugs into it on occassion.

Polling intervals depends on how up-to-date you need the info?   If you're ok with less up-to-date info, relax them more.  If you need them to be accurate to the hour, add pollers.   Same logic with retentions, how long do you require the data for?

Whitelist?  I don't use it.   The ignored defaults for HSRP/VRRP are useful though.

It's really just a big database.   

Stores MAC addresses from switchport scans, that's why you don't monitor trunks.   Do a "show mac addr" on a trunk and see all the MAC's on it, just gunks up and confuses the UDT database and results from it.  

Stores MAC<->IP tables from the routers ARP tables.  Allows you to search by IP and find out what switchport their on.

If you bring in the Active Directory logs, it then associates the Username<->IP, which allows you to see when a user logged into a host and what switchport they were on and such.