antonis.athanasiou · SolarWinds and monitoring Consultant · ✭✭✭✭✭

Code editing and #dark theme pretty please! 

It is likely that, if the box in question is stuck on a reboot loop, the monitoring protocols (WMI, SNMP, Agent) may have not been fired up yet and any OS level monitoring may fail. I would approach the problem from a different perspective: * If the target boxes are VMs, monitor reboot events on the hypervisor level * if…

Quick guess, are you experiencing any packet drops - errors/discards in those links?, you should be able to drill down to the interface level by clicking in the link then look at the right of the screen for details

While it wasn't a requirement at my current workplace, back in the day in professional services, I could tell that customers were feeling a lot more comfortable working with when they knew I was SCP certified.

I wouldn't rely on PerfStack exports as I'm not sure what data summarisation may be going on the background (mostly to get a reasonable amount of data in the browser level, but that's just an assumption), I know that NTA charts work like that. Have you tried to do a direct export from DB using Database manager or SWQL…

A quick way is to grab a list of the nodes in question (should be an easy export of the IPs through SWQL Studio or Database Manager) then initiate a discovery and bulk select using the filters in the discovery results. May I ask what's the benefit of monitoring Physical Memory and Virtual Memory as volumes? Physical memory…

The SWQL query below should be a good starting point, adjust it to your node caption you're interested in, let me know if you need more columns in: SELECT EventTime ,EngineID ,EventType ,Message FROM Orion.Events E WHERE E.EventTypeProperties.Name = 'Node Down' AND E.Nodes.Caption = 'NODENAME' AND E.EventTime > ADDMONTH(-…

This one is tricky. The alert trigger and reset conditions are stored in the DB with XML format so not so easy to read/extract (See Orion.AlertConfigurations in SWQL Studio). There used to be a way to extract the actual conditions as seen in an active alert page (Alert Definitions Details widget) but I don't think it…

not sure whether the alert is triggered when a transaction or a step is critical but the query below should work for both. Depending on the object, there's more information to display but it will look messy if one tries to join/union the results for both transaction and steps: SELECT ActiveObject, ObjectType, State,…

Are you referring to nodes currently affected by an alert or all the possible nodes that could trigger an alert? There's a difference and a solution for each.

What's the alert triggering on, a transaction or a single step? the query will be different as the alert is targeting different Orion entities. Also, are you trying to display active alerts and the object that triggered the alert in a dashboard ? a few more details on what you're trying to achieve will make it easier to…

I don't think it's possible to pass anything else than the main properties in any entity during creation, Orion.Nodes included in this case.. This is because anything else created/updated based on a node, it requires a URI to work with which includes NodeID within. That NodeID doesn't exist when using swis.create on the…

We are using a mixed case of polling methods and there are several Windows servers polled via Agent. I have too seen issues with WMI and with the utilisation of PerfStack it was clear that WMI polling was the culprit. This was occurring every 10 minutes (on the regular node polling interval) but also in SAM where the…

That's interesting, did you choose "Unique name" when selecting the field in the trigger conditions or something else? A screenshot would be helpful, if possible

Active Directory event log messages are stored in [APM_WindowsEvent_Detail] like all the event-log SAM components. I'd recommend to use SWQL (Orion.APM.WindowsEvent) instead of SQL for bulletproof and more robust results. The retention period for Event log messages is controlled in the SAM Data and Database Settings…

within the UnDP application, you can find a list of all your defined pollers see below: Also, within the Alert editor, as soon as you click your cursor in the text field (or start typing), a drop-down list of all the defined pollers will be listed, from which you can choose the one you're interested in:

The 'upsSecondsOnBattery' is just the name of the UnDP, you can name it anything you want. The above is not even an APC device. The Universal Device Pollers haven't changes much over the past few years, they are still defined in the 'SolarWinds Platform Universal Device Poller' application, accessible through the…

Have you tried tlpUPSSecondsOnBattery .1.3.6.1.4.1.850.1.1.3.1.3.1.1.1.2.1 ? I've used the same principal on a UPS (different vendor, different OID but same principal), the trigger condition should look something similar to the screenshot below (change the Unique name to what you've named your UnDP after…

You need to configure the WLC to send syslog/SNMP Traps to your SolarWinds server. Have a look on Cisco documentation as I'm not sure how WLCs are configured. Also lookup for the specific trap message when a failover occurs, this will be your trigger condition. Last, set up an alert as described here using the specific…

what's the specific error message you're seeing in postman? configuring the Authorization tab with Basic Auth should be enough, just tried with the query you commented, only changed the IP address to my environment and it worked

there's a KB on this, have you followed the steps to configure the web server address? https://support.solarwinds.com/SuccessCenter/s/article/Configure-website-URL-for-Alerts-and-Reports

Groups can contain different objects (Nodes, Volumes, more groups, etc.) therefore it is not always straightforward how to navigate through them. Try the following and see if it works, note that it will only output the nodes in the specific group and will ignore sub-groups if any. SELECT CM.Name FROM Orion.ContainerMembers…

good call!

I haven't had a WLC monitored for a few years so this may be outdated but have you tried alerting when the Physical Address of the interface has changed? it's an event-based alert that worked well on Cisco ASA pairs: You could also try to capture the event using syslog or SNMP Traps which may be a better way since the…

There are a few ways to achieve this. First, it's important to understand that an alert will trigger when a predefined condition is met on specific objects such as nodes or volumes or interfaces etc. By default, there is no option through the dropdown list to 'bind' nodes, volumes, CPU and memory utilisation in one single…

Hi Girban, REST API is available on all versions of the Orion Platform, 2024 included. Have a look in the OrionSDK landing page: https://github.com/solarwinds/OrionSDK Schemas available per version: https://solarwinds.github.io/OrionSDK/ Swagger: https://solarwinds.github.io/OrionSDK/swagger-ui/…

Very nice post Will and extremely helpful, thanks for sharing!

I don't know much about PAs but the "1.3.6.1.4.1.25461.2.1.2.1.11" OID seems correct. You need to establish which PA is active (1.3.6.1.4.1.25461.2.1.2.1.11 status = 'active') and also have a secondary statement in your SWQL query to determine when the tunnel is down. This may require another UnDP assignment as you can't…

It is today! https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/release_notes/orion_platform_2020-2-4_release_notes.htm

There are several procedures in the thread, you should only need the <precompiledAppversion="2"updatable="true"/>on /inetpub/SolarWinds/PrecompiledApp.config one, as Wluther mentioned. You do not need to delete the C:\ProgramData\Solarwinds\Orion\WebResourceCache.xml file, as this is only pre-loading the available…