KITGuy

The intelligent side of intelligent maps stopped working for a few versions but was fixed in 2025.2 maybe earlier. Unfortuantely to set individual maps instead of using $caption you would have to create individual templates for each group which would be insane as setting it to a specific map sets it to that in all groups.…

Thanks Lofstrand. However this returns both this and last month (maybe because it finishes on 1/8 at 00:00?) SERVER027MSSQLSERVERDBAUp1002025-7SERVER027MSSQLSERVERDBAUp1002025-8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Command "D:\SolarWinds\Scripts\SNOW\PROD\SNOWAPI_DPA.ps1 '${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData5}' '${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData4} on ${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData3}' '${N=OLM.AlertingMacros;M=OLMAlertMessage.VbData4}…

For Trap based alerts we use a powershell script that uses json to create service now incidents. I can share that if thats what you are after.

Before I think about anything else in your post.... The KPI is for the last month taken from 00:00 1st of the month back 28/30/31 days (Its irelevant in this case from any other point in time). A running KPI for the current month is also desirable. If too difficult I can just push out the weekly raw data and they can stich…

That works thanks! and its a bit neater then what I was trying. Further question... How would I account for data rollup in this calculation? If raw is 7 days old and hourly is 35 days old, the raw would skew the average correct?

Could be the techs havent added them when adding them to SW or the System account has removed them as a UID has changed at some point. There is some discussion of that in this thread: (+) What nodes don't have their disk volumes monitored? - Forum - Network Performance Monitor (NPM) - THWACK Run a network scan of your…

My install has been doing this for months. It will also create a duplicate VIP sometimes. It eventually makes the Orion Module service stop on the non active server. I have manually set them to the correct registry settings after stopping the services and it re-occurs. I have just upgraded to 2024.4 and it is still doing…

It does help, thanks

Hi @"KMSigma.SWI" , what are the equivalents for "This Month" (fixed)?

It should discover all elements on first pass and then second pass remove those elements that are already monitored. This should leave anything not monitored and not excluded. It can be a bit buggy at times where it doesnt remove monitored devices and their elements on subsequent passes. I have found many unmonitored…

I just use the Network Discovery feature. You can discover via IP address' or subnets. Set it to 'Manually set up monitoring after devices are discovered'. Then when finished check the Scheduled Discovery Results for any volumes\interfaces that are not being monitored. Set to ignore any that don't require monitoring like…

That too. I also run weekly scans on the subnets where servers are built to detect new volumes, interfaces etc.

Just a heads up, the system user can delete volumes from monitoring. I believe this occurs when the volume is modified by the hypervisor and it has a new ID. Can be detected and alerted against by looking for the Auditing event message that starts with "User SYSTEM deleted volume"

My problem was both powershell and regex and not knowing how they work very well. I would have thought by now though there would have been this script developed by someone. Surely i am not the only one who has wanted to take data out of a logfile and compare it for whatever reason. The write-host lines are split in the…

Got it. The script didnt like me using $line as the text source. Used $resl and it worked. [regex]$rx = '(?<=Total IDOCs processed: )([^\s]+)' $idoc4 = [int]$rx.Match($resl).value Thanks for your help @"KITGuy" Much appreciated 

Even though no one has replied I will post my findings. I am close but my regex that works in powershell doesnt appear to work in SW. So in Powershell: PS C:\WINDOWS\system32> $line 2024 May 22 20:03:56:079 GMT +1000 SAPConsumers-EmployeeTimesheetDetailsSAPAdapter Info [Adapter] AER3-000091 Total IDOCs processed: 15868…

${Caption}

No idea haha.... I am just the Solarwinds admin at the site. Maybe Product Documentation | ServiceNow

I had a similar issue when integrating and it turned out for us that the snow service account didnt have a language set as per the case notes below: -We run the below API calls to see the permissions applied on the service account used by SolarWinds for SNow integration and if it returns the needed values for the incident…

They are manually created. Select 2 objects on the map and hit the connect objects button. Then connect the interfaces.

Now I get: Provided SWQL query is not valid. Details: RunQuery failed, check fault information. Cannot resolve property ‘Disabled’

I get the error: Provided SWQL query is not valid. Details: RunQuery failed, check fault information. mismatched input 'as' expecting 'END' in Select clause

This is how I had it essentially. Unfortunately if the volume is going up and down around the critical threshold then the alarm clears and reappears over and over. In the end I set the reset condition to volume status = up so that operations need to clear a decent amount of space to clear the alarm\incident. Thanks everyone

So here is the ups configured for v3 auth priv. The device configured to use v3 auth priv. The notification section to use v3. A trap recieved using v1. I dont see anywhere I can use the Notification Username in Solarwinds.

From SW support: Please refer to the below steps for the resolution Resolution Workaround 1: Reset the Thwack account password with a new password without any special characters. Workaround 2: If you have a Server and Application Monitor (SAM) module, you may try the following workaround: Go to Settings > All Settings >…

Yes. The issue is that Event Viewer/Analyzer cannot discriminate between an alarm from the same source and title. Alarms from DPA will all have the same source and the alarm title will be the same for all traps originating from DPA with the same issue. When integrating these alarms into SNOW you end up with a mess of…

Does no one have this issue but me? If I want to create an incident in SNOW from DPA I can have 1 active incident per configured alarm at a time. So if I have an AG status has changed alarm for 100 Db instances only one instance can have an incident in SNOW at a time. The same goes for any other trap source so anything…