adatole ✭✭✭✭✭

You can mark interfaces (and disks, for that matter) as "unmanaged". That will stop polling entirely. Of course, that ignores the obvious: deleting the interfaces you don't care about.

Your idea is a lot slicker, but just FYI this can be done now:

I can't pull any examples at the moment, but I recall that ONE of the "convert" functions - either CAST or CONVERT - doesn't work (or work reliably) within ReportWriter. IF it works within MS SQL Management Studio, but not in ReportWriter, then try using CAST instead and see if it works.

how long ago did you create those custom properties and how is that report built. From your description, it sounds like you created the custom properties and built the reports before the web-based reporting feature was added. Additionally, it sounds like the report is using straight SQL via the Win32 Report Writer…

Are you familiar with the built-in baselines and alerting based on state (warning, critical) versus a fixed number? Or is that new information for you?

Under "manage nodes, custom property editor, you can export a variety of fields to Excel, update them, and then import them. That goes for almost everything, but there are a few fields which are not edit-able - such as name. For that, you need to go to a scripted solution. This recent thread has some of the current…

The same as your setting under Settings (upper right corner of the web portal when you are logged in as an administrator), Polling Settings (right side, midway down), "Default Node Statistics Poll Interval" (which is 300 seconds (5 min) by default.

It sounds like you are sending the same message to multiple destinations - the people receiving the alert directly from SolarWinds (via Email, it seems) and the call logging system. Why not break those up into two separate actions and include the call logging variables in one but not the other?

Yes this is how it works. It makes sense if you think about it - coming out of a "blackout" you would want to re-test all conditions to make sure nothing changed while the device was invisible to monitoring. However, here's my way around it: http://thwack.solarwinds.com/message/142288#142288

Just a shot in the dark, but are you looking at an alert event that has a delay set on it?

For those people who are looking for more insight on how to optimize (I wouldn't say "game" exactly) their support cases, check out SolarWinds lab episode 36: SolarWinds Support Spectacular! - SolarWinds Lab #36 - YouTube. Near the end JasonFerree and I run down the ways to get the fastest resolution on your ticket.

A couple of quick answers, along with pointers to more info: * If this is truly a one-off and it won't happen again for another group, then you should probably just clone your existing disk alert and change the parameters. * It's NEVER just a one off and it WILL happen again. * So go into the node manager and view volumes.…

If you have 10.4 (with auditing) then you can report on the AuditingEvents table: select * from AuditingEvents where AuditingEvents.ActionTypeID = 24 Otherwise you can use the ResponseTime table to get a rough understanding of when the box started being monitored since "ping" is your most basic unit of monitoring. Of…

easiest way is go to into the Custom Property editor, click the Settings button, and add "Community" to the list of displayed fields. Then you can export the list of nodes to a file (Excel, text, csv) that have the machine name, IP, etc and also the SNMP RO community string. Does that help? - Leon

Any chance you have a firewall rule (either on the UCS or between your poller and the UCS? Any chance you have a restrict list in your SNMP settings so that SNMP polling is only permitted from certain hosts?

It's been a while, but generally speaking you may be best off launching a simple batch file that acts as a "wrapper" for the action you want. The reason is that the script is launching as "system" and not an actual user, so it doesn't have any environment variables set that are needed for the script to run correctly.…

I'm working off the top of my head here, but: 1) set up regular interface alerts for each of the links, with the message "site degraded" 2) create a group which is the two NEAR SIDE (ie: on on "your" side of network) ports relating to the satelite and terrestrial links for the remote site 3) make the GROUP the parent of…

Yep, that's gone now. You should install a good browser-based screencap utility - many will let you invoke it and then grab a screen area or sub-element (like the graph) and then save it. It's usually about 2 extra clicks.

I have strong feelings about how trap and syslog are handled in most environments. Because many devices don't allow you to filter at the source; and because even if you COULD it would mean managing all 120 AP's rather than a single point of control, I always recommend creating a scalable "trap and syslog filtration" system…

I would suggest creating a custom property (DeviceGroup or somesuch) and then populating that property by SQL query, SWIS/SWQL, or some other process OVER the idea of using a "node name contains XA" type clause. It would be a more efficient use of polling engine resources over the long term, and have more applications…

Alert polling is simply a query against the database. You can actually see it if you go into your existing alert and choose "Custom SQL". That will reveal the query that runs every xx minutes (typically 1 minute). Again, this is the query that is run to CHECK whether any nodes meet the criteria (ie: the interval on the…

There are a few ways you could accomplish this: * add a syslog module and use that to send a custom message into SolarWinds (although filter your trap & syslog first! https://www.youtube.com/watch?v=_zHP6xTg5QQ#t=1840) * Write the execution to a logfile and use SAM's log monitoring to pick up results * instantiate a…

Apologies, I got distracted. And with regard to the support ticket issue, my habit as a customer has been to call and ask for status every 24 hours (not sooner - it doesn't help being a pest). let's go back to basics. Can you shoot me a screenshot of the trigger tab of your alert? Also, what version are you on. I'm going…

Just to be certain - when are you seeing it come back empty: when the alert legitimately fires, or when you use the "Test" button?

You are over complicating the alert. Set up a simple condition of: Volume Type is equal to Fixed Disk Disk Utilization is greater than 90 You don't need the complex condition. And if you DID use it, it would be something like: field Volume Type is equal to value Fixed Disk field disk utilization is greater than value 90

Does not have a "bring me beer" function.

I just ran into this today. While you CAN create a report (it's a fugly little bit of SQL) it won't pick up the dynamic queries. However, this report: http://thwack.solarwinds.com/docs/DOC-171528 ...is pretty nifty. First add it into your environment (place it in \solarwinds\orion\reports) and then add a Report resource on…

I'm doing it off the top of my head, but it would look something like this. I'm assuming you have a custom property for "NodeType" (firewall, Proxy, etc). If not, you'll have to group by machine type or something. select fakeid='1', s1.firewallcount, s2.proxycount, s2.....(etc) join (select fakeid='1', Nodes.Department,…

Can you share your alert logic (screenshot or just type it out)? Typically it's because you are checking the wrong field (rate instead of status, or vice versa). Or another way to test it is to create an email alert trigger action, and put every (reasonable) field into it - status, rate, rawstatus, etc. Then set your…

Can you past the full query which works in SQL Management studio? and then some sample rows for what you get as a result? That would help.