cnorborg

Another thing to keep in mind, if you have a way to consistently remediate the issue for a given vendor, you can have a Compliance rule automatically do the remediation as soon as it see's that there is an issue without any intervention. Of course that brings up an issue that I wish they'd address, that being that AFAIK…

in Detecting Hidden NCM Config Failures (ACCESS-DENIED) with SQL Alerts Comment by cnorborg August 4

I'm no expert, but a quick online search says that above 90% configuration memory, or 60-80% linux memory usage. And when CPU usage stays above 80% during normal hours, or hits 100% spikes a lot. Personally? I'd probably stick with the defaults at first, which are 80/90 for warning/critical, and adjust upward if they are…

in Node Custom Poller Alert Definition for MEM alert- need critical and Warning in percentage Comment by cnorborg August 4

When you say "Managed by" what do you mean? ie: What modules are you using? How are they being monitored/managed, via an agent, or via something like WMI? Are they all using the same credentials? Do the credentials have administrator or Administrator in them? Are you doing any API polling of the server or the application…

in Failed windows logins from ./administrator and ./Administrator Comment by cnorborg August 3

Quite likely you might be able to get something. One of the reasons we didn't pursue the linux SNMP part is ZScaler locks the boxes down pretty well. Not even sure if they'd allow you to modify the box to put in SNMP communities or not. In looking at the API part, you would first need ZScaler to activate the API for your…

in Zscaler ZPA App Connectors within the SolarWinds platform Comment by cnorborg July 30

Just to double check, I went into my log manager and picked a node that had just sent a log message. So log monitoring is enabled for sure, and that node had generated a log message for sure. Still same results. I even tried adding it to a different tab in case the tab I was on actually already had it. Still same results.…

in Was "Last XX Log Events" widget removed? Comment by cnorborg July 30

I agree, went and looked again on Node Details page. Finding other "Last XX" resources, as well as other "Log" related resources when I search, but not this one… When you say its there @matthew.orr , what version product are you using? I'm also on 2026.2.1.

in Was "Last XX Log Events" widget removed? Comment by cnorborg July 30

And here I was looking for shorter ones with easier questions and more points!! 😁😜 Or, you can just give us free points!! (Not that I spend hardly any of mine!)

in Launching THWACK Mission: Total Recall – Into the Database! Comment by cnorborg July 30

I'm not seeing anything like that either. Closest is "Last 25/50 events". I tried both on a summary page and a node details page, neither has it AFAIK…

in Was "Last XX Log Events" widget removed? Comment by cnorborg July 29

Huh, I've never experienced this issue, but not a bad practice to follow!!

in Repair after Windows update Comment by cnorborg July 29

What worked for me was doing the " snmp-server enable traps fru-ctrl on the configuration on Cisco switches. Got rid of most of those pesky things for some reason, still not sure why, but pretty harmless to do!

in Devices showing Critical after upgrading from 2025.1 to 2026.2.1 Comment by cnorborg July 29

Sorry, that probably is applicable, but I really wanted to post this one… https://thwack.solarwinds.com/discussion/152120/cisco-chassis-module-level-hardware-health-at-the-fru-field-replaceable-unit-level-in-osh-2026-2

in Devices showing Critical after upgrading from 2025.1 to 2026.2.1 Comment by cnorborg July 29

https://thwack.solarwinds.com/discussion/152256/2026-1-1-update-snmp-hardware-health-sensors-resolved

in Devices showing Critical after upgrading from 2025.1 to 2026.2.1 Comment by cnorborg July 29

Have you tried running the config wizard? Tends to get rid of most issues… You should also probably let us know what version you're using and such…

in SWJobEngineWorker2 crash Comment by cnorborg July 23

Have to ask, is the node down? That's what it looks like to me…

in HI, Greetings Im am trying to apply the ssl expiration certificate date template on my Solarwinds Comment by cnorborg July 23

You can go into UDT settings and adjust the polling interval for both L2 (MAC) and L3 (ARP) tables. But be warned that it will take a lot of resources! At least with SWOSH, you can get unlimited polling engines, so…

in Realtime polling of ARP tables and Mac address tables via SSH or Cli integration Comment by cnorborg July 22

Much better with the images!! 😁

in Fixing Thin AP alerting without leaving behind ghost APs Comment by cnorborg July 22

Can anyone else see the images? I get a "You are leaving Thwack" warning, then I get an error about an expired Token?

in Fixing Thin AP alerting without leaving behind ghost APs Comment by cnorborg July 21

The HardwareHealth tables are better for it, we set up a search using this query using a "resource" on a page. Works pretty well. SELECT Replace(N.DisplayName, '.nd.lanl.gov', '') AS Node, N.IPAddress , N.HardwareHealthInfos.ServiceTag AS [Master Serial], SS.SwitchStackMember.SerialNumber AS [Stack Serial],…

in Serial Numbers Comment by cnorborg July 20

How many devices do you have? You will quickly run up against limits. We went the route of putting them in groups and having the maps only show the groups of devices…

in Worldwide Map 'Location' Field Bulk Update Question Comment by cnorborg July 20

42 unlocks, sounds like a good number!! 😜

in Launching THWACK Mission: Total Recall – Into the Database! Comment by cnorborg July 20

Yep, we looked at doing more in-depth things, but the ZScaler part of it didn't appear to do any SNMP itself, so at that point it was just monitoring linux. We went to "ping-only" which gives them basically what they wanted and saves licenses for us!

in Zscaler ZPA App Connectors within the SolarWinds platform Comment by cnorborg July 20

That sounds correct to me!

in Clarification Required on "Last Status Change" Value in Interface Details Comment by cnorborg July 15

Not a fan of these "Catch up's", we should be able to do old questions!! Had to use one for yesterdays, noticed that they used the work "does" instead of "dies". Doesn't really make sense otherwise!!

in Launching THWACK Mission: Total Recall – Into the Database! Comment by cnorborg July 15

Yea, I think maybe this table might do it for you. Haven't checked for sure, but here is a quick query… SELECT TOP 25 N.SysName, ConfigTitleBefore, ConfigTitle FROM Cirrus.CacheDiffResults CDR JOIN NCM.Nodes N ON (N.NodeID = CDR.NodeID) WHERE CDR.DiffFlag = 1

in SWQL statement to display switches with config changes Comment by cnorborg July 15

Wait, I was just joking about the NDAs and such, not about you being out!! Ok, just kidding, they will make us fill out NDAs most likely…

in The Most Unnecessarily Cinematic MVP Announcement Ever 📽️ Comment by cnorborg July 13

Oh, I totally forgot one huge takeaway from this!! ⚡️DON'T RUN THE CONFIG WIZARD IF YOU'RE ALREADY ON 2026.2.1. ⚡️ It obviously changed my Alerts database and erased the values I had set in "CreatedBy". No idea why, but most of the other NCM issues I'm having are also after running the config wizard after the initial…

in 2026.2.1 multiple issues Comment by cnorborg July 13

Of course at this point, you've only been invited, its not official until Solarwinds announces it and they'll probably have us fill out NDA's and such first. But, since you violated a rule by announcing it early, you'll probably lose your invite now. JK! 😀😁😉

in The Most Unnecessarily Cinematic MVP Announcement Ever 📽️ Comment by cnorborg July 13

So, some interesting updates. Setting the "CreatedBy" to a valid account brought back those alerts ok. However, running the config wizard again broke it again!! So, I went in to fix it again and one rule wasn't showing up all that quickly for me, just happened to be our version of "Node is down". So, I went in to check and…

in 2026.2.1 multiple issues Comment by cnorborg July 13

So, I don't really know what you're asking for sure. Are you looking to manually figure out what changes have been made using SWQL, or are you just wanting a list of those that have changed? The way configs are stored and how SWQL works isn't really all the conducive to figuring out whether changes have happened or not.…

in SWQL statement to display switches with config changes Comment by cnorborg July 13

Ok, so I was having some issues loading a "Violation Details" in a compliance report, getting a "Website Error" after a long delay. So, I went ahead and ran the config wizard on the main box. Going through the AWS, it was still an issue post config-wizard, so I ran the config wizard on the AWS's. Fixed the issue briefly on…

in 2026.2.1 multiple issues Comment by cnorborg July 9

cnorborg · Network Professional IV · ✭✭✭✭✭

Comments