Donald_Francis

This is something I have done. I was happy I did it. The main box is a busy box and taking the web load to a diff box helped out a lot but I do have many web users. It really depends on how busy your main box is and how many people use the web page. 

It depends on what you are after. A broadcast storm will normally kill a CPU and so it does not matter what VLAN you were in as they would all suffer as the switch as a whole suffers So monitoring something like CPU and MEM with a quick trigger is important in my mind as well as syslog. And in actuality with a…

anyone?

I ran close to 20,000 elements on 10gb of RAM on a dedicated SQL server. While SQL will reserve as much as you tell it it can I rarely saw actual utilization go above 6 or 7 gb. Now with that said I just stood up a new SQL server for SW with 24gb of RAM but if all you have is 500 elements max something around 12gb will be…

Seriously, I cannot be the only one who cares about this

Those will run just fine. I run dual 6 core and I have had no issues.

I do this using syslog.

A broadcast storm at this stage in networking is normally caused by a loop in the network. That is something that normally is very hard to track down. To be honest I do not know how Orion can help you do that especially keeping in mind that if you have something like that going on monitoring traffic will probably be…

I do not think it does that yet. Supposed to be coming soon though I hear.

Each additional module's web component is in the install for the additional web. This is why it is so large now. So the only thing you have to do extra is install the ones you need after the basic install.

No V6 here and no plan for use at this time.

They can indeed run on separate boxes, I do just that. However while NPM causes a pretty good load NCM is a lite weight. What I am getting at is you may have other issues that moving NCM to another box will not fix. The first thing is to run your SQL DB on a separate box unless you have a very small install. If you are…

As far as I know they officially support IE and FireFox but not chrome as there are several little things here and there that do not work in it with the interface.

You might as well just call support now on that one. :P

As far as I have heard that implementation of netflow is not the usual and Solarwinds currently does not support it.

I could be wrong but I think all the different parts of Orion act as seperate entities that all feed off the SQL server. So in reality I do not know that it matters.

Just my 2 cents but I would open a support ticket.

You could do a reinstall but the best thing to do is probably get a ticket open.

I personally do not see how you could do that but I too would be interested in something like that.

That usually equates to output drops in SH INT but I do not see that in your output. That is generally from the port queue's filling up and tail dropping because it cannot transmit the data fast enough out the port towards the device.

There are still some bugs in it but it does not use anymore traffic than any other netflow.

Really? Osama?

Yes it can Monitor VM's as well as even the ESX box it belongs too. Those SNMP settings are community strings set inside the OS. Obviously it is suggested to move them away from the defaults of things like "public", "private" or "Secret".

Are you sure about that? I have all my servers restricted to accepting SNMP from only the poller and I can do node changes/adds without an issue.

I would vote option 1 just off of general principals that it is better to change the payload of a packet then mess with the headers.

I think you are missing the NDE command. Check this out.

You need to go to the Security tab and add the name of the Orion server.

Is IP CEF running on the other router? I think it is required for netflow to function. Should be on by default but you never know.

Also, I think it would be awesome if it could be made faster. Discovering a large network takes days literally. I think it would be perfectly alright to trade more mem ad cpu usage for a faster scan.

It is whatever you make it. The port in NTA is configurable and when you enter commands in Cisco equipment to point to a collector you also include the port.