brscott · Custom Property Aficionado · ✭✭✭✭✭

GAH!!!! Why can I not post SWQL as a "code" insert so that the formatting looks better.

Here is one I use. It's really old but still seems to be working. It does not include SAM monitors or API pollers (API pollers didn't even exist when I wrote this) Select Monitor, _IconFor_Monitor, _LinkFor_Monitor, Current, Warning, _LinkFor_Warning, Critical, _LinkFor_Critical from ( Select 'CPU' as Monitor, CASE WHEN…

This may be related. You also cannot do a ArrayValueAt in a subselect The error is: "Attempting to access an element as a type incompatible with the array", if that is any help. Like: select q.Field1, q.Field2, q.Concatenated from ( -- SELECT TOP 1…

Or as in the example above, I cannot figure out how to make it work as an aggerate function inside the subquery. 

I did try that, but I cannot figure out how to make it take an SWQL subquery as a parameter. Do you have an example?

And now that I have provided a direct answer, I have the doom and gloom. DISCLAIMER: I don't do much direct SQL on soalrwinds, so take this with a grain of salt. Looking at the "exists" you are going to get an alert if it exceeds your limit even once in the last 5 minutes, and not continuously for that 5 minutes. Unless…

In your "test" sql you have "FROM [dbo].[Interfaces] I", but the base select in the alert that you have to start with is just "From Interfaces" with no alias. Go Change all of your "I." to "Interfaces." and it should work.

NetPath No. NetPath is initiated from a polling engine, which only run on Windows x86 or Windows x64, not ARM, as a matter a fact, I don't think there is a current version of windows for ARM. SAM Module, this one is more likely, but from what I can tell still no. If by SAM module you mean a SAM application monitor that…

There is not a report, and bobmarley’s answer using the widget is the correct way to do what you are asking. Although eventually you will have a situation where a complex alert will appear and it shouldn’t, or it won’t appear in the list and it should. Maybe you get lucky and your alerts are not that complicated, but…

Would it be possible to break the script into 3 parts and put each part in a different component that could then have it's own credential? Keep in mind that there is no guarantee of the order the components run in. An expansion of Thomas' idea. Since you can have stored credentials in encrypted files so that they are only…

1) if you are not seeing the vmware tags listed in that widget, then they are probably not in the database. 2) to directly answer your question: the tags can be accessed two different ways. given that "n" in your example is Orion.VIM.VirtualMachines, the swql method would be n.tags.name. The other method would be…

Ultimately (as a couple have already mentioned) external monitoring is the only answer. What and how you monitor is going to depend on a lot. Yeah there are some basics and someone should (if they have not already) post an article about it, such as monitoring the main URL, maybe hitting this url with an swql and checking…

stevenstadel answered the question, and yes go upvote the feature request he linked... BUT... my advice is to give up on "All Alerts this Object can trigger". I don't say this because Soalrwinds is an inferior product and they just can't figure it out. Quite the opposite. You'll be creating nodes, SAM monitors and alerts…

The short answer is no, you just need to add the HA system (which is sort of an APE, but not exactly) and no changes to your SQL server. If you are concerned about HA, then I recommend that you at least get the Main Polling Engine HA'ed and then separately the SQL setup with an availability group. If either of those pieces…

Ok, Where is SPLITSTRINGTOARRAY documented at? That is amazing, and I don't remember ever seeing it.

I would guess that the dashbaord has been deleted. When I login as the built-in "admin" account, I can see all dashboards including the private ones. I know this does not fully explain the issue, because if I try to access a dashbaord that does not exist, I get the "404 oops" message, instead of a login.

I don't use stealthwatch or the newer cisco secure network analytics, but I'm pretty sure the answer is No. Both products are able to receive netflows and analyze the information. Cisco's product goes much farther down the threat detection path. Not really sure what you would mean by NTA monitoring stealthwatch, what would…

I'm not sure my discovery is working either. I am still looking at it. Seems I have badgered my users enough that they are creating the nodes before discovery can find them, so I don't have any good examples. I am seeing strange things, such as discovery shows that it discovered a node on 11/15/24, but I show that it was…

Here's the query I use on a widget to see new nodes added. It uses Orion.AuditingEvents like Bob suggests. SELECT ToLocal(ae.ObservationTimestamp) as CreatedDate, n.Caption as Node, '/Orion/images/StatusIcons/Small-' + n.StatusLED as _IconFor_Node, n.DetailsUrl as _LinkFor_Node, n.Engine.DisplayName as PollingEngine,…

Have you tried searching by IP address in the search nodes widget of the summery screen? Everything below here is assuming that the nodes were created, you just cannot find them. If they are just not getting created, then that's a different issue. If you find it named something strange, usually the node is named by the…

Everything is exactly right... except for the status. You have a really odd one here. So the basics... reboot node, reboot solarwinds, disable anti hacking stuff on the node (trend/crowdstrick/etc). Create a new monitor with nothing except below, but everything else the same. write-host "statistic: 0" Write-host "message:…

ok, that's no output result. I thought you were talking about somewhere else. Save that and go back to the previous screen, check the component and click test. Lets see that output

Ok that is confusing. If you see the other output but not the statistic.test, then it's crashing between there...but where? I don't see anything that could cause it. how about you change the catch to: Write-Host "Statistic.error: 1" Write-Host "Message.error: $_" Maybe that way it will let you see the error message.

Did you see the "statistic.test: 1" in the output? Beacuse if you saw that, then we are going down the wrong path. This is probably not the case here, but just to reiterate. I personally recommend to never use an exit code, and if you use the exit command always "exit 0". The reason is that you are forcibly setting the…

and don't forget to take out the "integrated security=true"

Add this to your script and I think you will see the problem. Write-host "message.blah: $(whoami)" Write-host "statistic.blah: 1" You are likely running the command as "nt authority\system", not as the user you think you are running it as. The "Credential for Monitoring" setting is really only setting a variable called…

Preferred Polling Method: Agent (in the advanced area up top) Execution Mode: Local Host run the script under the specified account: false This will run the script on the node. It will always run as "local system". Attempts to make it run as another user, or in any other way is an exercise in frustration. Maybe someone has…

HA! I meant "definitely want a tour"... unless you say no... then leave it as defiantly.

Check that you don't have two syslog destinations entered on the node. Then check the protocol. It's possible that it's configured for TCP and for some reason it thinks the connection was not successful and sends it again. You can test that by changing it to UDP. There are issues both ways when you choose TCP or UDP for…

I found some time to test this theory. It seems partially plausible, but incomplete. In my test I did the output and caused an exception. Output section showed my output. The "Dynamic Monitor Result Info:" section was blank, and the "Outcome based on statistic thresholds:" is Undefined. So that matches... BUT... the…