adam.beedell · SRE/Machine Learning Student · ✭✭✭✭✭

A colleague of mine has created a Alert -> Excel process and it's been hard work. I think that sort of document tends to become unreadable fairly fast and I'm not sold on that sort of thing as a solution really, as it's another thing to desync over time. It does have some benefits of being "Ctrl+f5-able" and not requiring…

I dont have this issue, currently on 2024.2.1, but havnt had this bug in a couple recent versions either. I think this is a local issue and I'd probably run config wizard if another user on a different PC got the same issue on a different map.

These polling engines are in the same solarwinds environment, or parallel environments?

Depends what table the custom property is associated with. If it were nodes, A.CustomProperties.main_location If you do this in SWQL studio, you can pick from the autocompletes when you press "."

What do you mean by "nodes with resources"? Location is already a property, you could add an equivalent though, Settings -> Custom properties -> Node -> Add

The link Stuart linked is a good one, in your case you could just WHERE Alertname = 'Your node down alert' etc. Good to go.

I'd love to see a master list with some context, always wish there wa something easier to CTRL+F through c:\programdata\solarwinds\logs indeed You can see the list of logs pretty much from logs adjuster, and when you create diagnostics they're all in that file. The folks who've done support tell me the best route is…

In addition to the tool you found, you can also built it into the alerts like: Alert node down (default) AND Node.Status like down and Node.Customproperties.MaintenanceWindow not like '6am lot' Alert node down (6:00 reboot excl) AND Node.Status like down and Node.Customproperties.MaintenanceWindow like '6am lot' Scheduling…

I'd expect you'd be able to just assign a new copy in that case, not the case?

${N=OLM.AlertingMacros;M=OLMAlertMessage.VbName1}${vbName1} Trap variable binding name You can specify up to 10 varbinding names/values as macros. To do so, change the last digit to the requested value. For example, to get the name of the fifth varbinding from the incoming trap, use this:…

Yes this is doable, but you'd probably need to switch to the powershell/bash/external etc script monitor. $path = "path" $yesterdaywithformat = ((get-date).AddDays(-1)).ToString("ddmmyyyy") $dirobjects = Get-ChildItem -path $path | Where-Object -FilterScript {$.filename -contains $yesterdaywithformat} etc etc

I think it does but somethings erroring for you, in your snippet the olm macro isn't in quotes so I'm surprised it works, what are you trying to make occur ultimately?

Do you need to respond to the alert in <24hrs?

Per object or per entire alert configuration? Do you need to respond to this alert quickly?

I think you probably need those - Would just process a drive expansion

@"nwbarwell" RE data reducing https://www.freecodecamp.org/news/how-to-remove-duplicate-data-in-sql I think you want the section starting with Group and Ending with Inner Join for this problem generically I think something closer to a JOIN between tags and (if you have to containermembers) vms is the way to go in this…

@"nwbarwell" This isn't intended to resolve your issue directly, but try this if you havn't already select count(vm.DisplayName) as vmswithtag, vm.tags.DisplayName from orion.vim.VirtualMachines vm group by vm.tags.DisplayName

If by alert severity you mean the actual in-SolarWinds warning/critical/etc then I dont know a way to do it in one alert, but it would be easy to make ~5 alerts copies and bucket them to accept a custom property indicating intended priority If by alert severity you mean what's received by the receiving ticketing system…

You can definitely do both of these using the script monitors

Installation tends to at the moment, particularly if intending to configure appinsight templates

There's a Tags table you can join to which may be easier, I'm on mobile right now though Fundamentally the operation of reducing those rows down if need be is a grouping or a different set of joins

I only selected once there and could use CPs, so still a bit confused Groups is hard though and should be made easier

When you say Tagged, are you referring to vmware tags?

Vague answers: -This feels like an odd way to approach what looks like a custom properties lookin' problem, there's probably an easier way -Either Joins or GROUP BY

You've got some options If they send traffic to each other and you've got agents, you can enable packet scanning stuff for this and get auto-mapping, it's heavy though. You can promote an agent to a mini-poller and monitor one box from the other like that if you're on licensing that allows it If you've got SAM you could…

I'm confused about your workflow, I think this just works You can also just export the lot and filter off what you need based on the properties, would usually do that. Does this not work for you?

Nah To: accepts queries, I use that in prod. You do have a problem though where linebreaks arent available, so if you copypaste a multiline function it tends to immediately break

Actually main thing from me there was specifying the datetime column as it was correct but was also being confused for a function

Top one you can find searching "noise report" on here Estate growth per time is something I cant share easily, but you can look for like ElementCount on P1s avoided was a process thing, and involved working with the major incident managers, when we'd go through an after-action-review we'd put an eye on something which was…

You can alert on the timeout scenario, and trigger a manual backup off that I've done the former, not the latter yet, trade ya? Left Join NCM.Nodes ncm on nodes.nodeid = ncm.corenodeID WHERE ncm.LoginStatus not like 'Login Ok' and ncm.LoginStatus = 'Unable to login to device : Timeout'