Seashore · Solutions Architect · ✭✭✭✭✭

We differ "Alerting" from "monitoring". First you have to monitor if users are added to the group, then we create an alert. Alert is easy, monitoring that is ... more complicated.... Either you might be able to write a powershell script to see that. Try if first outside orion, if that works it can be tweaked for orion…

No challenge - I use Orion ;-)

Doesn't 401 mean "Unauthorized"?!?! "he HTTP 401 Unauthorized client error status response code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource."

...and so I thought also. Until I read this post: https://thwack.solarwinds.com/product-forums/server-application-monitor-sam/f/forum/90052/windows-powershell-monitor---output-message-history Seems there is a message history stored after all....

Change "else 0 " to "else 99" and you will see :-) But status is only a number. We can change to "statusdescription". Then also add some code for the url: SELECT TOP 1000 [Alerts].AlertObjects.EntityCaption, [Alerts].TriggeredMessage, TOLOCAL([Alerts].TriggeredDateTime) AS Alerttime ,CASE WHEN…

Don't know, probably not. SQL 2017 was not thought of when NPM 6.4 was brought to life

Going from NPM (?) 6.4 to 2020.2.5 will require a lot of small steps. You can't go directly to the latest version. In your customer portal there is a upgrade-advisor to show you the steps: https://customerportal.solarwinds.com/support/product-upgrade-advisor, but that only goes back to NPM 10.2. I suggest you contact…

Did this: SELECT TOP 1000 [Alerts].AlertObjects.EntityCaption, [Alerts].TriggeredMessage, TOLOCAL([Alerts].TriggeredDateTime) AS Alerttime ,CASE WHEN [Alerts].AlertObjects.EntityType='Orion.Nodes' THEN [Nodes].Status WHEN [Alerts].AlertObjects.EntityType='Orion.NPM.Interfaces' THEN [Interface].Status ELSE 0 END AS…

Tested and have the same issue on both 2020.2.4 installations I tested on. So go ahead and upgrade, you will just keep this bug ;-)

Use SNMP? Depends on what you want to monitor on them.

Or why go through powershell at all? Why don't do it all in SQL with a "SQL Component" instead of a powershell component. Below will give you (I hope) how many certificates that expires within 14 days from the database. Normally it gives you 0 back. Set a critical threshold when statistics is more than 0. The message part…

Looks like you haven't added any credentials to the Invoke-SQL. Maybe it's working when you run it manually because it uses your credentials. But when Orion runs it it doesn't have any credentials. Maybe you can check the SQL log to see if you have any failed logins when Orion runs it. (might not be there). Think you have…

Ok, good. I haven't done many reports in UDT but I'll try to assist. There is a pre built report called "Active Endpoints". I edited that, edit the datasource, choose "advanced selector" and add the filter as per below: Now, the report is filtered on only one type of MAC-addresses. Did that help?

If you are not monitoring each interface AND each Windows workstation - which i don't recommend, I suggest you run the module "User Device Tracker". That module is built just to show exactly that.

Here is a start for you: SELECT TOP 25 E.EventTime, E.NetworkNode, -- Related Nodeid E.NetObjectID, -- Related appid Message, Acknowledged ,ET.Name -- Eventtype ,ET.Icon -- Eventtype icon FROM Orion.Events AS E INNER JOIN Orion.EventTypes AS ET ON E.EventType=ET.EventType WHERE E.eventtype IN (SELECT EventTypeID FROM…

If you are using a proxy there might be different settings from your account and the one Orion uses. Do you use proxy?

Yes. Assign the template to all SQL servers and edit the once that have different instance names. ("Override template")

So, you should only use THIS template on SQL servers, of no SQL instance is found the component will be down. If you have this template on all your SQL servers and they have SQL installed as a default instance, you should not be needing to change it. I try to learn that in orion monitoring is one thing and alerting…

If you have a SQL Named instance, the SQL service name might be different than the default. So check the service name on the node and if needed update the template if needed:

Another thought ; a sam application running every 12h with no credentials? 

Strange. A couple of ideas: Can it be the maintenance job that runs that long? Doing the same thing at about 3? Do you have a scheduled task running then? A scheduled report?

Created an IIS Server Basics template. Attached below. Change the http and https components to match your environment. Add more or disable as required. Probably you need to adjust the url they point to also. Hope it works fine for you!!…

For IIS, if you don't want to use Appinsight for IIS, it is good, there is another template called "Internet Information Service (IIS) 10". It looks at alot also. But in there you have the service. you can disable to component you are not interested in. Also you can add a http- or https-monitor to check if the website is…

So this: SELECT --o.AlertConfigurations.Name, AC.Name FROM Orion.AlertActive aa INNER join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid INNER JOIN Orion.AlertConfigurations AS AC ON O.Alertid=AC.Alertid WHERE o.EntityNetObjectId LIKE 'V:%' does not work for you in 2020.2.5? It does work for me.

Had to test in another 2020.2.4 - did not work. Validate query shows green but actually running the query results in error. The the manual join and it will work.

I can't get that query to work in 2020.2.4 either. BUT, doing the joins manually works. SELECT --o.AlertConfigurations.Name, AC.Name FROM Orion.AlertActive aa INNER join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid INNER JOIN Orion.AlertConfigurations AS AC ON O.Alertid=AC.Alertid WHERE o.EntityNetObjectId LIKE…

C:\ProgramData\SolarWinds\Logs\Orion\ConfigurationWizard.log That log can probably show you what the problem is. Probably it will show you that some SQL query failed. Use that and see what is wrong in the database.

Yes, this is for SAM. I have tried to share the template for this below, hope it works. So in a SAM template you can have different components. For example some that monitors services, like the SQL engine service, and other components can run SQL queries against the monitored server, the "SQL Server User Experiance…

To monitor that the SQL Engine service is running you only need normal windows server credentials. Then I should ran some SQL query also to see that its actually responding also. What the ask is up to you but I ask how many databases that are NOT backed up last 24h. That is a good thing to ask also. SELECT d.database_id,…

FINALLY I got it right :-) ${N=SWQL;M=SELECT TOP 1 SUBSTRING('${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}',0,150) AS [Output] FROM Orion.APM.WindowsEvent} Use that variable. Change 150 to whatever length you want.