SteveK ✭✭✭✭✭

Hyperlink dropped me to the bottom of the page and didn't see your comment, sorry. I guess it coming from 2 folks it must be correct then

If there is a preconfigured widget in the classic dashboard, you could use that for starters. You would most likely need to build a group and then limit the view to that specific group. Besides the precanned widgets, SWQL will be your best bet. SWQL is pretty much SQL queries. They have some preferred/best practice ways of…

We are still on the legacy licensing. I was under the impression that HCO allowed you to spin up APEs as needed. We have had the best performance/experience by keeping the primary server pretty lean with assigned nodes (we only have SW infastructure related items assigned to it) and then sending everything else off to the…

@"stuartd" is definitly pointing you in the right direction. The All In document is a great starting point. @"KMSigma.SWI" has this published: Overall Node Availability (Last 7 Days) - Modern Dashboards - The Orion Platform - THWACK (solarwinds.com), which will give you the logic for the Node Availability - Last 7 days.…

I always avoid using the out of box alerts since you can not modify them. You could copy the alert though and make modifications to that. Technically speaking you could set the thresholds to be high enough that they would realistically never trip, but I wouldn't recommend that route. I would setup a custom property to be…

If you are using the "Out of the box alerts" you won't be able to. The alerts that get installed with SolarWinds cannot be modified. If you are using a custom alert, that that one really depends on how you have your alert configured. There are a couple different approaches to accomplish this, and it all depends on how you…

Good call. I was thinking there was an easy way to set those in bulk from the GUI, but appears I am wrong on that. Manually adjusting those would be a pain without powershell/api.

@"adam.beedell" adam.beedell is exactly correct on this. We have to go through that for Datastores and WPM/Transaction monitors. We use a prefix on our property names, so that we can quickly filter utilizing the search box. We are also pretty heavy on using custom properties for our alerts, so there is a fair amount of…

We are still utilizing the legacy licensing model. I like alot of the HCO, but with our node count it did add a bit of cost to it.

So are you looking for a report that would give you the alerts that the devices could trigger, or are you looking for a report that tells you the active alerts for those devices?

So custom properties for alerts can get tricky. Are you adding the custom property from the alert object, or are you looking to add a custom property from a hardware sensor, node, app monitor, etc...? If its the node/app/etc..., I do have a query you could use. That was discussed in the thread below. Need assistance…

I've been pushing for the lab environment, but no luck as of yet. We don't have the lab licensing at the moment, and don't really have the time or man hours to consistently be spinning up and decomming a lab for the 30 day window (or whatever the trial defaults to now).

I wanted to do a drop down list originally for the email addresses, but the amount of variations and the length of the text box would have gotten too large to manage. We require the teams to submit a DL to use, as individual names would have been too much to handle as well. The application teams have been wanting to get…

Right now the main problem we run into is folks using the autocomplete or copy/paste and those stupid hidden characters. I don't have anything in place proactively to find them. The query at the end I have on a couple different dashboards so we can reactively get to it. All of our critical systems send out a page as well,…

No question in this one. I wanted to share how we handle our email alerts. I figured discussions could be started or if anyone had a differing view point, I'm all ears on it. In my environment we ended up going this route so we didn't have to create unique alerts for each team. I know each environment is different, so if…

For some reason the following did not work: Where 42 = 'Life, The Universe, and Everything' I may have to report a bug on that one. I also tried 'How many roads must a man walk down' but that still came back as wrong.

Glad its just not me on that one. So now the 2=2 has just become a standard in every SWQL query I write. I never know where the query may end up (Widget, one off run, report, etc...)

Thank you. @"KMSigma.SWI" feel free to use any of it. It took a bit to get the tables we used linked up, and I think I drove one of our DBAs a bit crazy trying to get the subquery sorted out. When I start doing some crazy queries like that, I like to get them involved to make sure I don't cause any issues on the backend…

I wanted to share what I have on my alerting table. So one of the issues I ran into, is we use custom properties pretty heavily for our alerts. Basically all of our emails are tied to a Email custom property for the object type. When trying to create a dashboard for the teams, this became a bit of a struggle since I didn't…

So I do not have anything like this in my environment at the moment. I think it would just be a matter of selecting the Hardware Sensor target and filling in the values. So this is all in theory, but I think something like this would be a good start:

The only way I have been able to do that is via Groups. Under Settings -> All Settings -> Manage Groups, you would need to create a group for your IIS server. I would recommend doing a dynamic group based off of either group name (if you have a consistant naming standard) or you could use a custom property that you would…

Here is what I use on the IIS/Web Server front. Basically it goes through a couple steps: Imports the Web module Builds out an exclusion list (based on your script arguments in the monitor) Retrieves a list of Sites from IIS Uses the sites to build a list of certificates/bindings Then checks the cert store…

I can't validate the query, but the 2 seperate alerts would be the way to go. It looks like you are going about it the right way though. I would have done something similar, where if count is greater than X trigger one alert. Then a second alert but configured to trigger if the count is greater than y. I would recommend…

Yeah the weird spider icon normally means the agent is reporting back in, but there isn't a node associated with it. I sometimes manually add the node (Settings -> Manage Node -> Add Node) and select the agent option for polling. I normally only see that though whenever I've manually downloaded and installed the agent…

To be 100% honest, I'm not sure on that one. I just checked my environment and I'm seeing some nodes with a guest status of warning, but the VMs do not have any active alert or alarm at this time in vSphere.

Yep. I never like to hardcode alert values like that if I can avoid it. There is always some unforseen system that comes around or something like SQL that wants all of the memory. So if I can set something up to a node or SAM based variable, I'm going that route instead.

so if I'm reading this correctly, you do not want to see both alerts. When the alert goes to Critical you want the warning alert to clear. Personally I'm not a big fan of that approach, especially if you have time thresholds in place. If you have a system jumping between warning and critical, you would never get the alert.…

I was wanting to test this out in my environment, so I wrote some queries to hopefully make the configuration hunt a little easier. SAM: Powershell impersonation queries - Forum - Server & Application Monitor (SAM) - THWACK (solarwinds.com)

I thought removing "Node Management" rights hid the Settings menu, but I don't know of a way to prevent them if they have direct access to the url. I know in the past we had some teams that wanted to only see the items they were responsible for. So utilizing the account limitations to a dynamic group based on custom…

much like @"adam.beedell" , I spent a good chunk of time trying to get an answer from SW support on what the difference is between them. The information I was given that if you are in Legacy mode, local execution powershell scripts execute utilizing the account "NT authority\system." I was told (haven't had a chance to…