ahbrook ✭✭✭✭✭

I got this imported into a custom report, but I'm not 100% sure what I'm seeing. I see a list of 23 SNMP nodes and 1 Agent node that are on the list. All of them have "STATUS=1." @"bogdan.stan" - what columns do you typically display and/or act on? Like, how do you make it clear to folks that it is showing agents that…

I just ran into this same issue and opened a support case with Solarwinds. They informed me that the widget is really for NPM, and only works for Nodes, Interfaces, and Volumes. https://support.solarwinds.com/SuccessCenter/s/article/All-alerts-this-object-can-trigger-resource?language=en_US I'm about to go put in a feature…

I don't think we found a good answer to this. Our best solution was to set our general application monitoring alert (shared between events and other sources) to require a manual reset. This way, even if the alerting event has moved on outside of the display time (1.5x polling rate, or 7.5 minutes by default), the alert…

Okay. This looks really easy to modify the OOTB ones. So the question becomes scheduling it. Is there a way to have a report only send if there is actually activity? We're really trying to cut down on spam, but if all we do is send a daily report that says "nothing rebooted," it'll get tuned out.

Okay, now I feel like I'm doing something wrong and I'm down a completely different rabbit hole. We have the VMAN Event logging add-on in place in our instance of Orion, as far as I can tell. But it's only collecting events from our vsphere and vsphere-dr instances, not the individual ESXi hosts like I would expect. I…

... I think I found the problem. A thread indicated that you need to tell your ESXi hosts to forward their logs to Orion's Log Manager like you would for any networking device. Because we haven't done that, Orion has no clue what logs are out there for the individual hosts, only the overall vsphere config.…

My infrastructure team member did find a specific event log that gets reported back to the VMWare host. But it doesn't look like this gets to our overall vsphere instance logs, that Orion collects. I'm not sure. We'll probably explore the report option below, but knowing if Orion could see this alert would be helpful.

This is a good point, and a report would be useful.

We've not had a ton of success with event monitoring outside of Windows with SAM so far. Our network log traffic flows to a Splunk instance, and we likely are going to be expanding that in the future (though if Log Analyzer can compete, more power to it). Any suggestions for where to poke around?

My developers would REALLY like you to consume metrics from Prometheus. :)

We're moving more and more into an OpenShift and AWS based environment in our case. I'd love to see out of the box API based monitors for: - OpenShift as a whole, including overall health monitors and individual containers - GitLab Enterprise Edition (On-prem) - Anything Microsoft is making. :) I'm asking my…

Thanks all. Admittedly we're not in a position to expand our Solarwinds portfolio (and we're still trying to recover a bit of confidence given recent events). What the security office does most of the time is a mystery to me, so I don't know if they have SIEM tools already. For now, I'm asking the particular employee why…

That makes a lot of sense, although it is not idea as I was hoping to avoid doing any SQL configuration. Has anyone ever put in a feature request for this? the only thing against it I can think of is the size of things. If you track every result of every component monitor, those tables would become extremely huge. Only…

This is a question better asked to Solarwinds reps themselves. We were already pretty close to 2020.2.1 HF1 so we felt comfortable with the imgration.

Oh, hello there misconfigured firewall rules! For some reason, completely beyond any of us, the "Solarwinds Agent Management" windows firewall rule, port 17778 inbound was set to only allow "public" traffic, not "Domain" or "private." As soon as we opened that up, we were able to get our agents check in and now we're about…

Exactly - the text of the component only showing up for the current state is what I'm after. How have other users gone about capturing that historical data? Is this something where logging might help?

This was a really good, easy to digest video, though there was a bit of dunking on ops folks. He also had some concerns with how Solarwinds is handling this, which I have to echo. I'd absolutely love to see a lot more public information on today's patch. How it works, why it is secure, etc. Basically I need all the…

On Friday, we got the call from our security office that we were safe to proceed with a migration scenario. I used this thread as part of my work to develop steps, and learned a few things in the process that may be helpful for others. Our environment: Main poller running 2020.2.0 on physical hardware Additional polling…

This is the biggest thing for me. I recognize Solarwinds is A) developing the hotfix, B) verifying the hotfix, C) dealing with angry customers, D) dealing with government entities, E) trying to write SEC filings, F) trying to make sure their legal things are covered, and G) who knows what else... but a timeframe would be…

Has anyone run into anything odd with the %PROGRAMDATA%\Solarwinds\Installers directory? Our security office asked us to collect the install history for the Orion platform over the last year. In that time, we've done all our updates through the management/automated process, not using the offline installer. Therefore the…

This is super helpful! In this scenario, are you leaving the agents installed on your managed nodes? I've not seen much guidance on whether or not they would be compromised as well.. We're estimating that we will have to completely uninstall and reinstall our agents, and I do not know how our database would like that -- if…

We decided to not take any chances with our information. I will note that the security advisory got caught in our junk mail folders, so I HIGHLY recommend checking there. We got ours at 20:35 CST, after we'd started our own internal incident response.

Hey @"viveashean" ! I wanted to give you a quick update. Okay, after a bit of delays we finally got on a call with Solarwinds support/development and Dell Compellent support. Long story short: Dell admitted the problem is 100% in their software. They just can't handle the kinds of requests that Orion makes using SMI-S --…

Apologies for bumping an older thread, but this seemed relevant. In our environment, we've mirrored what you described: Agents installed on node A and B WMI monitoring on the VIP / cluster IP AppInsight on the VIP/cluster IP This seems to be working, because I couldn't get AppInsight applied with ICMP and we don't use SNMP…

Ahh, okay. Yes, we do have AppInsight running on the Orion Web console. I'm personally having trouble getting the real time log viewer to show any information for IIS itself, but that is likely a configuration issue on my end. That said, knowing that I can't configure Solarwinds to report the X-Forwarded-For, and instead…

We're getting the same issue on many of our transactions. We've discovered that it corresponds with hanging chrome processes on our Orion poller, which eventually leads to degraded system performance. Regarding the chrome processes, we have ticket #00473247out there, but it seems to be in a status where I can't reopen or…

@"viveashean"one other thing - you mention adding arrays 1 by 1. Does the SRM "add arrays" page let you do that? When I select and scan the DSM, it lists all the arrays assigned to it, and it gives bars/highlights as if you can choose which arrays to monitor through the DSM... but even when I select a single array, all of…

@"jvb"Just flagging you for this because it sounds like a lot of new information is coming to light and you were keeping an eye on things.

This isn't a device. This is the Orion Web Console itself. We have the DNS for our Orion install set to forward to a NetScaler load balancer VIP, and that is then passing traffic onto the IIS instance of Orion. In Orion's IIS, we have enabled the "X-Forwarded-For" request header logging, so I can see the correct IP Address…

I'm REALLY glad I found this post. I've been experiencing the same issue, and I went through searches back in THWACK's history and with the support center. From that, I turned the idle time-out to 0 and the garbage collection to happen at 5AM each day... and this caused it to be horrid on startup each day. I started…