Donald_Francis

Actually if you pay attention you will see they listen to us quite clearly, features/changes that are asked for are put in all the time. 10.1 is a good example of that. Do you really expect every feature or change everyone asks for would get put in? If you do that is just silly. Do you expect it will take only a short time…

We monitor all ports of any switches that are deemed important. Than being usually any "core" switching. We do not monitor anything else switchwise. More ports = more elements = more pollers for one and in general we just do not care about stats on a basic L2 switch. On the flip side of that we put EVERYTHING into NCM for…

I agree with this but I think the problem is larger then just Syslog. Alerts in general are tedious and hard to manage. It is not because there is anything really wrong it is just the interfaces need to be rewritten so that changes and adds or just doing alert inventory is far easier and less time consuming. I would love…

So I am still working with Cisco , (I have backbone TAC at this point) and they are still digging but at this point they believe that the chassis is actually being polled so fast (multiple times a second) that the SNMP drop errors are real and that this WOULD cause the CPU to spike as the Chassis would try to answer every…

By the way anyone with this same question I had, you just make a new rule and put it at the bottom of the rules and for action pick "discard message".

Don't forget import subnets !!!!!!!!!!!!!!!!!!!!!!!!!!! The free version does it the pay for version needs to as well!!!!!!!! If it did we would buy it !!!!!!!!!!!!

I think primarily what I would like to see in a forensic screen is not the top 10 type of info but detail what a node did throughout the network or make it easy to find a particular conversation. Think of it this way, if you had an infected node or nodes you would maybe want to use netflow to see what those nodes were…

Thanks for the info and the update !

Sure. They initially said they would release that version but I think its possible that it was either delayed or it is only gotten upon request. The only reason I got it is because I filed the bug and did the final testing for it. I am sure you can get it if you file a TAC case or I would assume they will come out with a…

Brandon, those are OK workarounds but they are by no means a good or complete way of monitoring the system. Even if we roll with your solution there are still plenty of holes that can happen if certain services on the main box or polling server go down or otherwise go haywire. I really think there needs to be a built-in…

As just a matter of giving as much detail as I can. Back in 2.5 of APM we would get random unknowns that seemed to happen for no reason. In V3 it always seems to happen to an app or component as it transitions into warning or down/critical. So sometimes when we drop a node or a service we will get an unkown and then…

Gary I agree with your DBA except when it comes to RAID5 on the DB files. That would be BAD. Make that a RAID10 array. The more spindles the better.

The web server is just an additional license of about 500 bucks and it is a very easy operation to do. You can even take it further have more than one and load balance as needed.

I do this with syslog. In my mind there is no other way. Reason being is because if you are not monitoring syslog or traps for your switches (at least the important ones) you might as well not be monitoring anything because you are missing the most critical messages.

Turning off node status gave me a huge performance increase just personally speaking.

I would agree with that, treating them all as the same seems to be an issue they need to be addressed seperately. In my environment I only have about 250 netflow interfaces but probably several thousand at least that would be CBQOS worthy but not send netflow nor be cable of it.

Better for sure but I do not like the idea of advertising the eval to everyone. I have users from network admins on up to VPs that look at the web interface.

For me the number 1 issue would be able to tell that a polling engine has stopped. most everything else can be done through APM for those of us who have it. But I personally think NPM by itself should be able to monitor itself canned and out of the box. -polling -servers -services -job processing -errors like maintenance…

 I do have a ticket in on this as well. I was told by support this is now the expected behavior due to the ability to now unmanage on a schedule. It does not make sense to me and I think it is silly.

I have a question. How can you "roll up" netflow data? Do we lose granularity after the rollup making anything older than an hour bad for a forensic type analysis?

Number 1 is a great Idea I second that emotion.

Not custom pollers but syslog. Set up your switch for Syslog and have it send them to SolarWinds syslog.

Well in our case we are a large company with about 2,500 printers we know about. We are sure there are plenty others hidden here and there. Our use case would be to be able to discover all printers on the network, identify them, maybe gather stats from them (pages printed etc) and be able to alert on things like out of…

While those are indeed good things, I do not think either point addresses what I am talking about.

Well the whole point is I kinda want Solarwinds to do it.

I have continued testing. I have copied the alert with the same results. I have created a brand new alert from scratch that was basically empty and it too got the same results. Any email address I add appears to work find except these group email addresses. I can send emails all day to them outside of SW so I know that…

All you need to do to enable netflow on an interface is "ip route-cache flow". If you have flows already coming from an interface nothing else needs to be done. You can also use instead of "ip route-cache flow" , "ip flow ingress" as well as" ip flow egress". With those 2 you can obviously pick a direction for the flows…

I think the way in which SolarWinds as a whole slaps around a DB is its primary scaling issue. If you guys can solve that or just make it much better I think you will put yourself into a position where you can scale up easier, with less hardware and grow larger.

A new external node does the exact same thing.

As a customer I can say honestly that this kind of reaction is just what we would want to see. We appreciate the quick and honest replies very much This is also one of the huge pluses of a support vehicle like Thawck. I look forward to the support improvments. I have been a SolarWinds customer since the late 90's so I…