ashleyh ✭✭✭✭✭

+1 for this request. Palo Alto firewalls and a number of other vendors only support XML output formats via API response, all of which would be much more useful for creating API Pollers. 

Doing the above as a custom query I posted gives you exactly what you are after, no?

For a more detailed usecase... I would like to see an automated discovery per site which I can leave running at scheduled intervals. The filter options I would want would be something along the lines of (Device Vendor equals Cisco AND platform equals ASA) OR (Device Vendor equals Cisco AND interface description/alias…

Try this: Custom SWQL Query: SELECT TOP 100 UDTEP.ConnectedTo as [Device], UDTEP.PortNumber as [Interface] , UDTEP.IPAddress as [IP Address], UDTEP.MACAddress as [MAC Address], UDTEP.Node.Uri as [_LinkFor_Device] FROM Orion.UDT.AllEndpoints as UDTEP Where ConnectionType = '1' and IPAddress ='' Search SWQL Query: SELECT TOP…

Got this working ourselves on our main page. Its not perfect but it works for a quick glance view at what is connected where. Create an SWQL custom query widget, enable search and have it return blank "no results" until the search is run. Here is the query and output: Custom query is configured as follows: Custom SWQL…

Thats brilliant, thanks a lot. After some digging it looks like TCP/17778 was being blocked by Windows Server firewall locally. No idea why I didn't get other issues. Anyhow, I have successfully opened this, and set up the F5 to monitor tcp/17778 as a health check, works perfectly.

I have raised a feature request idea here: Please up-vote it as this is the same function you are asking for! https://thwack.solarwinds.com/t5/LA-Feature-Requests/Extract-of-Log-Trap-Messages-VarBinds-to-Trigge...

Thanks! Looks like some expensive discovery jobs we need to run every day. We have a massive amount of change of infrastructure links in the environment, so doing this for every box every day gets quite expensive to then do compare's with our criteria for each and every device. But at least I now understand the battle

Thanks a Lot. Looks like its not possible by any in-built functions. I have just +1 for a feature request I have seen submitted already.

Thanks. I just tried a telnet test to both Active and Standby on 17778. They both give no response (but not closed). Checked our firewalls and it just sees the connection "Aged out". No response is fine but they are both giving me the same (no) response, unless there is a HTTP Get or something I could perform to expect…

I have raised a feature request idea here: Please up-vote it as this is the same function you are asking for! https://thwack.solarwinds.com/t5/LA-Feature-Requests/Extract-of-Log-Trap-Messages-VarBinds-to-Trigger-Orion-Alerts/idi-p/597824#M131

Thanks. Unfortunatly if I perform a test to that port, both Active and Standby servers appear open on that port. telnet 10.x.x.x 17777 Trying 10.x.x.x... Connected to xxxxxx.abc.com. Escape character is '^]'. ^CConnection closed by foreign host. telnet 10.y.y.y 17777 Trying 10.y.y.y... Connected to yyyyyyy.abc.com. Escape…

Did you find a solution? Please can you give me an example of the trap message itself and I will give you a copy of the way I would do it. Feel free to block out hostnames and other details, as long as the trap OID is there and all varbinds I can tell you..

HI. So It can't be done to link it to a "polled" orion interface. But you can still have it tag/alert from the Log Analyser rule. I see a couple of methods and an issue above from my experiance. You are trapping on trap OID 1.3.6.1.6.3.1.1.5.3 AND 1.3.6.1.2.1.2.2.1.2.29. It cannot be both OIDs at the same time. if you view…

Gave it a try. The Orion Log Manager created alert had it set to "I want to alert on Nodes" The out the box interface alert in alert manager is set to "I want to alert on Interfaces" (Which I suspect is correct). I created a new "Or" Alert, copied the log manager alert condition and added an "OR" statement. Got a…

Agreed! This is making the job really hard. If I create a new interface like "loopback 10" on a Cisco switch, would you expect to see an "interface added" event when its passed the rediscovery interval and shows it available on "list resouces" or only "interface added" event when i actually 'tick' it for monitoring?

HI Adam! Thanks for the Reply. Yeah unfortunatly due to the complexity, size (2800 devices), over 250,000 interfaces, and differing standards/requirements, the auto discovery option in built isnt powerful enough for our use case. So we use the API to perform discoveries, run our own criteria and regex matches, and then…

So much of this rings true! We too have SAM and I do get a huge "hang" on the webpage if I bulk delete maybe 100+ interfaces. Although I have never pushed it anywhere near the volume that the API is. Would you mind please sharing your SR number with support if you have it? We have one open and I would like to raise this…

Thanks for the Info. We have our Main server (Plus HA), 9x APEs (so 10 Polling engines in total) plus 4x Additional Web servers. All our end users point to Additional Web Servers, and polling load is away from the main server and on the 9x APEs. At the moment we have the API pointing to the main server, but we will indeed…

Hi. Thanks for the links. Unfortunately we already use Account limitations as you linked above for things like the "Device Owner" to split out who owns what. However, SWQL for the current logged in user would allow us to do things like: Report all Alerts that I have acknoledged. Or have a widget displaying Alerts (like…

I got the join working using a "right" join, but because of the mandatory top level select statement on pollers, we will never be able to see the "message" coloumn of the events table. SELECT Engines.ServerName, Engines.EngineID FROM Engines RIGHT JOIN Events ON Engines.EngineID=Events.EngineID where EventType = 6600 AND…

I can confirm 100% the above is correct. Everything is dumped as a "message". This is logged as a feature request with a few examples from us, and gets wrapped up under the "extract data" from the "what we're working on". No sign of it in the new release/RC. I suggest raising a Feature request for your exact…

Have you done an SNMP walk of the PA and compared it to a physical? Ours work..but we have had a lot of issues with PA-VM code levels. I am not 100% but my suspicion would be on the PA not putting out values in the first place, and solarwinds just displaying what it knows.

We have 10x HA pairs setup but don't like to rely on DNS for network devices as its outside of our control (and a lot don't support hostname trapping etc). For our setup we have created HA pairs using dummy virtual hostnames that do not actually exist and a dns server that doesn't exist and is non-routable. We have all of…

We are trying to configure HA between our polling engines. BIND is out. We do have some microsoft DNS but our 'DNS people' in the company insist on not using WMI, "WMI queries are expensive and nowadays there are much better ways of achieving this, e.g. AD Web Services". Im a networking guy, so I dont know much about this.…