cnorborg

NTA has no such intelligence built into it. It reports the Netflow traffic that it sees on a per-device basis. So, if 3 different Netflow sources (ie: switches or routers) each see the same traffic traversing them, they will all report it. That's just it doing its job. The intelligence should come from whoever is…

in How does NTA handle redundant data? Comment by cnorborg September 2015

The compliance manager would probably be the easiest way to do that, have you looked at it yet? You can create a report that looks for "transport input ssh" on the VTY's and for the ACS config you use for ACS.

in telnet or ssh Comment by cnorborg May 2015

Just an FYI - you might want to pose this as a new question rather than replying to a 7 year old question that already has an answer marked as "Correct". Otherwise, not only might it get ignored, but people with the correct answer can't get Thwack points!! That being said, this works for me. Are you sure you have the…

in Not able to get Compare Configs to ignore Comment by cnorborg November 2015

For all nodes or just one? Would be easy if you wanted it for all nodes. Just find where they stow the up.gif/down.gif and "reverse" their naming. If just for one or a few nodes, maybe more details might help us out in figuring it out...

in I have a scenario where I want the node status to be down and show a green ICON. When UP it's Red. Basically reverse logic. Ideas? Comment by cnorborg October 2015

2070 Nodes - 3252 Interfaces - Volumes 41 Volumes Quad-core Xeon 64-bit server (2.66GHz), Win2K3 server (32-bit) w/ 4Gb RAM. Separate Enterprise SQL Server. Separate Web Server. Polling - 120 sec., statistics - 10 min. Nothing bumped up in polling. Average CPU load, about 30%. 67% physical memory, 36% VM... Rarely have any…

in What Is Your Polling Configuration? Comment by cnorborg December 2008

The real question might be, if you're looking to be notified quickly of an AP going down, is polling the WLC the best way of doing this? Personally I'd go with an SNMP trap from the controller, I believe the "AP Register" one will let you know if an AP associates or disassociates. If you have good, overlapping wireless…

in Taking 5 minutes to be notified an AP is down Comment by cnorborg September 2014

You might be able to disable it, looks like some tracing got turned on... https://msdn.microsoft.com/en-us/library/ms174401.aspx‌

in The NPM database is flooding our SQL Trace Logs with this error 50 times a second: DBCC TRACEON 3604, server process ID (SPID) 77. This is an informational message only; no user action is required. How can we make it stop? Comment by cnorborg October 2015

Give an example of what you want to do? Quite possible compliance report/remediation could handle this for you very well..

in Programmatically identify device switchport & change vlan tag? Comment by cnorborg July 2016

I believe I know what you mean, that you want to remove any other NTP server than the one you want defined, regardless of it's IP address. So you don't have an actual list of them sitting there of what other NTP servers there are... I have a bit of a hack based on the newest NCM that can work for you. This is how you set…

in Automated Config clean up Comment by cnorborg August 2015

I actually think this would be much easier to do with Compliance checking and config blocks... Have it search for a config block that looks for something that starts with "^interface (Fast|Gig)Ethernet .*" and ends with "^!". Look for the description you don't want to be there (ie: "description Access Port") and have it…

in Change interface description depending on old descriptions Comment by cnorborg September 2015

After you cancel and you're back at the "Network Sonar Discovery" page, there are 3 tabs. "Network Sonar Discovery", "Scheduled Discovery Results" and "Discovery Ignore List". Go to the "Scheduled Discovery Results" and see if your discovered nodes are there. If they are, you can add them from there. Just select the nodes…

in Can you cancel a discovery but keep the discovered devices? Comment by cnorborg November 2015

A more definitive way of doing this would be through AAA. If you have command accounting turned on in AAA, it will log each and every command done, whether it be through NCM or just by opening SSH and doing it through the CLI. Pretty simple to do, just put in: aaa accounting commands <command-level> default start-stop…

in Log user who actioned change Comment by cnorborg November 2015

Sounds to me like he's looking more for a way to compare configs against a baseline, which once again NCM will do. You can't compare configs from different routers I believe though within NCM. If you're downloading the files to a windows box before comparing, try "WinMerge". Excellent tool for comparing any files to…

in I am looking for a tool to compare running configs on cisco routers? I want to do it live for about 35 of our common routers. comparing 2 at a time is fine. Only things I can find in the toolset want to comare startup and running on same unit. Comment by cnorborg September 2014

I recommend NOT monitoring uplink ports in UDT. UDT relates ARP tables (ie: IP addresses to MAC addresses) to MAC tables (ie: MAC addresses to ports) to domain controller logs (ie: IP address to Users). This is the fundamentals of UDT. If you only monitor end-user ports with UDT, then there is a one-to-one relationship…

in Interface name in UDT Alerts Comment by cnorborg February 2017

You can do something like this SELECT TR.NodeProperties.Nodes.Caption, RequestedScript, ErrorMessage, DeviceOutput, Action, Status FROM NCM.TransferResults TR WHERE (Action = 3) AND (Status = 2) Customize your page, add a resource of type "Custom Query" and it will show up there. Or just use it in SWQL studio (part of the…

in Still looking for a place in which to view all results for executed scripts in NCM without having to click/open each device's results individually. Ideas? Comment by cnorborg October 2015

Well, first off, you can see a pretty big disconnect on the SNMP polled stats vs. the Netflow stats. That's because the polled stats are probably showing the average over 5-9 minutes, depending on how you have your polling set up, where the Netflow stats should be showing more immediate results, depending on how you have…

in Netflow and Correlation with NPM Interface Stats Comment by cnorborg June 2015

Wow, going to use basically the same answer twice in one day, and the answer is based off something I just did the other day! I actually had this problem the other day where I wanted to create a report to find out the licensing on a bunch of 2911's, I tried figuring out how to do a UnDP to do it, but it didn't really get…

in Create Cisco licensing report (show license) Comment by cnorborg August 2015

I believe the new 5580 ASA running 8.1 that there are some netflow features. I'm pretty sure other ASA's don't have this ability however. Cisco's site should have documentation on the 5580...

in Netflow on Cisco ASA Comment by cnorborg March 2009

I tend to use Excel myself, writing a blog on how to do it, personally I find it easier if you have a lot of repetition for things like router configs. Need to finish up the 3rd article in the series and get it online! First two are here though... http://the8thlayer.blogspot.com/ HTH!

in Startup/default configuration template for new devices? Comment by cnorborg January 2016

I've been told by Solarwinds Engineers that putting polling engines in remote locations is not a good idea. Something about the polling engine requiring LAN performance access to the SQL server. If this isn't true, I'd love to hear it, but they were quite adamant about it when I asked before.quote:Originally posted by…

in Leveraging Orion Comment by cnorborg May 2005

Hmm... I think you have things a bit wrong. First, even though it polls every 10 minutes, it is polling a counter of ALL data that went through the interface. So its not missing anything at all, it just reads the counter, divides it by the time interval, and says that's how much data went through ON AVERAGE. Its really…

in What multiplier should be used to estimate actual interface bandwidth utilization when NPM only polls once per 10 minutes? Comment by cnorborg January 2016

Hopefully an easy one. I'm assuming the policy to which the rules are in is attached to the report and all.. If so, make sure in the Report definition that you have "Show rules without violation" checked. Otherwise if you have a rule that nobody is violating, it won't show up. Congrats on having 31 rules not violated if…

in NCM - Certain Rules not appearing in report Comment by cnorborg November 2015

Are you monitoring your Orion server with Orion? The database server too? Make sure you enable the QoE for the Orion server, it might give you some insight. Most Orion issues I've seen tend to stem from a slow database server. Make sure you take a close look at it. If you're running the database on the polling server, get…

in SolarWinds Optimization Comment by cnorborg February 2016

Just to get this straight, you're monitoring end-user PC's in Orion? And it's their "caption" that is changing when they reboot? I don't think many people actually monitor end-user PC's in Orion, so this problem is a bit unusual. I would think the solution, if you wanted to keep doing this, would be to change your DHCP so…

in Node Captions being renamed when laptop/pc's reboot Comment by cnorborg March 2016

quote:Originally posted by Network_Guru Hi Craig, It seems you can't edit any of the discovered properties in Orion. As a workaround, I suggest enabling SNMP to discover the device once & then remove the SNMP polling in Orion System Manager. It will then keep the discovered properties in the DB. Well, if I could enable…

in Setting SNMP attributes when monitoring Latency Comment by cnorborg June 2006

I was wondering what might happen if one of the ports that was down came back up and one did! So, before it came back up, according to the query above the IsMonitored status was checked in the database. Now that its up, its still checked as if it was monitored. However, in the GUI, the "Port Management" part of UDT…

in UDT Misbehaving and oddities Comment by cnorborg August 2018

I went ahead and created a feature request for this. Go vote it up!!

in Arista Support Comment by cnorborg June 2019

I don't believe that is a desirable thing to do. The two products I believe need to be on the same server in order to integrate well. If you're having performance problems, I would guess its because of your database server(s). How is your current environment structured? Do you have a separate SQL server for the NPM…

in Moving NTA Flow Storage to a standalone server Comment by cnorborg May 2015

Reaching a bit here, not sure what is going on. It almost sounds as if you have it set up to keep copies of configs whether or not if they've changed or not. That is assuming your "Comparison Criteria" rules are working. I found something that might matter, but not sure as I've never used it. Under "Settings" / "NCM…

in Looking for help on getting solarwinds to stop saving the config when the RTCD kicks off. Comment by cnorborg August 2015

By default Solarwinds doesn't save configs when it logs in to download a config. So that is quite odd. You should make sure you don't have any other triggered jobs that go save a config when it Maybe someone set up something like that in the past, or have only you worked on this server? Places I would look would include…

in Looking for help on getting solarwinds to stop saving the config when the RTCD kicks off. Comment by cnorborg July 2015

cnorborg · Network Professional IV · ✭✭✭✭✭

Comments