adam.beedell · SRE/Machine Learning Student · ✭✭✭✭✭

You misunderstand, I'm referring to specific functions so that it's parsed correctly Write-output = Bad Write-host = Good

15-20?! Arg you're a machine!

I ran to the end of my SWO product knowledge there haha

I still think you just want to use -computername If not, your test.ps1 has to return something and then also the in-solarwinds script needs to terminiate in the normal way with Write-host and an exit code

$results = pwsh testscript_writefile.ps1 -args $args I think you actually just want to use New-PSSession -ComputerName

This is the point where not being in the same environment makes things hard unfortunately. It's not immediately clear to me why there's a difference and I dont have the data to figure it out. I think you're near the finish line though Me and @"chad.every" tried to start from the alert, those first few lines that are set in…

You can use PS5.1 to open PS7 if you need to. Most of the functions available in PS7 have equivalents in 5.1 unless you're trying to run on linux or something.

SWO is a separate product (think: Solarwinds Platform for cloud-native stuff) (and is not required to access 3rd party apis) You can pass data through first party or 3rd party integrations between SWO and Solarwinds Platform stuff (NPM) The 1st party stuff I've not setup personally, but the keyword to search for is…

What format?

An observability agent would be to push data to SWO not NPM, but yeah you could get data out of a Prometheus instance. (though consider - if you've already got the metrics in prometheus you could just send those upstream, or copy prometheus's datasource)

Remove and n.status = 2 Find the event IDs for up, warning, critical add to the e.EventType = 1 Then you'd probably need to group by nodename, and CASE or ORDER or JOIN the event to the top for either the most recent of the events, or the event that specifically matches. Most recent probably works and would be easiest.

Works for me. Not sure what you'd need from ciccus.nodes though. My guess is the windows account doesnt have NCM access

I'll take a more positive stand than @"mesverrum" on this one. Seems fine, but you'd need to have a think about how to define the problem/s 1) Yeah totally fine, either SAM or API pollers or an integration using the SDK, any of these is fine a) You can push but you'd normally pull. You tend to push properties and pull…

I dont think so, but if you'd said anything else I'd have recommended changing it. (Particularly if you're remote you'd need to define N$ instead of N: for example) Try running $results = get-volume $results = $results.driveletter -join(', ') Write-host "Statistic: 0" Write-host "Message: $results" Exit 0 Whatcha get?

You could change where e.EventType = 1 and n.status = 2 To include the up status and up event This will change the view a lot, and I think you probably want to experiment with it to figure out what's useful and what's not to yourself and your client

You running the script in local mode targeting the polling engine which has N: mounted to it?

Do you have patch manager? I've not used patch manager. The patching question is not something a single person can do from scratch really, you wont have a data source for every random program in the estate's newest versions, need to rely on something that has a team of engineers maintaining it. Someone please prove me…

select n.caption, n.IP_Address, si.StatusName, e.EventTime as [Down at] from orion.Events e left join orion.nodes n on n.nodeid = e.nodes.nodeid left join orion.Statusinfo si on si.StatusId = n.Status where e.EventType = 1 and n.status = 2 -- You may have missing rows if the object has been down for longer than the event…

Do you just want when the device stopped responding to pings? Not sure I understand you

Something like --The SELECT statement is hardcoded into the alert SELECT Nodes.Uri ,Nodes.DisplayName FROM Orion.Nodes AS Nodes --Paste everything below this line into the Custom SWQL Alert LEFT JOIN Orion.Routing.Neighbors AS Neighbors ON Neighbors.NodeID = Nodes.NodeID RIGHT JOIN Orion.ContainerMembers cm on nodes.Uri =…

Word up to whoever on the spam team sorted out the previous round of these

Does Chad's not do what you're after? What's missing/failing/etc?

I dont believe you can at the moment, you can only back out defined predefined text. You can do this in SAM using any of the script monitors I have been asking solarwinds for this, but I dont believe it stores historical text currently.

You probably want to use an event-based solution for <1min Send alive events and dead events from the service, if dead then bad, if no alive then bad but with less certainty Alternately you'd want to set polling to 1 min from multiple places, and the alert to be checked every 1 min or less if it lets you. Max would be 2…

SELECT TOP 1000 StatusId, StatusName, ShortDescription, RollupType, Ranking, UiOrder, Color, IconPostfix, ChildStatusMap, DefaultIconName, CategoryStatusMap, DisplayProperties FROM Orion.StatusInfo

Like I said try it in a email first, then once it's simulating ok try it in the script. Variables are accepted in the same dialogue box in the target section, I'd expect that to work What the variable is depends on what your alert is as it's a positional format, using the picker in the email form is the best way to get…

select top 5 n.Caption,n.IP_Address,n.Status,n.DetailsUrl, n.Interfaces.Name, n.interfaces.LastChange FROM Orion.Nodes n WHERE n.Interfaces.status = 2

Search "Window Functions" for the proper into to what you're trying to do Answering directly you can output something like: substring(tostring(DATETRUNC('day',GETUTCDATE())),1,11) as [day] Substituting GETUTCDATE() for whatever timestamp, or using any other method doesnt matter really.You'd GROUP BY a less edited function…

1) 40b given example above ignoring settings referenced as changable