brscott · Custom Property Aficionado · ✭✭✭✭✭

Just grasping at straws here. Make sure the powershell exits with return code 0. Basically to test it, wrap the entire thing in a giant try/catch and in the catch part maybe write out "statistic.error: 1"

Just to be clear, what you are asking for is technically possible, *BUT* it's just awful, confusing, and unmaintainable unless you have several people fluent in SWQL. The proper answer is "custom properties" as has already been suggested. If you still want the groups for other reasons, then create the group as a dynamic…

There is a lot of ways you can go with this, and I don't know your environment or monitoring setup. If these are local servers, the first step is to make sure the infrastructure is monitored, including the servers. Then you move the SAM Application monitors, including the Appinsight for IIS (if you are using IIS). Even…

Right there at the top of the document explained my issue. Seems global filters don't work on custom swql ... which is ALL of my widgets.

I have considered something like this, but haven't done it yet. The way I was guessing to do it: Create a custom query widget for the groups with an additional field that's a URL back to the same modern dashboard but using a global filter:…

The why is probably related to ServiceNow SSL issue during that time. No clue why you don't see it on the alert history.

Since this is not simple, I really suggest you download the SDK which includes SWQL studio. https://github.com/solarwinds/OrionSDK

Hmmm, I'm not sure which part is not working. I'm running Orion platform version 2024.1.0 with Log Analyzer. Not sure if any of this has changed in the Observability product line.. 

It's not pretty because all the varbind names are one csv string and all the varbind values are one csv string. SELECT le.LogEntryID, le.LogMessageSource.Caption, le.DateTime, le.Message, ( select top 1 lefv.textvalue from Orion.OLM.LogEntryFieldValue lefv where lefv.LogEntryID = le.LogEntryID and lefv.Name =…

Probably the easiest thing will be to roll your own. Something like: This is just a base to start with... since there is no error checking, mine is just returning 0 because of an access denied error. Putting the regex on the command line would be nice, but you run into difficulties with special characters.

1) Just to be clear, tcp port monitor will not verify the SSL cert. It will only open the connection, wait for a response, close the connection and record the response time. If you need to monitor the validity of the SSL cert, that is a different discussion. 2) Correct. tcp port monitoring does not require credentials. 3)…

By "monitor a few ports", do you mean TCP ports? and are they accessible from the polling engine? If the answer to these is yes, then create a new SAM template and add a "tcp port monitor" component to it. Then you have to choose to A) add more components to that template for each port, or B) create a template for each…

Just as a note, most of the time it's easier if you just always return with exit code 0, and use the variables to set the status at least for the warning and critical status. If you want to use the "down" status, then you have to do that from the exit code. It gets really confusing if you exit with 3 (warning), but you…

I have custom properties for email_on_critical, email_on_warning. These send an email if the node or SAM monitor is in those states. It's a comma separated list of email addresses, so you can set it to anyone... muhahahaha. OnCall_Group and OnCall_Hours. The group is forwarded to our ticketing software so they know what…

There might be something else interfering with your install. I install the agent using a domain account on servers all the time and have done so on every version from 10.something to 2024.1. The domain account is in the local admins group. I just copy the MSI to the server and double click it. In versions before 2023.x I…

Something to try, but low likelihood to be the long term fix. Put the node in "unmanaged" for 5 minutes. (not muted, it has to be unmanaged)

Well, that is highly irregular. This might warrant a support ticket.

Try clicking on "rediscover" for the node, but it's not likely to help as it should be happening automatically. I would guess that for this to happen you are monitoring the windows server via SNMP? If that is true, the best solution would be to change to WMI or the Agent. If that's not an option, there is an article here,…

1) The node will have to be using the solarwinds Agent. Yes there are other ways, but they are WAY more complicated. 2) If you can do it in hours instead of minutes, then there is a file age monitor. Easy answer. 3) If you must be more precise than an hour then your only choice would be using a linux script monitor and…

Two alerts is the easiest route. Have the switch over time be during working hours. So if you leave at 5:00, then switch at 4:30 (or ealier) so when you get re-alerted it's while you are still at work. Optimally if you are leaving something "down" you should have muted the alerts so you don't get re-alerted for something…

Well if the VLAN has a routed subnet assigned to it, then you just goto Settings -> Network discovery and choose either subnet or ip range.

The automatically adding the host and connecting everything up to nodes is a feature. The duplicate nodeID mapping issue is not. The solution is a support ticket because it's probably going to require some database updates.

I have found that the memory reported from VMware is just not that useful... it's not solarwinds fault, it's just the way vmware reports it. We do some alerting on the Node's memory reaching warning/critical state. That seems to work without needing to directly compare it to the critical value. Not sure, if there is a…

If you want to test your SWQL queries then use the SWQL studio that is part of the OrionSDK download from the site bobmarley mentioned above. ... but ... Your question asked if there was a way to run the SWQL in the WebUI. There is but to be clear this is *not* recommended! Use for testing only.…

Use the above, but also try to create a report with almost the same parameters as the trigger condition for the alert except without the down status.

SIDE NOTE: If you are doing much with groups, you will discover they just suck. Alternatively setup custom properties and use those instead. Then to maintain compatibly with your existing groups you add a dynamic query to the group to add all of the nodes with that custom property value. 

The ideal is one template and just change the "script arguments" field after you assign it. Not sure why it didn't work with $args[0], try replacing that top line with these two lines and make sure you are setting the script arcuments to an ip address or hostname when you are testing it. param ( $IP ) $AvgTime =…

Here is a slightly more advanced version. This shows all SAM monitors even if they don't have any values overwritten from the template. It shows the template name. It shows the group name if they are assigned to a group instead of the node. I excluded AppInisight monitors because I have a lot of them and they added a lot…

Yeah, I'm sorry it's going to be complicated. Yes you are correct it runs on the polling engine. https://documentation.solarwinds.com/archive/pdf/sam/sam_getting_started_guide.pdf The oversimplified version is to create a template, add a component monitor, "windows powershell monitor", then dork around with it a bit and…

There! Now you can set thresholds on response time and response count. And just like that... some of monitors went red... I guess I better inform those responsible for their monitors of what I just did. $AvgTime = Test-Connection $args[0] -Count 3 -ErrorAction SilentlyContinue | Measure-Object -Property ResponseTime…