SteveK ✭✭✭✭✭

Without knowing your environment or what SolarWinds moduls you have, I can only take a guess. So my initial thought is to go through "Network Discovery." This is very contingent on your licensing though, if you have unlimited nodes then it shouldn't be an issue. There is an option to Manually add monitoring later. So maybe…

Awesome. Glad I could help. I guess mark it as an answer so if others run into the same issue they can see it in the forums.

So going at it from a purely Node/Application/Component side. Your alert object would be component. I would then build out the scope to include both the component name and application name. Then your trigger condition would need to be the advanced block with the different groupings for component down and node name is X.…

So thats is what is interesting with this. I haven't ran the numbers yet (if someone has, please jump in) but I know SAM monitors will switch from Up/Down/Critical/etc... to unreachable whenever the target node is down. With it being unreachable, I'm not sure if the SAM piece is still attempting to execute its various…

I have seen some weird behavior in the past were the alert will not trip unless the monitor was at one point in an up position. So you maybe need to start with something simple like print spooler that you could hopefully start/stop at will. I'm curious if SolarWinds groups would be better for something like this. I haven't…

Under SAM components there is a "Service Status - SNMP" component, but that looks like its for checking services in Windows. This is a few years old, but looks like someone wrote a script to monitor the Linux services. Not sure what would need to be updated, but probably a starting point. RHEL_CentOS 7 Service Checks -…

I think the component id is going to be your problem on that one. I want to say 264 is the template id, and each component would receive a new component id whenever its applied, so not really scalable. You would probably want something like: If you rename the monitor when its applied to the node, then you would need to…

If you are trying to just verify if DNS is functioning from a different source than a DNS server, then as Seashore mentioned, Powershell would probably be the best way to go. Write a SAM Powershell monitor to check DNS, if failed report down, if the resolution time exceeded y warning, exceed x then critical.

Out of the box, not that I'm aware of. You would probably need to build out some kind of Windows PowerShell Monitor or Windows Script Monitor to get the data you are looking for. That would probably be a bit limited on how you would present that data though. Going a bit more abstract, which this would be really in theory.…

I'm not that well versed in Linux. As far as I know the service monitor side is a windows deal in SolarWinds. I checked a couple of our linux nodes and could not see a service option. You could create a SAM template using the component Type of "Process Monitor" to check on the status of the process, then report Down when…

So there are a couple things to unpack here. So you can have multiple components (all the same with Windows Service Monitor or Mixed with multiple different component types, go as crazy with them as you would like) and there are a 2 main approaches to alerting on these that I'm aware of. To make your life alot easier, I…

No problem at all. You could do a similar approach for volumes as well if you wanted to. Whenever I'm given the "I want to see all of X that is monitored", I like to go off the node table. It really causes the lack of monitors on a system to stick out like a sore thumb. 

So not monitored is going to be your issue. I want to say that the interfaces will only show up in the database if they are actively being monitored. So I guess that turns into the conversation of how well you know your environment. To get a list of monitored interfaces though, I like to pull that from the Nodes table…

So if you are pulling from the volumes table (Orion.Volumes), that is definitly the wrong threshold to use. I personally haven't seen datastores flagged with drive letters before. Please correct me if I'm wrong, but I'm going to go off a couple of assumptions. On your query you are utilzing VolumePercentUsed (Column: Disk…

I would definitly avoid using the caption, system name, etc... for something like that, depending on the size of your environment. Trying to manage what systems get what alerts through that kind of criteria would become a management nightmare. If you have a standardized naming schema where the first letter (or couple of…

I'm personally not a fan of having monitors in a critical or warning state for an extended period of time. It can definitely skew reports. I'm also not a fan of having custom alerts for a specific monitor. Depending on the size of the environment and how things are configured, that could become a management nightmare. The…

Only other thing I could think of would require creating additional alerts. Have one alert for normal business hours that would have a tier2 escalation after X amount of time. Tier1 emails the internal team(s) then Tier2 hits the noc. Then an alert for outside those hours that immediately goes to the noc. That one goes…

Something like this, powershell and sam is probably your best avenue. I haven't had to do something like this before. My first thought is to use a multiple statistic value so you can capture the file/folder count as one statistic and do not set any thresholds on that. Then utilize a switch block or if statement on if the…

Unfortunatly not that I'm aware of. Keep in mind that SolarWinds does more of a moment in time monitor than real time. So for SW to catch event id 1074 before the reboot would be next to impossible. My advice would be the threshold like you mentioned, maybe have that set to 5 minutes. That way a server has to miss 2 cycles…

You should be able to use: $c = Get-Credential ${Credential} inside of the script itself instead of setting credential into the argument.

I don't think there would really be a way to avoid the cascade of emails with the 3 tier approach like that. As mesverrum mentioned, you could add additional trigger conditions so the value is between a range or greater than/less than branches. In that case the original alert would clear but trigger the new alert. To go…

Jbiggley had a response in this thread: Passing ${CREDENTIAL} in a PowerShell without using -Credential - Forum - Server & Application Monitor (SAM) - THWACK (solarwinds.com), which I believe would accomplish what you are looking for. It takes the "Credential for Monitoring" variable (${Credential}) then decrypts the…

Your options will be a little limited, but if you click the 3 dots to the right of filters, then select "Add filter" you can add additional columns. I know for applications, your options are basically Node, but that at least presents the caption name for the node on the view. I use it all of the time for ours. If you are…

The Appinsight monitors can not be modified at the template level. Once the monitor is deployed, you would have to go in and disable the individual components you do not want for that specific sam instance.

Thats exactly what is happening. I don't have the exact numbers in front of me, but I know IIS Sites, App Pools, and Database servers when using AppInsight could have stupid numbers of components. I want to say its somewhere between 20 and 40 components per App Pool/Site/Database. I have an IIS server in the envirionment…

I did something similar for a dashboard widget. One of our departments have multiple dashboards, so they wanted a navigation option on the page to all of the various dashboards for them. All of them start with the same name, so I did a replace on the name in the select, and look for that prefix in the where clause. SELECT…

I'm not aware of a way to do that. As Mesverrum mentioned, a DBA should be able to do some kind of find/replace but I'm not sure of the specific table that houses the alert actions. One recommendation I have is to eventually look at replacing how you do your email alerts. We ended up setting a custom property on our Nodes,…

I've been using the centralized upgrade for a couple versions now and haven't had a problem. We do have one poller that is on a slower network, so we traditionally kick off the download a day or two before our scheduled outage. This also helps on reducing the downtime during the upgrade itself since the servers have…

not that familar with the URI for the Report side of things. You could probabyl get away with using replace. So instead of n.Uri you just use: replace(n.Uri,'swis:','') as Uri.

Unless I'm missing something, you are probably looking for something like: Select Count(1) as CountItems From Orion.Nodes [N] Where [N].CustomProperties.Department = 'IT Division DataCenter'