byrona ✭✭✭✭✭

Get out of my brain The PM team has been thinking about this as well. Something like Google Finance type interactivity. I haven't specifically used the Google tools that have this but it's been pretty much the same in all tools that I have seen it in. I am less concerned with the very specific details of the implementation…

Thanks, this is exactly what I was looking for!

So, after thinking about this I have a follow-up question... What if you need to store more than 2.2TB worth of data to meet a data retention requirement?

Dang, I new there was a blog that covered that but I wasn't able to find it before asking the question here. Thanks for pointing that out!

I would like to get follow-up response on this. This particular issue has caused us a lot of problems. 

We are using an additional poller and that is where those systems are polled from. Is the disabling/re-enabling the polling the only workaround at this time? Are there plans to resolve this problem in the future?

Furthermore, as I think you were alluding to Byron, it should take advantage of current technologies (ie AJAX, Flash, Silverlite, etc.) so that we're not limited to full page updates every X minutes. This is exactly what I meant! Several aspects of the WebUI feel very outdated from a technology standpoint. I would…

You don't need admin privs to modify custom properties. Just expose the custom properties on the views your user has access to. (I have extensive custom props, so I usually create a separate view that is linked from the node view.) -v In my experience you need Node Management privileges in Orion to modify the Custom…

I would try ${Node.Location} and see if that works. Also for Custom Properties you would use ${Node.CustomProperty}. I am not sure if these will work with SNMP Traps. If these don't work with Traps you can try to setup a UnDP that monitors a specific OID for the status of these systems and set an Advanced Alert when the…

I think the biggest issue to tackle is the connector bit. When a customer asks "can you support logs for <insert item here>", you need to be able to say YES in nearly all cases. Every time I tell somebody NO, I get Splunk thrown in my face . Based on your responses HERE, HERE, and HERE, I get to go back to a customer and…

So, it seems to me something is not functioning properly.

Brandon Ugg, this represents a HUGE security problem for us. If we want to use custom maps for our different customers via background images this information would potentially be accessible by other customers. It would be VERY VERY nice if the dev team could consider restricting this. I am thinking something like if the…

Thanks, this is exactly what I was hoping for!

Thanks for that Nicole! Two follow-up questions... Would you agree with LEM being able to satisfy the other PCI control objectives that I referenced above? What specifically do I need to watch for to identify clock changes?

So then the real key will be making sure that the IP VMAN lives on has access to all of those systems also. So it sounds like I don't need to setup anything on VMAN once its up and running and that the integration wizard will handle moving everything over including access accounts, is that correct?

I have been told that the downside to using Baisc Alerts is that it's specific to the poller. If you have multiple pollers you probably want to just ignore the Baisc Alerts and use Advanced Alerts. As far as the original question by the OP, I agree, I would like to better understand what the Current Value column is for and…

Thanks for the feedback thus far. I am no specifically interested in the contents of the alert, just curious what methods people are using to get the alerts to the techs. SMS is a good idea and most cell phone companies have an email to text gateway you can use as well. With the NMS system that we are replacing with Orion…

kellytice​ thanks so much, that is exactly what I was looking for! Yes, we have 2 people and require 2; at least for the test we were doing. I really appreciate your help as we roll this out.

I would be interested in hearing more about your specific configuration for this, specifically the poller separation part. We are using Orion in a multi-tenant setup now using account limitations. What I am looking for with this request is progression toward a very robust multi-tenant environment where I can define…

Thanks, this is exactly the info I was looking for. The only followup question I have is: Is the Kiwi Log Viewer an additional application that has to be purchased? I have seen it noted as Freeware but have also seen a cost associated with it?

Glad to hear it's on your radar. Doesn't Google make an appliance that you could use for something like this... HERE it is; just a thought. Until it's resolved the Google work around should work.

I assume that also remains true for Windows PowerShell components? If so do I tell them to run locally since in that case local will be from the perspective of the agent?

What kind of integration are you looking for? I will attempt to reply to this question because I think it's a really good one... To quote a previous post I recall seeing; if we can monitor it, we also want to alert on it and report on it. To add to this; we also want to be able to correlate the data with other monitoring…

Awesome response nicole pauls! I realy do like the approach that you guys have taken with the LEM product "instead of writing rules that expose very specific attacks/viruses, write rules that expose threats/patterns of attack". While I have spent a fair amount of time working with the product I will openly admit to feeling…

Hrm, I definitely can see your problem and think that SW should use an "Unmanaged" status in place of "Unknown" but I also understand the reasoning behind using "Unknown" status in this case. I have my alerts only set for "Down" status to avoid the problem with the "Unknown" status. What I have found is that with at least…

Thanks curtisi! This doesn't look like a good fit for what I need but I do appreciate the attempt, even if it was a Microsoft attempt. 

Thanks nicole pauls! Since you guys had the nice widgit that shows how long it's been I thought this might be possible to create a rule for as well. Well' at least I wasn't missing anything obvious. I think I might put in a Feature Request for this capability. We recently had a device that had gone without sending us…

Yeah, the problem is that I don't remember what was there before and in what order. I was basically using the factory settings.

This is great info Phil, thanks for sharing!

Thanks for the info. To provide some background on the question... Our company is in the process of building security services and log management services (we are a service provider if it isn't obvious) and currently we are using LEM as the technology behind the log management component deploying a LEM appliance for each…