bobmarley ✭✭✭✭✭

It is picked up by SNMP from the end device so if someone enters it into the router/switch/server when they configure it - it will show up when it gets polled.

I think it uses the words LIKE and NOT LIKE instead of = or <> but here are the docs. Use SolarWinds Query Language (SWQL - SWIS) - SolarWinds Worldwide, LLC. Help and Support

I have always put a filtering server in place before the messages got to the LEM or to Orion. One solution would be to have the messages forwarded first to a Kiwi Syslog Server and then have filtering rules in the Kiwi server drop the unneeded messages prior to sending them on to the LEM or Orion. Kiwi is very affordable…

Cal, could you expand on this statement? "For SCPs working for SolarWinds customers under active maintenance, you will be recognized as an SCP member within the support system and provided with an enhanced support experience" Any details you can share?

You could demo a copy of NTA

One solution you could use is have the script send Syslog messages to Orion then they will be in the Syslog table. You can then create your alerting against that.

Kiwi Syslog server is a good start.

Could also be done with Network Atlas. Create your background with Visio, Excel, whatever, screenshot is as a .jpg then import is as a background in Network Atlas. Drag the dots over onto it for whatever resources you need to show. 

I don't always have easy access to configurations is switches/routers because I have to have another team do that work. However I am admin on Solarwinds and can access the Custom Properties easily. Is there any way to add the address in Custom Properties -vs- doing it with SNMP?

I wrote some scripts that Orion executes that create a ticket in Service Desk, then Service Desk sends out the page automatically if the ticket priority is high enough. Each team needs to maintain their own Queue Monitor each week but it works perfectly.

Thanks lhardswgeek I will be using that in the future. Another method is to send the email directly from your script. Here is the code to do that. $EmailFrom = “BobMarley” $EmailTo = “AllMyFans@webejammin.org” $Subject = “RedRedWine” $Body = “This is where the alert stuff goes” $SMTPServer = “smtpgateway.webejammin.org”…

Good Luck!

I used a program called Email to DB which read an email box and then forwarded the body of the message as a syslog to Solarwinds. You could also spin up a small Splunk instance and do the same.

Assuming your running it against another node you probably don't have the credentials set up correctly to run against the remote machine. I got around it by adding my Orion server as a local administrator on the REMOTE computer. Need to pick Object Type choose Computers and add your Orion server as domain\orionservername

Go to product forums for NCM and start by checking that product out. It's the main one everyone uses. There are alot of videos you can watch. Also try the onboarding mission. It will introduce you to the site.

We delete your account if you haven't logged in in >90 days. Same thing with Software, if you don't launch Visio for >90 days they remove it from your computer. If you need it back you need to re-request it. This keep the systems way cleaner than supporting accounts that are not active and and saves money by putting…

Try disabling and re-enabling the alert rule. I have one that gets stuck once in awhile and that is what fixes mine.

Sounds like a firewall rule allowed the old servers but is excluding the new ones. Try doing remote desktop into your new Orion server and open the command prompt and see if you can ping the servers directly. If it fails then it's not something in Orion. Most likely the firewall not letting the pings through.

I ran into the same thing. I have always ran as DBOWNER in my previous installs but some things are not working in 12.4.

Did you happen to use it in your port descriptions? If so I can send you report easy enough?

The app is pulling in from the Events table, what I needed was the Alerts table. Added the query below to grab the correct table to pull triggered alerts in. SELECT TriggeredDateTime, TriggeredMessage, Acknowledged, AcknowledgedBy, AcknowledgedDateTime FROM Orion.AlertActive

Guys, We ended up using Splunk as our single pane of glass and have it it receiving messages from Orion, so essentially reversed roles with it. Orion was missing some key elements in the alert console such as the ability to acknowledge a message and run an action such as an external program that created a trouble ticket.…

I think the possibilities are pretty endless using the generic data input. I don't have it installed yet but plan on doing it on our lab system soon.

Thanks for the post. It does look like it will bring in anything you want with the generic data input. Here is the description from splunkbase. "The Splunk Add-on for SolarWinds allows a Splunk software administrator to collect SolarWinds alerts and SolarWinds asset inventory (network devices and their various attributes).…

Did you ever find a workaround?

SELECT TOP 1000 Name, Trigger, Reset, TriggerSubjectTemplate, TriggerMessageTemplate, ResetSubjectTemplate, ResetMessageTemplate FROM Orion.Alerts

As an alternative if you are running it from your own workstation you can use your own credentials using the code below. $swis = Connect-Swis -host YOUROrionServer -Trusted

I kind of look at it like a Swiss army knife. It covers a wide range of uses but there are a lot of point solution tools that you need if you need to dig in deeper. 

Here is how I did it in our Cisco devices, Firewalls should be similar. -Set all of your devices to log to your Solarwinds NPM server. -Set up a syslog alert to trigger any time someone issues a 'write' command I also have that trigger NCM to download the config

Any Ideas?