Seashore · Solutions Architect · ✭✭✭✭✭

Hi, with below query you see all unacknowledged alerts and the link to the right "ack's" the alert. But you don't get any popup.... SELECT AC.Name as [Alert Name] ,CASE WHEN MINUTEDIFF(A.TriggeredDateTime, GETUTCDATE()) > 1440 -- More than 1 Day (1440 minutes) THEN (TOSTRING(ROUND(MINUTEDIFF(A.TriggeredDateTime,…

Hi, are we talking Netflow data now? From the NTA module?

@"adam.beedell" is correct and below is the whole query you should run in SWQL. SELECT COUNT(H.HostName) AS Value FROM Orion.VIM.Hosts AS H WHERE H.ClusterID = 40 -- YOUR ID HERE AND H.Status IN (1,3,14) By adding "WITH QUERYSTATS" to the end of the query, when running it in SWQL Studio, you can see the actual SQL query it…

Hi, I have created an alert rule that uses the data from AppInsight for SQL, this one gathers agent job status. The alert rule is a "Custom SQL alert" (Should probably rather be a custom SWQL alert but I haven't converted it yet) Below is the code you use in. The last to lines is to filter on the SQL Agent job names. WHERE…

Hi, you can solve this with a "Custom SWQL Alert". Below example is for when more than 10 Nodes named "*-VDA-*" is down. You can change that part to something that matches your environment. This alert WILL "assign" the triggered alert to one of the down VDA-nodes, but that's just how it has to be. -- Part that SolarWinds…

Not with SWQL, but you can add several limitations to a single account. 

Hi Just add "WHERE v3.Node.Vendor='Cisco'" SELECT v3.Node.Caption, NodeID, ROCred.Name as ROCredential, ROCred.SettingValue as ROCredential_Index, Username, Context, PrivacyMethod, PrivacyKey, PrivacyKeyIsPassword, AuthenticationMethod, AuthenticationKey, AuthenticationKeyIsPassword, RWCred.Name as RWCredential,…

Hi Below query looks in the audit log for the login-events. So you see how many logins there are per day. Might be that not all have permission to read this, might need to be admin. Hope that is ok anyway. SELECT COUNT(A.AuditEventID) AS QTY ,DATETRUNC('DAY',A.TimeLoggedUtc) AS LoginDay FROM Orion.Auditingevents as A WHERE…

Hi, do you have HCO? Do you have subscription based license? If you have and license is expired then the platform will not work anymore. You need to renew your license.

Added to @"bobmarley" ´s query column for IP-address also. Filtered it to only show IPv4, remove if you don't want that. Also where you can filter on your custom property SELECT top 100 I.FullName AS InterfaceFullName ,I.PhysicalAddress AS InterfacePhysicalAddress ,I.Node.Caption AS NodesCaption…

Hi Here is a Query that should give you what you want. Adjust it so it fits your needs. SELECT TOP 100 N.Caption AS [NodeName] ,AVG(N.ResponseTimeHistory.Availability) AS [Availability] FROM Orion.Nodes as N WHERE N.ResponseTimeHistory.DateTime>ADDDAY(-7,GETUTCDATE()) GROUP BY N.Caption ORDER BY…

....and here is some code to show number of tickets per state. Maybe you can use that to show what you want. SELECT I.State ,Count(I.ID) AS QTY FROM Orion.ESI.AlertIncident AS I GROUP BY I.State

As said, you can only run queries on a widget against the solarwinds databases. So first you want to monitor the values, to get them into the database. I wrote some about that some time ago, read more here: SQL Query monitoring in Orion SAM – best practice

Hi, I don't think that is possible in SWQL but in SQL it's doable. I would try to use a "FOR XML PATH" to solve this. Think that will work.

Hi, below is a script that I have been using for some time. I looks for all certificates that expires within 30 days in the computer store on the server. [CmdletBinding()] [OutputType([String])] Param ( #Specify friendly name of certificate to be excluded $FriendlyToExclude='xxx', [Parameter(Mandatory=$False)] [int]…

Hi As many tables are pre-joined you don't have to use "inner joins" when using SWQL (most times anyway). So, you can use below as a base: SELECT N.NodeID ,N.Caption ,N.CustomProperties.City ,N.VirtualMachine.DateCreated FROM Orion.Nodes AS N We start at the table "Orion.Nodes" and then jumps to both…

If you have asset inventory added on your server you can use something like below, or a combination with looking at "orion.VIM.virtualmachines". SELECT N.Caption ,CASE WHEN HW.Model LIKE '%virtual%' THEN 'Virtual' WHEN HW.Model LIKE 'VMWare%' THEN 'Virtual' WHEN HW.Model IS NULL THEN 'Unknown' ELSE 'Physical' END AS HWType…

Is this another DNS server that you want to monitor, other than the one your solarwinds server is already using? I guess you already have dns enabled and opened to your solarwinds server so nothing more to open, unless this is another dns server you want to check. If you want full control, add a powershell script that does…

It really looks like the action is not approved yet. Can you just verify that. Go to the Actions tab in manage alerts, group by "approved" and see if your action is under "need approval". Then it is not approved yet.

Just tried your query in SWQL studio, without your custom properties of course. I ran just fine. Is it working without the where-part?

Hi I think "port mode" is the filter you are after:

Or add object as an "External node" with no status polling, and add a "SAM TCP Check" on port 22. Not as "heavy" as netpath.

Manage SAM application monitor templates and application monitors (solarwinds.com)

Hi I have reported that and got a response: "Per our investigation, this is a known issue. As of now, there is no viable workaround and the fix is projected to be in the next release." #01534551 is my case. On 2023.4.2 So nothing to do about that right now.

Can it be that it found a VM that has the same hostname and/or IP-address as the Brocade? Can create strange connections. Check your SQL for Solarwinds and the tables [VIM_VirtualMachines] and [VIM_VirtualMachineIPAddresses] for name and IP that exists on the Brocade.

No the service account the dpa (ignite) service is running with has nothing to do with the connection string to the dpa repository database. The file the error message mentions has the username and password to the repository database, password is encrypted. If you have changed the service account I can imagine, but I'm not…

 Maybe you can find something in this log file: C:\ProgramData\SolarWinds\Logs\OLM\TrapService.log

Hi, don't know what the polling interval is but I have data about snapshots less than 12h old. (don't know if any newer exists). Looked for polling interval for VMAN but couldn't find anything related to that. 

Proved to be harder than anticipated to filter out just the physical server but hope this will do. SELECT N.MachineType AS [OS] ,N.Caption as [Node Name] ,N.IP_Address as [Node IP] ,N.Location ,N.AssetInventory.ServerInformation.HardwareSerialNumber ,N.AssetInventory.ServerInformation.Manufacturer…

What product are you talking about? SolarWinds ServiceDesk? On thwack itself?