bobmarley ✭✭✭✭✭

Here is one place you can info on when a component went up/critical/warning SELECT TOP 1000 EventID, EventTime, NetworkNode, NetObjectID, EventType, Message, Acknowledged FROM Orion.Events where Message like '%component%'

Worked great!

Give this a try.where IsNull(o.[AlertActive].[Acknowledged],'') like '%' AND o.AlertConfigurations.Name LIKE 'SL%'

You could make a copy of the alert and include only the two servers in the copy, change the trigger values for the copy then go to the original alert and exclude the two servers. 

I don't typically upgrade until the version has been out for a few months. Currently running 2020.2.6. Planning on upgrading to the latest 2022 version in February. Although I haven't seen it in the release notes, am hoping the bug has been fixed so I can import Custom Properties again. 

Go to your Manage Nodes Screen then click Custom Property Editor. 

If you don't need it to run it within Orion, but as a scheduled task or using your automation tool of choice it can be done with the API. This doesn't address only the ones that are changed, but syncs up all of the nodes from the external source with the nodes in Orion. First have your script pulls all of the node…

Glad you got that going! Happy to help any time! 

Here is something to look into so if it happens again you can revert back. (1) How to: Backup your Custom Properties - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Assuming it is on your main page, click the pencil in the upper left corner - Customize Page then click Add Widget. Type World into the search bar and drag worldmap onto your main page 

Can you post the script you are trying to run?

If I understand your question you want to tie together a link down condition and a specific SNMPTrap message to generate an alert? This is possible through using primary and secondary conditions in the alert trigger conditions. The primary section would be used to define the link down part of the alert and then the…

There is another 'gotcha' you may look for. If the user has an AD account and also has an Individual account as well, the Individual account will over ride the AD account. Second 'gotcha' is if the user belongs to multiple AD groups that may exist then then when you are viewing the accounts the users rights are determined…

I have two of them displayed on the Main page. One is the overall map and the second has filters for specific nodes. 

The wording for your script looks good for me. Some things to check Do you have the Solarwinds SDK installed on the server itself? Powershell on the server needs to have the plug in available. Is the path and filename to your script correct Does the user set up in the alert action have node management rights and does it…

If you have an older version of Solarwinds the Syslog info is located in a different spot. Here is another query you can try. SELECT TOP 1000 MessageID, TOLOCAL (DateTime) as LocalTime, IPAddress, SysLogSeverity, Hostname, Message FROM Orion.SysLog

What version of Solarwinds are you running? It should be at the very bottom of your main page. This query might work for you. It will have more fields than you need but you can always delete the ones you don't want in the report. SELECT TOP 1000 LogEntryID, LogEntryTypeID, LogEntryLevelID, NodeID, MessageSourceID,…

I can try it in my system, what is the name of the widget you are trying to add? Below is one method I use. How to add a Custom SWQL Widget to your dashboard - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

Google Solarwinds Orion SDK and you will find information about the API. The stats you are looking for are available to query from an external tool if you need to.

Did you join the table? LEFT JOIN Orion.NodesCustomProperties nd on I.NodeID = nd.NodeID Also have you tried without the AS CustomProperties_Locations, that is what the error is reporting on

It would depend on which product you are using. Solarwinds has several that receive Syslog messages.

They are generally awarded for items like participating in the Monthly Mission, Training, Surveys etc. Some are awarded right away and some are done manually, sometimes they take a week or so to show up if they are done manually. 

Have you tried doing a mix of the regular GUI type alert on the top and adding a subsection with the SWQL at the bottom? This is as close as an example as I can show but it should work for Group alerts too. This is mixing Node down AND Snmp Traps into the same alert but should allow some more filtering for you. May be this…

Try this, make sure you substitute YOURCUSTOMPROPERTYNAME with Locations (or whatever the CP name is) in your query. SELECT TOP 10 n.NodeName AS Node, n.Status as nStatus, n.CPULoad, n.DetailsUrl AS [_Linkfor_Node], '/Orion/images/SubViewIcons/Network_02.png' AS [_Iconfor_Node], i.InterfaceName AS Interface, i.DetailsUrl,…

Also here is how mine is set up using the GUI, this is set so 15 or more group members needs to be down in order for the alert to trigger. Scroll to the bottom of the image to you see the checkbox at the bottom. Also you should be able to control what gets passed on to Service Now through the wording in the alert action,…

Use the Select Count command. There are a few examples you can find on Thwack below is one. (+) SWQL for status count in multiple columns from same table - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

You can use System Up Time, in this example I'm filtering by a couple items in the name and if they have been up for 120 day or more.

Without testing it I would make a guess ${N=SwisEntity;M=CustomProperties.DisplayName} or try ${N=SwisEntity;M=CustomProperties.YOURCUSTOMPROPERTYNAME} with your own name filled in place of YOURCUSTOMPROPERTYNAME

There is another way, receive SNMPTraps for Windows Events. Windows has a command built in evntwin that will send SNMP Traps for items in the event logs. There is a command line version as well, evntcmd. Try googling those, perhaps you can use that as a workaround. 

Congrats on passing!