cnorborg · Network Professional IV · ✭✭✭✭✭

Comments

  • Sounds good, just updated my profile with my current information. Looking forward to hearing from you. Make sure you don't send it to my old email!!
  • Oh, I get it, you want to remove duplicate >existing< files in your archive. I think any duplicate file finder will aid in that. Maybe something here? duplicate text finder free download - SourceForge Personally, I'd just move all the files currently in this directory into another one and zip it up into one huge file. Once…
  • Yea, with the WLC's the paging makes a huge difference. Otherwise it tends to do paging at different spots quite often, causing differences in the config. Changing that should definitely help!! I think we're long past Cisco making this platform more standard, so its up to us to accommodate for the differences!! :-)
  • I believe WLC's are a bit of a problem child and could use some modification of how they are handled by default in Orion. I could be wrong though, they might have fixed it and I just haven't seen it yet. I don't think so though. cvachovecj​, has this been fixed yet? By default, NCM does a "show run-config" to download the…
  • Wow, I inadvertently answered this question, which I didn't quite understand, by answering a question in another thread!! I think that's a first for me, at least when I didn't give the link myself! :-) Glad to help!! 
  • Not sure what to tell you then. I tested a similar regex against a config on one of my fortinet boxes. The actual regex I used was: ^\s*set admintimeout 480 Worked just fine as shown above. If I tacked a $ at the end it didn't work, but putting a ".*$" at the end did, so there might be odd characters at the end of the…
  •  It would be "Web Node Management", the new website based way of adding/managing nodes. 9.0SP2 is the version I'm using. Another odd thing that you might want to fix that doesn't matter to me, is on the main web-server/polling-engine, I get "Custom Properties" in my dropdown to sort nodes by. We have an "additional web…
  • Well, from what I see, EOC is a mixed bag as to whether or not it will work in your circumstance. I did think there was a limit to the # of remote sites, but did find this in the documentation: "Testing confirmed that EOC was able to poll data from more than 30 Orion servers if the TOTAL amount of elements (nodes,…
  • Huh? I'm (hopefully) a bit confused. It sounds like you're saying they installed 30 copies of Solarwinds, one at each site? That sounds rather nuts to me!! Unless the sites are a heck of a lot bigger than what you described in the initial message, I'd monitor everything centrally and get rid of the 30 separate…
  • I've never used the "automated" remediation scripts either, by that I would mean "Automatically execute this script when a violation is found" option being selected. I think there would be very few instances where I would potentially use this feature. If you meant that the Compliance remediation on its own is "automated",…
  • There definitely is still a problem, I just updated the case notes. After re-indexing I get 248 nodes with the word "community" in them, less than 1800 lines of output from the search. However, I created a Compliance policy that checks all the nodes for the word "community" and I get nearly 3000 as expected. I was also not…
  • You must not have followed the link to the feature request! "Deleting the rules isn't always what we want either, because quite often we might want to look at or copy a rule from one of these reports into our own reports. So I'd like the ability to hide them instead. Maybe put a "show hidden" button in places so we can go…
  • Ok, I actually have this set up as a resource on a page that I have for looking for unusual things. For this to work, the IP would actually have to be "active", ie: not on a shutdown interface I believe. You don't need NCM to do it either, it relies on NPM's discovery of a device. This is a bit rough as I only use it…
  • Hmm... Maybe this will work, but I'm guessing from her other conversation she has going that she's looking more for the commands that a person executed on a device either via a script or a job, or maybe even a Compliance rule remediation. Basically be able to tell everything a person did to devices using NCM. This only…
  • Hmm... Not a fan of the "archived" node unless it is just a temporary state until you can copy the statistics to the new node. There are a bunch of questions raised by an archived node, like if you go look at it, should it do graphs and such based on "today", or the archived time as default? If I'm looking at a CPU graph…
  • So, I guess I'm just wondering how you would expect something like this to even work? The only way to even access multiple networks that are all using the same IP Address space would be to somehow NAT the duplicates, and that has its own host of problems you'd have to solve on its own. Not to mention you'd have to do 1:1…
  • Well, there is always the halfway approach, pick the spot that is closest to halfway and put the server there. In this case that would just about be Hawaii. If you need someone to manage the server on site, I could be available!! :-) Trying to fudge it and replicate databases and such will probably just cause even more…
  • Guessing you either read the wrong one, or stopped reading. The solution to what you want to do is in this: Filtering for incorrect logging hosts I did discover that the initial solution didn't work in specific cases, including what you're mentioning. So this link should work for you. Should also note that this ONLY checks…
  • So close @njoylif!! Try this: SELECT City, State, [zip code] FROM Orion.NodesCustomProperties ncp WHERE (ncp.NodeID = ${NodeID}) Should work if your custom properties are set up correctly...
  • Quite often it's simply a missing ORDER BY clause. In this case, simply do this: SELECT ROUND(SUM(VolumeSpaceUsed)/1099511627776, 1) AS TOTAL_TB FROM Orion.Volumes V INNER JOIN Orion.Nodes N ON (N.NodeID = V.NodeID) INNER JOIN Orion.NodesCustomProperties NC ON (N.NodeID = NC.NodeID) WHERE MachineType LIKE '%Window%' ORDER…
  • I don't think that will really work well. Wireshark is looking at much lower level data than netflow, not to mention its looking at it continually - so you can tell how many milliseconds it was between this packet and that one. Netflow summarizes the conversations by several criteria including source/dest ip/port among…
  • We're having the same issue with both our main and "additional web server". It happens more on the AWS, which is where most clients go to, so I think its related to the # of connections. We do have reports enabled, but not for most clients, and I seriously doubt that anyone is doing them on a regular basis...
  • Not to mention, with UnDP (Universal Device Pollers) you can poll and report on pretty much anything that is available via SNMP. Just have to make your own custom pollers... So I guess the answer would have to be - EVERYTHING!! 
  • I'd suggest opening a ticket with support. The link you sent was fairly detailed and sounded somewhat complex, both at the time of installation and whenever you might have to run config-wizard post-installation (which can be often!!). Not something I'd want to do myself, but if you're under pressure for Gov't compliance or…
  • I believe it depends on the device type as to whether or not it has this, but if it is there, it should be on the "Node Details" page under the "Node Details" resource. In there the top two things should be "Node Status" and "Polling IP Address". In the middle near the bottom you should see "Last Boot", which will tell you…
  • How are you monitoring the nodes? Via the Agent? https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Agent-Requirements-sw476.htm Linux - TCP port 22 for SSH for installation and SSH Windows, TCP port 135, 445 Both - TCP port 17778 and 17790. WMI - Lots of ports!…
  • And easier approach might be to go to the bottom of just about any page you go to in your environment, you should see a list of the modules there?
  • It doesn't just use CDP neighbors to get what the neighbors are, it can use other things like routing tables, arp tables and such. So the question is why does it think those devices are neighbors. The only problem I've had is it not finding neighbors though, I've never found instances of where it finds connections that…
  • This is what I use in my flow record: match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect interface output collect counter bytes long collect counter packets long I also collect on the input of…
  • A lot of questions here! First off, values put into both SNMP and WMI counters are generated somehow via algorithm's that tell the SNMP or WMI agent how to report the values back. They could vary quite a bit. SNMP could be averaged over a period of time, while WMI could be "now" values. It used to be that WMI would impact…