bobmarley ✭✭✭✭✭

Thanks @"KMSigma.SWI" I am getting an error when trying to run this. Any Thoughts?

Name = ${N=SwisEntity;M=ComponentAlert.ComponentName} Status = ${N=SwisEntity;M=ComponentAlert.ApplicationAvailability}

Your developers will need to install the Solarwinds Software Development Kit which is available at Github then write a simple SWQL query or powershell script to pull the data out. The SDK includes SWQL Studio and the Powershell Plug-in the developers will need. 

I port information to/from Solarwinds to several other platforms. What is the information that you are trying to share?

You can update your certs and then continue with upgrading. No need to start from scratch.

That is the same order we use, has always worked fine. Only time we ever have issues is if the SQL server gets pulled out and then it sometimes would not process the queues afterwards and needed a manual process to fix those. 

Some of my reports use data from tables that are all over the Orion Database. Sometimes the data for something like a Mac-Address for one device is in a different table than for another. (We use a lot of custom SNMP Queries for inventory items) One trick I found is to populate custom property through an alert action for…

Look up the Chrome Plugin called Revolver - Tabs it will allow you to rotate through several Solarwinds and Non-Solarwinds tabs 

Here is one I set up as a Custom SWQL resource. It displays the nodes that are down along with a column that shows when they went down SELECT NodeName AS [Node Name], '/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Node Name], DetailsUrl AS [_LinkFor_Node Name], --MAX(DOWNEVENT.EVENTTIME) AS [DOWN TIME]…

Genius!!!!!! Thank you. Worked perfect for us on 2020.2.6 with the old school trap receiver. (we never upgraded) Typed it up below for a simple cut/paste (top 3 lines are already there in the Node SQL Alert) SELECT Nodes.Caption, Nodes.NodeID FROM Nodes INNER JOIN Traps ON Nodes.NodeID = Traps.NodeID INNER JOIN…

Looks like 2.15.0 did not completely fix the issue, there is still more work to be done CVE-2021-45046 It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the…

Can anyone confirm that SentryOne is not affected? 

We use Solarwinds SDK and a powershell script that grabs the data out of the Orion database every so many minutes. That is how we are getting all of our data from Solarwinds into Sharepoint to create graphs there. There are several other methods, but that was an easy way. 

There is another scenario that you may encounter as well. The AD groups in Orion are sorted top to bottom, when you sign in you filter down through them until you hit the first match. If you are in multiple groups you can easily match more than one group, as said you get whatever is set up for the first match. Doesn't…

If you click on the red box, Click here for details here is what you get. { "message": "An error has occurred." }

You can get around the 30 days by executing this SQL, replace your account name shown. Do one line for each account. update accounts set passwordexpirationdate=NULL where accountid='ACCOUNTNAME'

That is doable however you will may run into issues with rights on the remote servers. You can add machines as accounts, same as you would add users. The script will run as the Orion servers system account so add your Orion server to the appropriate group on the remote machine and it will be able to run on the remote…

Worked great thanks!

Thanks! Saved my bacon today!

Another method would be to use Interface Custom Properties. In our environment we use an Interface Custom Property called ALERT and fill in either Empty, Yes, or No. In the alert logic we use Interface = Down and Custom Property ALERT = Yes for all of our uplinks, router connections. If the field has No or is empty it does…

Another approach you may want to try is to create an SWSQL query and then make an SWSQL based report of the results. What exactly are you trying to report on? This will pull the last 200 EVENTS for you. There is also an ALERTS table but it does not show reset messages. SELECT TOP 200 TOLOCAL(EventTime) AS LocalEventTime,…

Here is an example on how to join tables Select TOP 100 NodeID, IP_Address, Caption, AuditEventMessage, Status, TimeLoggedUtc FROM Orion.AuditingEvents VAR1 INNER JOIN Orion.nodes VAR2 on VAR1.NetObjectID = VAR2.NodeID

You may also try checking the account that is being used in report scheduler. If the account / password is incorrect the report will not run as well. 

You can look in Events and filter for Alerts Triggered and Alerts Reset to see when they are getting tripped. Another option is to set up a new alert that trips and sends an email whenever the node is in a Warning state and have it also send an email on the reset. We use those type alerts on some of our 'special' nodes…

Probably not the preferred method but you could expand the nodes in Node Management and remove them by clicking the checkbox and then deleting the volumes you don't need. 

I believe you are correct. In your scenario once the condition is met the alert is put into Warning status. It will get polled 10 more times before the alert triggers. If lets say on the third poll the node responds then a Reset is issued. If after the 11th poll it is still down it will escalate the Warning to an Alert.

I used it on my lab and it worked great. Will be upgrading Production in another week. Hope it works for your environment as well. 

Use the database manager and run this. update accounts set passwordexpirationdate=NULL where accountid='ACCOUNTNAMERHERE' Details here Configure user password expiration (solarwinds.com)

Is anyone else getting duplicate emails for all of these? I received four for this activity alone this morning. 

I may have a workaround for you that I have used in the past to populate custom properties values. You could create and alert trigger such as if custom property equals "app server" and custom property equals "Ansible" then an alert action to populate a new custom property field "application server". You will end up with…