adam.beedell · SRE/Machine Learning Student · ✭✭✭✭✭

Had a quick swing at it Is this the sort of output you're after? The column i've cut off is the device name, you could probably drop the frequency, so the middle 2 columns are I guess what you'd be after? Doesnt feel super useful to me but could be in your environment. A MAX of the Maxload column would be easier to work…

That'd have to be your plan not mine really as I dont have the same problem or starting data, generally I'd put not-in-monitoring as a problem higher than not-nicely-mapped though. The technical answer could be like: Parse out the devices from the JSON, put them in a discovery, return results, investigate those missing. Or…

The answer is definitely yes, though offhand I'm not sure if an easy way to do it. Hopefully there's a obscure macro. Else it's a select x where x is cores then dump it into a FOR XML PATH or similar.

Weird objection from your team given that DNS kinda has to be open already Otherwise as seashore said. You could chuck that on an agent and it'd have the possibility of less ports if there's an agent involved and you've already got that port open

Glad it helped! (Still not super sure based on the conversation how much of that value is custom polled vs OOTB. I think we're talking OOTB) (It's possible to assign a custom thing mathing together the two other things, setting across the group and then disabling the old thresholds) (or getting it by SLW as a bugfix or…

I think the answer is just "bulk set a new threshold against that 'volume' per ISE device"

Cant give steps with certainty because while it is definitely possible no-one's really figured it out yet outside the SW devs. I've not tried myself (but will probably need to for a project in this quarter) but have been in discussion with a couple people trying.. Maps seem to exist or mostly exist in the containers table,…

I've also wondered this, and I'm unsure. JMX bridge almost certainly needs it, otherwise I dont think it's very core. Would be a great test to backup, uninstall, see what happens, restore.

Did you have a certificate error when viewing the resource?

Without knowing anything about your environment it's hard to say anything, other than usually its a issue of what's being counted mismatching with expectations. Not sure what's being counted, not sure what's being expected, but usually that Possibles: MB vs MiB People expecting a filter that's not present Counting more…

Yeah that should be starting something else (or starting kiwi)

run netstat and see what's using port 5000

Glad you came across the fix. I think nagios converstion is pretty rare these days, but these rules are similar to the more used SAM templates, they always want to parse text from the console rather than read anything from memory, might be a security thing idk. Bit late now but you'd probably find help faster in the SAM…

You got a 2nd syslog thing on that box?

You can query this with SWQL kinda but it's a good point. Should put it in the feature request section before someone else says so too

Check if you've got a accidentally-dumb rule above that one that's messing you up

There's a tolocal function if you need it. Honestly the other way around is more confusing sooner or later

Ignoring the "get em to mute", 3 approaches 1a) apply that sam template to everything b) node down alert includes a phrase about AND that application is UP c) Note that that is reasoably easy in SWQL but not in the UI d) Double note - You're going to have the "down" information before you get the 4071 information by at…

Hard to say much without knowing significantly more about your environment, but probably the data in the DB matches, and the data being selected in the ui is the wrong selection. If it's not that, then i'm surprised

(As in, you can put a link or an iframe (maybe generally not ok by security often anymore) on a SLW dash to meraki, but if you're not logged into meraki already it couldnt be one click, and if you are somehow it'll sign you out soon enough. Cross-site-scripting prevention probably also gets in the way there)

Logins will be a headache for switching between the two. I dont think you can customize the meraki dashboard much, so probably your options are to stick meraki stuff on a SLW dash, or pump both system's data into a 3rd system

-SWIS api/powershell module etc - spreadsheet download/upload with excel and the same manage custom properties page -Not sure, maybe somewhere

Would script-y stuff work for your guys, or batch upload stuff, or looking for a different type of UI?

Either the amount of time to look backward (if it's set to days or something that's unwise, should be like 1.5 polls) or it's the reset logic on the alert. I'd assume if it's red it's probably the former, otherwise the latter

 @"AndoniFTQ" its hard to get answers to big questions that depend on environment stuff. SWQL is selecting some information from the DB. Your powershell is selecting data from the event log on a box, from the same box by the looks. Note there's a different start point and source. So you've got to think about how to put…

Nicely done! I think you've got it, yeah, in Jim's code "$SWISQuery = "SELECT V.URI" This pulls back an Identifier for each thing you care about (or rather "$uris = Get-SwisData $swis $SWISQuery"does when you run it) Then line7 is "You, the admin, make sure you didnt just make a mistake and select everything" "$uris.URI |…

Import-module is a powershell function not a swql function. There's a bunch of environment-specific stuff but usally you make sure you can connect to powershellgallery, set certificate and tls stuff maybe, trust and install it

Ooh, and a vector db

Maybe Redis... Small projects, non-mssql I think... will see how it goes!

Think "newui manage nodes" not sure in manage entities, but in any table-ey ui yeah sure