bobmarley ✭✭✭✭✭

The alerts can be displayed a lot of different ways. Are you looking for a list of triggered alerts try this, it only goes back 3 days but adjust to your need. SELECT [History].AlertObjects.AlertConfigurations.Name , [History].AlertObjects.AlertConfigurations.DisplayName , TOLOCAL ([History].TimeStamp) AS TimeStamp -- ,…

Here is an example of joining tables within SWQL Studio, I included the table you are looking for. SELECT TOP 500 Nodes.NodeID , Nodes.Caption , Nodes.IPAddress , Nodes.DNS , Nodes.Vendor , Nodes.snmpversion , Nodes.ObjectSubType as PollingMethod ,[Nodes].Engine.ServerName as PollingEngine , Nodes.LastBoot ,…

You can join the tables like this: , [Nodes].IPSlaOperations.UDPJitterOperationStats.AvgJitter

As mentioned by @"chad.every" we use the add on tool User Device Tracker. It monitors the interfaces even if they are not check marked in NPM as being monitored, so it catches every port. 

I also use the tool @"chad.every" mentioned which is on the Solarwinds Server itself. There is also a couple of them in the Solarwinds Engineers Toolset which work well. The toolset is relatively inexpensive and has a number of good tools in it. 

Put Jitter in the search in SWQL Studio

What is the media on the link, is it copper, is it fiber optic? Do you have a bad cable, dirty fiber optic? Have the cables been tested? Is the interface on the device showing any errors at the device level itself? Have you tried looking at the traffic with a packet sniffer? Are you getting a ton of TCP retransmits? 

You can use powershell as well $WalkRequest = @{ UserName = 'SNMPUSER' Target = '10.47.99.125' OID = '1.3.6.1.4.1.9.9.473.1.1.2' AuthType = 'SHA1' AuthSecret = 'WIb#dwnsoleELD3hdn' PrivType = 'AES256' PrivSecret = 'WIb#dwnsoleELD3hdn' } Invoke-SNMPv3Walk @WalkRequest | Format-Table -AutoSize

Here is a SWQL Query I found on Thwack. It shows all the ones that fired and how frequently SELECT --TOP 25 COUNT( AlertHistoryID ) AS [Alert Count] , oah.AlertObjects.AlertConfigurations.DisplayName AS [Alert Name] , oah.AlertObjects.RelatedNodeCaption AS [Node Name] , oah.AlertObjects.EntityCaption AS [Alert Entity Name]…

For some alerts such as node down, we send alerts out when the Warning condition is met right away for important items like routers, switches, circuits, etc. even before the Down event is triggered. It gives the Network Team an immediate notification there is something going on.

That must be a bug, possibly open a ticket?

In some cases we run an alert to collect that info and put it into a custom property which we can then leverage to use elsewhere in the product. For example, out SNMP v3 creds vary widely by device so we use a custom prop to determine which creds are used by each node when doing backups. 

I use a powershell script to test all of the ports run it from the Main poller or APE directly. Here is a sample. Just add all your own servers and all the ports SW uses. Test-NetConnection -ComputerName 10.10.10.10 -Port 1433 #polling engine to database via IP - This is the database port Test-NetConnection -ComputerName…

Looking forward to it!

This is what I use in my subject line of my emails for this alert. You will need to fill in your own domains and match the code to the number of them you have. You could also pull the variables out. Alert ${N=Alerting;M=AlertName} is ${SQL:SELECT StatusName FROM StatusInfo WHERE StatusID='${OrionStatus}'} :…

Very good to know, troubleshooting some issues as well

Thank you for sharing this, very nice. 

Good point. We only use this for Service Accounts, so it does not happen often enough to worry about multiple lockouts per polling period, however this may a weak point in our setup if multiple lock up. That said, whenever a Service Account locks up an alert is generated people are on it right away so those events are…

As @"stevenstadel" Location is derived from SNMP. We use a Custom Properties for items such as Location, Site Name, Street, City, etc. We have a mix of modes, some support the SNMP Location field, some (like ICMP Only nodes) will not respond back with that info. So without that info some of you nodes will always be blank.…

Have you tried making a single SAM template for just this condition and deploying it? When an Active Directory user account is locked, an account lockout event ID is added to the Windows event logs. Event ID 4740 is added on domain controllers and the event 4625 is added to client computers.

Having a similar issue on 2024.4 adding a AD Group. Ticket open. It sounds like you should open one as well. If you can't find the user in the GUI or in the DB then is sounds like a problem support will need to look at.

Possibly try something of this sort.

It's not too difficult to set them up, took me a day to set up all of our profiles, and we have many. You can copy existing ones so that helps. Wish you success!

If you still have the database intact you can try doing a new install and connecting to it. You will need the original database connection parameters and connection info. If you have not already deleted anything try running the Configuration Manager by RDP'ing into the server and running it. When you run it connect to the…

An additional suggestion. If you own HCO and have the free lab license its not a bad idea to monitor your prod Solarwinds environment from your lab as a second set of eyes. It's free and exercises your lab environment. 

Had never given that any thought, always had mine in a circle where each monitored the next one until the last one went back to the first one. The MPE ended up on APE1, just by chance.

We have several different types of nodes that use different credentials as well as different means to download them. We just set up a Connection Profile for each type and assign it under Manage Nodes - Edit Properties. Each unique node type has it's own unique Connection Profile. It sounds as if you possibly need a profile…

SELECT TOP 100 N.Caption AS [NodeName] ,AVG(N.ResponseTimeHistory.Availability) AS [Availability], n.CustomProperties._Group FROM Orion.Nodes as N WHERE N.ResponseTimeHistory.DateTime>ADDDAY(-7,GETUTCDATE()) GROUP BY N.Caption, n.CustomProperties.YOURCUSTOMPROPERTYNAMEHERE ORDER BY AVG(N.ResponseTimeHistory.Availability)

[Nodes].ResponseTimeHistory should have the rest

The best place to start is in the Orion.Nodes table SELECT NodeID, ObjectSubType, IPAddress, IPAddressType, DynamicIP, Caption, NodeDescription, Description, DNS, SysName, Vendor, SysObjectID, Location, Contact, VendorIcon, Icon, Status, PolledStatus, StatusLED, StatusDescription, NodeStatusRootCause,…