FormerMember ✭✭✭

The way the initial handshake works is: * Agent detects it doesn't have any certificates (first line in the log) and needs to get itself signed by a manager appliance. * Agent connects to the given manager appliance IP on port 37890 (outgoing port 37893, there's basically a pool and that's the first one it chooses) *…

Guessing by the lack of noise, nobody is aware. Have logged support case to find out and are looking at the customer preview program post 3.11 as its touted as a potential product capability.

You create an alert as a "rule" in the Trap Viewer. Is that where you're stuck? To configure Syslog Viewer filters and alerts: 1. Click Start > All Programs > SolarWinds Orion > Syslog and SNMP Traps > Syslog Viewer. 2. Click File > Settings. 3. Click View > Alerts/Filter Rules. 4. If you are creating a new rule, click Add…

Okay, I haven't done this yet, but from reading the post from Choly, Andy's suggestion won't work in any case as it is for NetFlow not CBQOS. Is there a matching DB entry for CBQOS based retention that I can use instead?

I've sent a ticket to SolarWinds and they answered me: Hello Sergio, The script ALTER SEQUENCE job_ticket_seq RESTART 26000; will not delete the tickets, it will only restart the ticket numbering. So for example, you reset the numbering to 26000, if there are tickets available in that range, let's say, a ticket number of…

First, I'm sorry you're having a problem. Dev is going to look at your ticket to see if we can help you work through it. Now why do we have an embedded database in the first place? Well, we use it to store job scheduler configuration information. We do not store APM (or any other) polling results in the CE database. The…

I see it cost over 1,000 for IPSwitch, well that's the product we had prior to Orion. We will just keep IPSwitch and Orion running in tandem until Orion integrates it into their software. Thanks

I found the fix. You have to re-apply the v3 credential set from the system manager, you cannot do it through the web interface. Why these nodes lost the credential set I'm at a loss.

Evan's right - the only thing you can do is use monitor users and set up their filters to be restricted. They can see that a node exists, but they can't really do anything with it, and they can only see the filters that you set up for that user. Set user to regular user (admin or auditor so they can create filters) Log in…

Let us know what you guys find - we might have to build a new connector to get it all working (we too would prefer a free method that we can refer customers to consistently). To our knowledge Novell's last official word on eDirectory auditing was to use Novell Audit/Identity Audit to store the data in a database, and that…

We do have eDirectory connectors. Unfortunately eDirectory auditing has gone through a few iterations Earlier versions used syslog, but as of late it's been in a database. Our experience is fairly limited (1-2 customers) but we have seen it work. You'll have to configure the auditing side to log to the database, then…

 

We have given up on UDT, it's not really fit for use without this feature and we have been waiting for 2+ years for the features that are required to make it useful.

A question for the product manager's. Will it pull this information from IPAM if it's monitoring DHCP on an Cisco ASA (or an Windows DHCP server)? Currently I'm starting to set up UDT and I'm seeing patchy mapping of MAC addresses to IP addresses. This seems to be down to different hardware at different sites (i.e. L3…

Theoretically, the rule you want to build (show me any access/changes to the file path ending in web.config from my web server): File Audit Events.FileName = "*web.config" AND File Audit Events.InsertionIP = "<that system>" File auditing has multiple points of failure, so if you need to backtrack, you can narrow down…

Hi, If an agent is configured to communicate with an LEM manager, it will establish a TCP connection and you will see heartbeat traffic between the manager and agent. Only logs configured in the connector will be read and normalised data transmitted from the agent to the manager. Any rules which have an active response to…

Jon, Thanks for the response. How do you get this info from Cirrus? What information from the switch is it using to get this?

My sales rep told us Dual core 2GB Memory

This is definitely what I have been looking for. I currently use another product for this and it would be very useful to incorporate this into Orion since it is monitoring the switches anyway. Can this be added to a future version of Orion???

So after some help from Steven Klassen we found the issue(s). It ended up being the poller that I downloaded was set to "get next" instead of "get". This meant that I was actually polling the next OID in the tree. We fixed that issue and then we ended up deleting the alert for it and creating a new one with a unique name…

Hopefully this helps!

RDP and ICA ports are standard port monitors. Logon counts are available using WMI, but I don't have a query handy. I duplicated one of the existing templates and added the following: Active Users via WMI Namespace: root\Citrix Query: Select NumberOfActiveSessions From MetaFrame_Server Description: self explanatory…

Ok so I created a new poller and it does the same exact thing as the original one. Its weird because when I test the poller I get the correct number of percentage. I will attach a screen shot of it. I found out that the number I am getting is the output of the UPS. I unplugged everything from it and the…

I had a quick read through this,... very good. i would however, like to see a little more detail on custom poller impact, i.e. number of them per node, how they are polled on the same frequency as the node etc.. Definitely more information on what the diference is between the 2 diferent polling parameters in the tuning…

After running SP3, make sure to run the Configuration Wizard again. According to the screenshot, you're still at 9.1 SP2.

In APM 3.0 (which will be out very soon), we have a new "file"age" monitor. This component monitor determines when a file was last modified and reports the date as a statistic. If you want to be sure that a file has changed, you could just set the the threshold for warning/critical if the file age is greater than 5 minutes.

We made some big changes in between 8.1 and 8.5, but really, we haven't changed it much since 8.5, except to extend it to new modules like APM.

The warehouse stuff is deprecated functionality that we just haven't removed from reports yet - a while back we supported warehousing to a SQL server but the performance constraints of LEM (and high volume log data) made it unfeasible to continue supporting. Essentially, you can only run scheduled reports against your LEM…

Thank you Bronx, but those links didn't answer my question. I am having a hard time wrapping my head around the concept. Why is the default 300 seconds for both. What would be some scenerios where you would want the polling frequency/timeout to be more or less? We are not worried about polling engine utilization because it…

I made some progress on my own. I went back to the device that was getting slammed by 10's of thousands of snmp packets from NCM. I ran inventory for just that device and same thing. Hit 20K packets very quickly. I noticed in the packet trace and the inventory status window that it was trying to go after the IP CIDR Route…