bobmarley ✭✭✭✭✭

Thanks, yes the above query is SWQL. Added the IsServer as @"silverbacksays" suggested SELECT [Nodes].NodeID , [Nodes].ObjectSubType , [Nodes].IPAddress , [Nodes].Caption , [Nodes].IsServer , [Nodes].AssetInventory.Enabled FROM Orion.Nodes Where [Nodes].IsServer <> 'False' AND [Nodes].AssetInventory.Enabled IS NULL Order…

@"CourtesyIT" Has done a lot of work with STIG's in the past, possibly reach out to him and see if he can share any thoughts on getting this done. 

This should get you started, it will list all of the ones that are enabled as well as null. SELECT [Nodes].NodeID , [Nodes].ObjectSubType , [Nodes].IPAddress , [Nodes].Caption , [Nodes].AssetInventory.Enabled FROM Orion.Nodes Order By [Nodes].AssetInventory.Enabled DESC

I wasn't able to get 'Statistic Value' when trying to graph this. I used 'Response Time' instead and was able to get the MS it took for the reply. 

Until a feature is release you could use a powershell script. This will pull out the Top 1000 syslogs and save it to a .CSV file on your machine. Review the notes as you need to put your server name in as well as adjust the path for your environment. You can change the results by changing the query within the script. cls…

I would tend to agree with @"SteveK" If you absolutely wanted to unmanage or mute the node for Event ID 1074 you could do it by using an alert action to execute and external program, passing the node information along variable and creating a powershell script to mute or unmanage the node for X minutes

I do not have a full answer for you but the way I get data into some of our third party tools is first define a SWQL query that will retrieve the data you wish to import. Next run the query from within a powershell script and save it as a .csv file to a network location. Create a scheduled task to run the powershell script…

Did you get this going? As @SteveK mentioned you could return a Stastic Value within your script to report the status. In the Powershell script itself you could return a 0 (up) at all times during any time except Saturday and you time window. So basically first have the script check the day of the week and time and if it…

Read the documentation on these three links https://documentation.solarwinds.com/archive/pdf/orionplatform/orioninstallerguide.pdf https://documentation.solarwinds.com/en/success_center/ncm/content/ncm_getting_started_guide.htm https://documentation.solarwinds.com/en/success_center/ncm/content/ncm_administrator_guide.htm

Read Page 18 of the top document. documentation.solarwinds.com/.../orioninstallerguide.pdf documentation.solarwinds.com/.../ncm_getting_started_guide.htm documentation.solarwinds.com/.../ncm_administrator_guide.htm

We had no issues with it

If you already have a file that has the IP address or caption and the serial number you could directly import using the Custom Properties Import function. That would be the easiest way. 

If you use the variable ${N=SwisEntity;M=ComponentAlert.ComponentName} it should display whatever you named the component in the alert that you configured, so for example in alert email include something like URL having issues is ${N=SwisEntity;M=ComponentAlert.ComponentName}

I am assuming you are referring to a SAM template ? When you created the monitor if you gave the component a unique name you can use ${N=SwisEntity;M=ComponentAlert.ComponentName} in the alert In the SAM template you can change the name here to something like http://domain/checkhealth. By default it is named HTTP Monitor.

I think you are on the right track for the SAM portion. Unfortunately you can't schedule SAM to only run at specific times so the monitor will run 24/7 and will be in a down state for most of the time as shown in your chart above. When you set up your alert set it on a schedule and have the schedule only set for Saturday…

You could add them via a script and have the script unmanage them until a future time/date then do as @"yaquaholic" suggested and run a discovery right after the remanage occurs. 

Whenever a report is generated it is logged into the Orion.AuditingEvents table. You can create your alert to trigger from that event. 

Your SAM script and alert actions can run and create alerts and do alert actions independent of the status of a node. Perhaps you need to assign the template to run on another node besides the Orion engines. We have a script server that runs all of our scripts and automation. It is not an Orion server just a stand alone…

We do as @acurrent suggested and have a powershell script that runs on a schedule that assigns custom properties to nodes. 

You can change custom properties as an alert action as well. Perhaps when you SAM monitor detects a fail over it can execute an alert action to change the custom property and another alert action to run a script that unmutes the other set of nodes. 

You can change custom properties via the SDK as well. 

Just did another upgrade to 2023.4.2 on two systems and it went well. My only comment is that the SolarWinds Admin service did not restart on any of the systems and needed to be started manually afterwards on every server. Other than that no issues.

There is probably an easier way. Pull up the Node Details for your SQL server then launch Real Time Event Log Viewer, click on the event and then click Start Monitoring. This will create a new SAM template for you. Alternately, if the event is not in the log manually create a SAM template for that event ID. 

I have seen that, is it just happening on a single resource or several of them? Do you own SAM as it may help to troubleshoot the issue. In the Solarwinds Event Log are you getting any errors about Not able to open a new database connection? 

I am not sure. My out of the box ones do not filter to a specific node but have not loaded and tried all of them. Here is the SWQL if you need to use a Custom Query, edit it to your needs. SELECT TOP 20 TOLOCAL(EventTime) AS LocalEventTime, Message, EventType, NetworkNode, NetObjectID FROM Orion.Events Where Message LIKE…

Would it be possible to add Node is not equal to unmanaged?

Your alert logic may not have the condition of Not Equal to Unknown set in it and on the original poll that is what was returned could be possible.

(As an admin) look under Settings then My Deployment then the Deployment Health tab and see if any of the tests are failing. If they are try to correct any issues you may find there. If you own the SAM product you can apply the Solarwinds Orion - Main Polling Engine and Solarwinds Orion - Additional Polling Engine…

I take care of three SolarWinds instances and have used the offline method for years. Since version 2023 we have been using centralized upgrades and it has worked well. We upgrade each time there is a new release, so are always at the most current, not letting it get many versions behind. 

Start with a new server and if possible allow the installers to create the database(s) for you. Depending on the products you are setting up you may need more than one database. You or your DBA will need to create a user for the installer to use. Check the documentation and it will explain the database user requirements.