Lofstrand · Solutions Architect · ✭✭✭✭✭

Hi, you are mainly correct. One thing to add though, timing on polling intervall and alert trigger intervall are not aligned. Meaning that for example, first poll might happen at 10:05 and first alert evaluation at 10:09. Second poll at 10:10 and second alert evaluation at 10:14.

You can write your own queries for monitoring for example long-running queries or replication health, as long as you "ask the question" in the right way. Have a look at this article I wrote some years ago, can give you some inspiration: SQL Query monitoring in Orion SAM – best practice - THWACK

Hi, are you talking about doing this in NPM or IPAM? I would, in both products, create custom properties where you specify what organization the IP belongs to. Custom properties can then be used in alerts, reports and dashboards etc. Custom properties can be updated on several entities at the same time, or through the API.

Hi I would check two things: First the log file for that application monitoring. Look at the MPE at C:\ProgramData\SolarWinds\Logs\APM\ApplicationLogs, there is one folder per application ID. Enable debug monitoring on the application if needed. Does those logs show anything? Also, I would check if you have any reverse dns…

Almost 100k rows in one report, that is not little. If you tweak the report into showing less lines, does it work then?

Hi @zap123 Have you checked on your solarwinds servers, how is the memory pressure? Are these reports very large? Can you narrow down the timespan, if applicable? I would recommend opening a support case if you don't see any obvious when testing the above things.

Hi, looks like this could be a known bug, fixed in 2026.4. I suggest you ask support about it, refer to his issue: OO-53534

Hi Are you talking about custom SQL Views, in the database? If so, they will not be available via the API. You can only access original things in the solarwinds database, no custom views, tables or other databases.

INNER JOIN ( SELECT N.Uri FROM Orion.Nodes as N WHERE N.Vendor='Cisco' AND (N.Caption LIKE '%DC1-R0%' OR N.Caption LIKE '%DC2-R0%') AND N.NodeID NOT IN ( SELECT L.NodeID FROM Orion.OLM.LogEntry as L WHERE L.MessageDateTime>ADDHOUR(-1,GETUTCDATE()) GROUP BY L.NodeID ) ) AS T ON Nodes.uri=T.uri

Hi @Strux I have such an alert ready for you. You need to use a "Custom SWQL alert" for that. Looks like this: The code in be customizable part looks like this: INNER JOIN ( SELECT N.Uri FROM Orion.Nodes as N WHERE N.CustomProperties.City='Örebro' AND N.NodeID NOT IN ( SELECT L.NodeID FROM Orion.OLM.LogEntry as L WHERE…

If it's certificate information you want to get an output on, why don't try creating a SAM Powershell component. That powershell component can get out the certificate information and that can be parsed into a report or what you want.

If you send the windows events to OSH, you can see them under "My dashboards" / "Logs" / "Log Viewer". On the left hand side, filter on the type of logs you want to see.

Hi @quannm546 Try below SWQL query in a Custom Query Widget SELECT TOP 10 I.Node.Caption AS [Node] ,I.Caption AS [Interface] ,I.LastChange AS [Last Change] ,I.node.DetailsUrl AS [_LinkFor_Node] ,I.DetailsUrl AS [_LinkFor_Interface]…

Hi, I don't think it's possible to get out the actual content of the [content] column, as it's stored as binary. SWQL does not have that capability.

Try this to start with. It will replace the credentialID for nodes with a certain custom property value. Find the new credentialID number you want your node to have and add the Custom property value to search for (or add your own filter). This only updates SNMPv3 RO credentials. Can be that you have RW credentials. Then…

You can try running below SQL query against your database. Will check if where a username is used. Can be more places as @cnorborg says. Another place can be vmware/hyperv monitoring. SELECT c.ID AS CredentialID, c.Name AS CredentialName, c.CredentialOwner, c.CredentialType, cp.Value AS Username, -- Node usage n.NodeID,…

Try to use this in a custom query table widget. SELECT C.Application.Node.Caption AS [Node Name] ,C.Name AS [Component Name] ,C.DetailsUrl AS [_LinkFor_Component Name] ,C.MultipleStatisticData.Label ,C.MultipleStatisticData.StringData ,C.MultipleStatisticData.NumericData FROM Orion.APM.Component AS C WHERE C.Name='SSL Cert…

You can start troubleshooting at the following logs on the main server: C:\ProgramData\SolarWinds\Logs\Orion\ActionsExecution.log C:\ProgramData\SolarWinds\Logs\Orion\ActionsExecutionAlert.log They might be able to tell you if there is an issue on the solarwinds side.

Hi How do you access the API? What authentication method do you use? I doubt this is something with SolarWinds, can it be something with certificate chain/root trust or client-auth certificate binding after a Windows updates?

Depending on how the alerts are designed, there is no possibility to check this. Alerts are not bound or connected to entities, it's queries against the database towards all the entities. Different customers set up how they want alerts in different ways, so it's almost impossible to have such a generic alert.

I would create a custom property to manage the two groups, with Critical vs non-critical. Then I would create email distribution lists, that contains the required recipients, naming the DLs like "critical.alert@company.com" Then on the alert rules, configure the email action to send the emails to an address built up by the…

Have you filed a support case on this? I do see others having the same issue (or it's your case I see….) If not, I suggest you do, to create higher attention to this.

I guess it depends on how you customized it, but there are agents for Linux and Cent OS: More on the agent requirements here: https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-agent-requirements-sw476.htm

That is what archiving is for. Have a look at https://documentation.solarwinds.com/en/success_center/ncm/content/ncm-configuration-settings.htm?cshid=OrionNCMPHChangeArchive for more details.

Hi, there should not be any hard limits for that large config files to be downloaded. However, there might be performance issues when those files a viewed in the web browser, or compared with older versions of the files.

Is it just stuck at that page/picture? Nothing more happening? No error messages? You can check the log file, might give you more clues. C:\programdata\solarwinds\logs\orion\configurationwizard.log (hope I remember the path correct :-))

I have not heard or seen anything like that. Suggest you open a support case to dig further into that.

From the Active Directory Domain controller? Either use event log monitoring, or use the AppInsight for Active Directory. Both included with SAM and Observability Self-hosted

If you are using an http/https component, then it looks like this in perfstack. Doesn't say "responsetime" right out, but it is that: There you have response time in ms. Corresponds with this:

I suggest you add the charts you want to a PerfStack chart, save it and add it to Modern Dashboard as a Time series widget.