HerrDoktor · Grumpy human · ✭✭✭✭✭

documentation.solarwinds.com/.../kssng_adminguide_action_log_to_db_bulk.htm

There should be a field somewhere with the Group-SID or something. If that field is empty, it’s an individual user, if the field has a value, it’s derived from a Group Login. I can have a look in SWQL Studio later and update my post here.

Yeah, that 1-2 second polling makes less sense with every new information presented. reduce to 60 seconds and you should be fine. Convey the customer that their requirements don’t make sense and are way out of anything useful.

This is dependent on your SolarWinds Server‘s regional settings. Mine is set to 24hr schema and my charts look like this 

So the alert response will be conducted by a human being? I don’t see any need for a polling frequency of less than 60 seconds if a human is in the equation. Especially when the human is looking at a screen. You can not refresh the screen every second … a human interaction always takes time, a minute more or less should…

Check the „entity“ that is added to the Group. If it is not a „Node“ entity, SAM assignment won’t work. Even though a VIM entity might resolve in the end to a Node, it won’t do it, because the SAM Template Group Assignment can‘t traverse the SWQL tree. a bit complex to explain but I hope you get the idea 

What benefits is the customer expecting from a 1-2 second polling and from the real time polling? The shortest polling interval is 10 or 15 seconds, with the exception of ad-hoc Real time polling on demand in a browser. Who will be managing/Responding to the alerts this 1-2 second polling is generating? how long is the…

Kiwi Syslog is simply just receiving the logs from your devices. In most cases the majority of the config is done on your router/switch/appliance/server. The next thing to check is if you are receiving any Syslog/trap. then you need a rule that displays the message or logs it to a file. In a nutshell it’s pretty similar to…

You can put filters on whole views in the classic dashboard. If you have modern dashboards, you can adjust the query to only include your desired nodes 

You mimic most manual processes. In the templates You can „re-purpose“ some steps for other things. Once you abstract the whole template as a series of SSH commands you can make most of the tasks work. It’s not out of the box unfortunately, but you can get quite creative with those templates.

Are your switches in install mode or bundle mode? you need to see NCM as a SSH-Robot. I usually ask my clients „show me how you do that manually over the CLI“ then we build the templates from this „process“

You can use an Agent monitored device as a Remote Collector for SAM. No APE needed documentation.solarwinds.com/.../sam-orion-remote-collector.htm

Even added more lines and objects, still works

looks like a bug... working on my instance - Version 2024.4.0

SolarWindsObservability Self Hosted ->SWOSH the new name for what we know as „Orion“ or „Solarwinds Platform“

Here‘s the list of 3rd party software used by SEM https://documentation.solarwinds.com/en/success_center/sem/content/sem_third_party_software_list.htm I have seen Spring on there and the version that is used seems to be in the list of affected versions. However,It has been the situation in the past, where Solarwinds used a…

I personally am a fan of doing Backup/Restore, because there are a lot of paths for a database you need to adjust when you are trying to move mdfs and ldfs. please do not attempt this if you have zero SQL knowledge. You can mess up your instance by doing things the wrong way. get a DBA on board, someone with the right…

Oh Cool. Didn’t know that this works. Thanks for the info 

only a restore from the database would bring the view back. if you really want to go through the effort: Build a new Solarwinds Server, hook up a backup of your Solarwinds Database, export the view https://github.com/Mesverrum/MyPublicWork/blob/master/ViewExporter.ps1 and import it…

To be honest, the app did not get an update for the last 5 years if I read that correctly in the release notes. my Suggestion would be using Safari instead of the app 

The widget for the monitor will most likely just show the event when it happens briefly. That’s why I would go for an alert

Monitor the security logs on your domain controller for the corresponding event. Create an alert without reset condition for the event occurrence. Create a widget that displays this alert 

Is your WHD published externally? If not, are you logged in via VPN to the corporate network? Can you open the WHD website in safari browser?

Maybe you have putty as the default app for ssh links.

It seems there is no column „error“ in the ncm.transferresults table. i Don’t have my swql studio right now but can check later —- edit — I assume you want errormessage -> change error to errormessage in line 35

Thanks for your confirmation. Glad I could help 

Here's an example: Both Maps have the same devices on them but grouped totally differently. One map is by device type, the other one is by physical location.

 Network Atlas Deprecation Reminder you might want to look at creating it fresh with „orion/intelligent Maps“ other than that, it really depends on the nature of the map. Upload a nice background and place the elements accordingly. Or draw „boxes“ around logically grouped devices. there is no „best practice“ really as…

I have not found anything to work around it yet. That’s what lead me to create the feature request. 

You definitely need more disk space as the logs are stored in both formats. Also a bit more load might be noticed. so just be careful with your desired retention. Keep an eye the „oldest log“ widget