bobmarley ✭✭✭✭✭

Here is a new query that selects all records instead of just the first 1000. That may fix your issue with selecting nodes. Also added the source mac address so you will have both the network device and client's MAC in the report. SELECT SourceName, SourceIPAddress, SourcePortName, SourcePortAlias, SourcePortType,…

Thanks! 

What does this line return back to you when you run your script? Write-Host "Statistic:" $BLpe

Try using a number for your statistic, that should work. So for example UP = 5, Warning = 10, Critical = 20 in your script logic so Statistic can compare a value in the template. This will change the status.

In the Orion.AlertObjects table it appears you could use either EntityNetObjectID or RelatedNodeID as your node ID for your query. 

Use the Statistic command to pass the information back to Solarwinds How to get a statistic output - Powershell Script Monitor - Server and Application Monitor - Forum - Server & Application Monitor (SAM) - THWACK - SolarWinds Community

Would it be possible to RDP into your Orion server and run the WPM recorder from there? 

It it probably possible to use an alert action to get this done. You will need to run a script as the action and use the script to set the interface status. Here is a similar posting (+) OrionSDK Not Permanently Setting Interface Status on Node - Forum - Network Performance Monitor (NPM) - THWACK - SolarWinds Community

I format mine a little different but they run. Invoke-Sqlcmd -Query "MyQuery From @Results" -ServerInstance "SQLServerName" -Database "DatabaseName"

@Seashore thank you! I forgot where that pulldown was and have been looking for it :)

You can try running this: SELECT TOP 1000 TimeLoggedUtc, AuditEventMessage FROM Orion.AuditingEvents WHERE AuditEventMessage LIKE '%mute%' AND TimeLoggedUTC < ADDDAY(-30, GETDATE()) Order by TimeLoggedUTC DESC

Here is a SWQL query you can use. SELECT TOP 1000 SourceName, SourceIPAddress, SourcePortName, SourcePortAlias, SourcePortType, MappedIPAddress, MappedHostName, MappedPortDescription, MappedPortName, MappedPortAlias, MappedMACAddress, LastSeen FROM Orion.NPM.OrionSwitchPortMapping --Where SourceName LIKE…

You may find the info you are looking for in the table Orion.NPM.OrionSwitchPortMapping It contains these fields: SourceName, SourceNodeID, SourceIPAddress, SourcePortDescription, SourcePortName, SourcePortAlias, SourcePortType, SourcePortState, SourcePortAdminStatus, SourcePortSpeed, SourcePortIndex, SourceMACAddress,…

All of the ones in use are under My Dashboards - Applications - SAM Summary - All Applications. From there you can expand out the applications to show the specific devices the apps are assigned to.

You could use SAM to monitor the services and then use an alert action to restart the service. Probably execute a powershell script whenever the service was not running. The script could in turn check service status and restart services as needed. 

I would just request a 30 day trial and spin an instance up to test against if the client is nervous about using the production server. 

Nice work!

Google 'Fiber Tap Device for Wireshark'. Put that device inline with your internet router and put the probe/sniffer of your choice on the tap to watch the circuit would be one solution. 

You can use the modern maps tool as well it is located under My Dashboards -> Orion Maps -> there is an Insert Images feature that will allow you to pull your Visio diagram in as a background. 

It has been awhile since I did that type of work. I used to do my diagrams in Visio and save the diagram as a .jpg and then use that as my background in Network Atlas. 

Did you get this working? Here are some docs that may help. Monitor, alert, and restart a Windows service with SAM (solarwinds.com)

I always save as .csv as it removes any special formatting before doing imports. 

If you lower your retention period then let the database maintenance run (usually overnight) the tables should shrink.

Actually Caption isn't one of the fields that can be modified using this method.

A third way is to use an alert action. 

Here are some screen shots to explain. If you were to run your SAM template once a minute -vs- once every 5 minutes then set your alert up like this, to check the query results every minute as well. Then in the Trigger field set it to condition must exist for 5 minutes. Then the query will have had to have failed 5 times…

One suggestion I have is try polling more often and then change the alert logic so it has to fail for 2 or more times before creating an alert. 

There is a possible fix to get more rows to display. It does have some drawbacks however. If you have a lab environment maybe you could give this a try. Fix routing table resources with incomplete data (solarwinds.com)

Maybe try something like this to get started SELECT COUNT (RouteID) AS RouteID FROM Orion.Routing.RoutingTable Where NodeID LIKE '1234'

I think the info you need is in the table Orion.Routing.RoutingTable you should be able to look at the total in either the RouteID or RouteDestination tables for a specific node. You will probably need to create an advanced SWQL alert for this.