bobross

mrdriskell has been working on a powershell script that will parse the event log and return the actual message. This should point you in the right direction:

Not on my Linux box right now so unfortunately I can't do any testing, but off the bat I'd remove the white space from around the equal sign. Also, from what it looks like, you are expecting to have 'untrusted' possibly show up multiple times per line. You'll want to change the first sed to this: sed…

I didn't have much success getting multi-line messages to return prior to APM 4.2. I'm referring to a single message with multiple lines and not the multi-value scripts in APM 4.2. With that said, I was able to get multi-line messages using both VBScript on Windows and Perl on Linux. The trick is getting the right new-line…

You can do this in the alert logic. On the Trigger Condition tab there is a spot where you can set a delay "Do not trigger this action until condition exists for more than". Just set the delay as a multiple of the polling cycle for however many fails you want to consider as down.

If you're using perl on a Unix system, this should get you the oldest file: my $file = `ls -Aghot --time-style=long-iso | tail -1`; my ($year, $month, $day, $hour, $minute, $filename) = $file =~ m/(\d{4})-(\d{2})-(\d{2})\s(\d{2}):(\d{2})\s(.*)$/; You'll need to do some math and probably the localtime function to get the…

If you aren't planning to upgrade the license then you should be able to delete components that don't give you valuable data. I'd recommend creating a copy of the template then modifying the copy - That way if you eventually do increase the license the original is still there. On the edit screen you'll see…

You can use some "variables" like {NodeID} or {ApplicationID} which are based off of table names. If you take a look at some of the Node alerts you'll see how this is done. Unfortunately, it might be tricky to get reports created and linked to properly for each node. You'd want to have a standard naming convention for…

Based on the assumption that the idle process is returning "bad" data, I was able to construct a script to return the top 0-10 processes in Windows based on CPU load. I haven't tested it yet against another server, but I think that the issue originally posted can be considered solved. We will be using this script as a test…

The format should be... ApplicationTemplate.Name = 'HTTP Monitor' In place of HTTP Monitor just put in the name of the base template. The above SWQL filter works for me on APM 4.1.

You can create one 'External Node' and attach multiple HTTP monitors. The IP of the HTTP monitor does not need to match the IP of the node being monitored. HTTP Monitors don't allow for dynamic login. You could work your way through it with a custom script, but you should also look into SEUM as this might be more…

I've never used alert actions like this myself, but have you tried just a basic 'netstat start service' command in the alert action?

You'll need to use SEUM for this.

We done something like this before to check for duplicate processes: @procs = ps -ef | grep process | egrep "perl|grep"; print "Statistic:$proc";

The default time is the local time of the computer that you are using as opposed to the system time on the Solarwinds box. We have Servers in multiple timezones and run into this problem regularly. If that doesn't solve it then I would check the SQL database on the Nodes table and check the unmanage times columns for the…

Just an FYI, it looks like that template isn't a rolling 30 days but something a bit more static... Also, the Nodes listed in the WHERE clause could be causing some nodes to not be used. WHERE ( DateTime BETWEEN 39139 AND 39170 ) AND ( (Nodes.Caption <> 'BJ-RT-2621-01.bakerd.com') AND (Nodes.Caption <> 'BJ-FW-515-01') AND…

Many components have a check box for "report statistic as difference". Do you have that option for this component?

I mocked up an SSH "User Experience" monitor. It uses two components: Linux/Unix Script Monitor Command Line: bash ${SCRIPT} Body: echo "Message: Test Ran Successfully"echo "Statistic: 0" TCP Port Monitor Port: 22 The first component is used to verify that an actual SSH connection can be initiated; unfortunately, the…

Check your account permissions in the web console. If you don't have anything selected for the reports folder then it won't show. Also, if the web console that you are accessing is on a different server from the main server then you'll have to manually move over the reports in the reports folder. Only reason I mention this…

You might want to go back to your admins and see how they are checking their info. We've found that the vast majority of the issues with Linux are related to either admins not understanding how to use their own tools or outdated versions of SNMP being run on the client. Overall we have a similar number of linux boxes being…

No sooner do I post then I see that you already tried assigning it to a variable. Can you try removing the stream and activex calls and just trying... WScript.Echo "Message: ${IP}" WScript.Echo "Statistic: 0" in the various forms you've tried before to verify that ${IP} is feeding correctly to the script? Sorry I'm not…

Does the displayed server time match up with the local time or is it coinciding with what you are seeing in the database? I'm inclined to believe that it has something to do with DST. You might want to verify that all of your timezone settings are correct. Is it possible that they are set to one of those funny…

There are templates available for Exchange, SQL, and Sharepoint on the APM Content Exchange: http://thwack.solarwinds.com/media/42/orion-apm-content/application-templates/?INTCMP=THW-GNav_ContentExchange_OrionAPMTemplates

If you click on a chart you can access Raw Data on the Custom Chart screen. This will export to a .csv file that Excel should be able to build a chart from. Someone else might have a tidier solution, but for those one off occasions this works fine for us.

One of the guys that I work with setup a query/report to do this. With that said, having "Credential" as an option for sort filter on the Manage Application screen would be the cat's pajamas.

It seems to always happen this way, but I think I found the answer. These two queries seem to function properly. The Nodes query properly finds the node that is currently in an overrun state, and the Applications query properly responds with a valid field even though there are no Applications in an overrun state. IF EXISTS…

You can set this up manually in the alert logic. I'd suggest making use of Custom Properties to set a start and end for the "Quiet Time" if you are planning on implementing this on multiple servers. We have alert logic in place currently that performs different actions during business hours and during overnight hours.