byrona ✭✭✭✭✭

Using the kiwi syslog generator would be good; however, I manage LEM in a lot of different environments and I would rather not put that tool in each of those environments as well.

Would really love to see a response over here?

Yes, they are static. I am thinking that if I apply a custom property to each interface that needs to be grouped (for example Customer Name or Group ID) I can then use a query/report. Does that sound right?

Awesome, the alerts appear to be working as expected. However, now I am wondering, is there any way for to have the nodes status color change based on the pollers status? I t would be nice to have a visual refence to the issue on the NPM home page, or in group status, etc. Unfortunately, no this isn't currently possible.…

I have always understood the interval to be 10 seconds. Any disagreements? I would love to get confirmation on this. Also, do the Fast Poll pings get logged into the database in such a way that they are then used to calculate against availability? I would assume so but once again, I am looking for some solid confirmations.

It has been a long time and many many SolarWinds support tickets since my post here. I honestly can't recall if I did open a ticket or what the outcome of that issue was. If you have access to the ticketing system you could look up our account and see if you can find a ticket on it. Sorry, it's just been to long for me to…

Thanks Brandon, ticket #216279 created.

I wish I had though of this myself, flagging the traps/logs and then using a custom SQL query alert is a fantastic way of using the advanced alert engine to detect these types of failures.

The good news is I believe it's possible, the bad news is I haven't had the time to actually try to get it working.

Byrona, If I remember right the match is the section after the = sign. Can you try matching on just *Red*. I know this isn't a solution for what you are wanting to do but I just checked several of my filters and they are based on conditions in the second part of the message. I have confirmed that this is accurate, only the…

Thanks, I will try this. If this is truly the case then I am not sure the Trap Alerts component is very useful for most traps as I need to alert when a specific varbind is equal to a specific status, not just when a specific status is present anywhere in the trap.

Still waiting on an update to know if this is still a problem.

Thanks Jeremy! Can you tell me if that also existed in previous versions, specifically 5.5? I ask because I am curious if I should hold back on upgrading based on this. If it exists in my current version as well the I am not loosing anything if I upgrade.

Very Awesome! Thanks for sharing this Alterego!

I do prefer the model where the Knowledge base is hosted by SolarWinds as it would provide more immediate updates and help ensure the documents are always accurate.

Thanks sqlrockstar​; I think I can live with that.

Haven't heard back on this, any thoughts here?

I believe the problem I am encountering is a Windows desktop system authenticating against Active Directory and NetBIOS causing the system name to be reported instead of the IP address. The problem is that is incredibly difficult to track versus having an IP address.

curtisi I attached both of the rules in question.

Turns out that didn't work at all.

Yann With regard to the UnDP, can you please explain the difference between "status" and "rate"? I have been using rate but maybe I should be using status. Thanks in advance!

Ah, with your suggestion I actually found I can do it in exactly the reverse order and only allow it at the location level. I didn't originally see it until your suggestion got me to looking at it again but in the tooltip it actually tells you that you can use the Location to override the settings.

Thanks kellytice​, I have gone and voted for that feature!

this is a great topic. Alert management is not currently a strong suit of Orion ((this is my opinion). We are in the process of integrating alerts from Solarwinds into a ticket management system (Frontrange ITSM). Within ITSM, all alerts will be treated as incidents, where we can define SLAs and track acknowledgements and…

Thanks for the information, this is exactly as I thought but wanted to confirm.

Wow, I can't believe they don't have a good solution for this, this behavior seems completely unacceptable to me.

The connector is not only device specific, it's log specific. It needs to be designed to parse the specific logs you are trying to get as that is required for normalization of the data. If you want to use the connectors were applicable but also use LEM as a raw syslog server you can use the KB article I noted above. If you…

I guess I would have expected the box to be unchecked but have the option to check it.

bharris01​ Thanks for the help on that!

Currently you are not able to add your own custom tabs to the interface. There is a feature request for this but the functionality is not yet available.