bobmarley ✭✭✭✭✭

--You can either use this in SWQL studio or create a report with it. SELECT TOP 1000 AuditEventID, TimeLoggedUtc, AccountID, ActionTypeID, AuditEventMessage, NetworkNode, NetObjectID, NetObjectType, DetailsUrl, DisplayName, ObservationTimestamp, ObservationRowVersion, ObservationSeverity, ObservationSeverityName,…

I believe it works similar to the way the alerting engine does. The alerts are stored in the database and then every few minutes an alert query is ran to look for the condition you are alerting on. 

Most of my time is spent in my chair :)

Not at my present job but previously had - I would coin the term 'Manageer' - a manager that like to do engineering work and wasn't very good at it. 

I don't use Syslog into Orion any longer so don't know the answer but they used to be stored the the database and were easy to get.

Thanks for posting, this script worked fantastic. I changed one line so it would save the files in a specific directory using this $filename = "C:\PowershellScripts\BackupAlerts\$alerttitle-ID-$alertid.xml"

Thanks for sharing

You could use the Orion SDK and create a script to delete the nodes then use an alert action to delete them after they have been down for x number of days

Here is working code I tested in March 2021 on V2020.4 Add-PSSnapin SwisSnapin #This will use your currently logged in AD account $swis = Connect-Swis -host YOURORIONHOSTNAMEHERE -Trusted #This lets you use an orion local account and password #$swis = Connect-Swis -host YOURORIONHOSTNAMEHERE -UserName YOURNAME -Password…

When you did your install/upgrade there was option where you could opt out of installing Log Viewer and then you would still have those menus. 

We just got ours back online as well. Went live 3/2 so was down a significant amount of time. Glad to have it back and so are the 50+ engineers that sign into it daily. A lot of lessons learned. So glad we were active on Thwack in the past and had taken advantage of all the custom scripts, automation, backups we had made,…

I had to do this on my system when I brought it back up. SO the table you need is called DBO.SMTP Servers if you attach with SQL Studio you can use this query to view it. Fill in YOURDATABASENAME with the correct info below. SELECT TOP (1) [SMTPServerID] ,[BackupServerID] ,[Address] ,[Port] ,[CredentialID] ,[IsDefault]…

That should work for you. That is how I populated them in bulk when users forgot to add them in. If you are doing a large number of nodes it may not fill them all in on the first run, just disable and re-enable the alert a few times and it will eventually get them all. I set my alert to run once a day once everything was…

I am running it by our Security Team and our Management this week. The current installations has four years of customizations in it so I would hate to lose all that work and have to rebuild it from scratch. Lessons learned though if I'm able to get it running again is to create daily exports of all custom properties,…

@"sum_giais" Thanks! I think I'm going to spin up a new server, attach to the database long enough to export all of the alerts, custom pollers, and reports and then retire the server and DB then start from scratch with new servers and databases. 

Once you load the SDK up and attach to your database try expanding the items on the left. The Orion.nodes table has most of the information that you would need to use for reports. Most of the items are named pretty well once you expand them out. If you want to see the data inside them the right click on the item and use…

If you are doing a new install you could manually shut the SMTP service down prior to the installation. I can't remember is SW had their own or they used the one built in Windows. Mine's not up to take a look at the moment. Other option would be have your mail admin blacklist the Orion server's IP's during your install. 

Yes you can alert on a Custom Property and then use Is Empty as the logic and then you can create an alert action to populate the property if you wish. Be aware that there is a limitation to how many nodes this action an populate during an alert interval and I think it's associated with the SQL timeout but it does work for…

The servers are running an unpatched version and we were directed to power them off by our Security Team. 

So you are trying to pull the data directly from the database without bringing up the main poller?

We wrote an alert that ran every few hours that verified a node was in the UP state and it would trigger an email. This would ensure the alerting process was running and email was working. Hope that helps. Also Solarwinds I get this often when trying to reply to a post after clicking I'm not a robot Thwack.solarwinds.com…

Should be audit events for these changes you could report on. 

 I have the same question. Would customers be planning on doing a fresh install on a clean database or a fresh install on an existing database?

We wrote custom pollers for our Liebert UPS's it wasn't too hard. They collected all of the stats the UPS supports like time on battery, serial numbers, location, temperature etc. I believe I uploaded ours up here to Thwack previously.

Our management asked the same question. My 2cents, our Orion had several years of customizations that had been built into it. We used the API to tie the product to all of our other tools and even wrote our own console for our Network Operations Console because no vendor had a decent solution for that. For what it did it…

If you can't figure out how to rearrange it within a transform you could always use three copies of the same poller and transform out the first four characters as year, then characters 5-6 as month, then characters 7-8 as date then use all three pollers in your report or alert or whatever you are trying to get it for. 

Yes that was a very nice feature to have. I would suggest loading up SWQL studio and spending some time learning where the data is located, most of it is under Orion.Nodes and then learning how to do 'joins' in SWQL. Once you get that working you will find it much easier to write your reports, widgets, etc in SWQL than…

Look under the Audit Events instead of the regular Events table. That's where that information is stored. 

Load up SWQL Studio and almost everything you will need for reporting purposes is under the Orion.Nodes table. If you need some specific queries to get you started post here what you are trying to get and the community is pretty good about providing examples. 

Am going through the approval process to turn mine back on at the moment. If approved will be doing the same thing. Should know sometime this week. Will let you know how it works out.