cory.cousins

Yes, we use SAM. We have encountered repeatable high CPU during polling cycles on a handful of servers, which we narrowed down to our SAM template that scans the Windows Security logs. It was due to the extreme amount of logs SolarWinds had to scan within these particular logs (150k+ events every 10-minute polling cycle),…

It has nothing to do with network segmentation, ACLs, firewalls, etc. Here are the two main reasons against using the agent or SNMP... 1 - Internal politics and culture. Servers routinely enter existence without my knowledge and the configurations vary wildly. Integrating the agent install (or even sending a communication)…

I escalated the ticket through our sales rep. No luck. Everyone I've spoken with says it can't be fixed by SolarWinds, so I'll just keep "fixing" it through SolarWinds by temporarily unmanaging / re-managing nodes as needed (see example graphs below). Using SNMP or, even worse, an agent to manage the servers isn't an…

Support has suggested not using WMI "according to all the thwack threads of users who have gotten past this". They also suggested opening a ticket with Microsoft and rebuilding WMI. No one seems to care that we've always corrected this issue by adjusting something within SolarWinds (temporarily changing polling interval or…

It may be reaching, but I'm wondering if multiple queries for information are somehow stepping on each other. Maybe CPU is being polled at the exact same time asset inventory or hardware sensor information is being polled and unmanaging/remanaging separated them. Looking into it now. I bring this up because I setup SAM…

Yes, restoring the old dll and replacing the appropriate dll in the updated location solved my HF#3 issue.

I spent 2 hours working with support via remote session yesterday to fix the server in the graph below. We couldn't fix it. We restarted the WMI service on the target server. We disabled anti-virus. We reinstalled multiple Orion components. We moved the node between polling engines. We unmanaged the node and added it to a…

Happens when you go to home page. There are no menus, but you can use the search function to navigate to a working page where the menus appear again. All of the menus lead to the error message above... reports, settings, etc. Been on hold for 55 minutes now waiting for a resource. Hanging up to open a case via customer…

The issue is now more concerning than just names randomly changing to IPs. Sometimes I have to manually rename nodes multiple times before the change sticks. Sometimes the name change never sticks and I give up. Sometimes renaming node A actually renames node X (this is my favorite). Fun times, especially when the vast…

I don't have any issue performing an nslookup for any of the affected IPs. It would be nice to have an option to freeze fields.

We have now noticed the WMI process (WmiPrvSE.exe) spiking CPU on some monitored servers. This only happens while the server is being polled for NPM information via WMI. In the example screenshot below, the server has been reporting 50ish% CPU utilization for the past 4 days straight. It's only hitting 50ish% because of…

Thanks for the follow up. This fixed my HF#3 install issue, which then resolved my issue with deleting interfaces.

Upgraded to EOC 2.1 this morning. Now staring at at this error message or similar messages when attempting to access various sections of the web console. On hold waiting for a support resource to troubleshoot.

The diagnostics will be uploaded as soon as they finish. Yes, this only happens during the preview phase while editing/creating the report. If you simply run a finished report, it just runs for hours and hours and never returns a single result, but at least it doesn't crash the connected Orion instances.

They're monitored via WMI. I'm working a ticket now, but waiting for the issue to happen again to provide logs. DNS still resolves the IP to a name in the cases I've tested.

I agree that it's important for certain groups to view the same information, but your suggestion still suggests I need to dust off the old crystal ball and conceive a collection of static dashboards tailored to our environment with every possible view/chart/gauge that folks may find useful in any situation. I don't want to…

Changing the polling interval back to the original 10 minutes did not reproduce the issue (it was only in a 1 minute state for a few hours). It's been showing accurate data since the polling interval change from 10 minutes to 1 minute. I see nothing out of ordinary in the event logs on the target server or polling engine…

Just got off 2 hour support call. The SolarWinds.InformationService.Core.dll contained within HF3 appears to be the root of our issue. Ticket has been escalated internally. Got our environment back to working order by restoring the old SolarWinds.InformationService.Core.dll. 

Case#1025178. This will be fixed in SAM 6.3.

I have the same issue with the "Custom List of Reports" resource. It only shows my custom reports created via the old Report Writer method. This doesn't strike me as a feature request to be voted upon. It strikes me as an oversight when the web-based report writer was introduced. The alternative User Links resource also…

We're running EOC 2.0, which was installed on Jan 4th, 2018 through the falcon installer downloaded on the same day. I downloaded the latest falcon installer this morning (to avoid known issues with older falcon installers) and checked for updates. To my surprise, HF4 was available for Orion Platform 2017.3. Applied the…

Sorry, I should have been more specific. Not looking for a single value. I'm looking to graph this out historically over a period of months. Also looking to avoid a table solution where I'd have to export and produce an Excel graph. The data is meant for CIO & Directors. Data arriving in the form of an Excel graph instead…

I tried the "Run the script under specified account" option and also toggled between the x86/x64 options, but still had the same "access denied" issue. However, I found a workaround by using the Invoke-Command cmdlet (see below). This gave me a method for passing credentials. Thanks for your help. $time = Invoke-Command…

What if it were for something like response time instead of CPU/Memory? For example, we wanted an alert if response time suddenly increased at a site. Setting up an alert trigger when it exceeds 95th percentile would have been a nice option. Instead, I created a dozen different "bucket" alerts and added sites that fit the…

This worked. Uninstalled hotfix via method described above, installed SAM 6.1.1 additional poller without any further roadblocks, hotfixed main poller, then hotfixed new additional poller. Many thanks, Cory Nearly two weeks of back and forth with support only to get the fix on the forums within a matter of hours...

Running a repair doesn't appear to remove HF1. The file version for SolarWinds.APM.Collector.dll on 6.1.1 vanilla is 6.1.1.3047. The file version for SolarWinds.APM.Collector.dll on 6.1.1 HF1 is 6.1.1.3099. It's still 6.1.1.3099 after the repair. I'm also working a recently escalated ticket I've had open since Sep 4th.

Confirmed bug since NPM 10.7. Ticket#747415. No update regarding if and when it will be addressed.

Update for Ticket#771812 mentioned in my original post. If you see this error... Try removing resources from the view (settings-->manage views-->node details, volume details, etc). I started by removing the new forecast / app stack resources that are automatically added to some views. Removing some resources will help…

More fun. SQL server CPU jumps to 100% and stays there until you reboot. SolarWinds web interface and email alerts wonky meanwhile. 3 times in the past week. Never happened prior to NPM 11.5 / SAM 6.2. Ticket #777141 Unable to remove nodes from "discovery ignore list". Ticket #777967 I noticed hotfix 3 was released on the…

Update. We discovered a change in Windows Event Log Monitor behavior after upgrading to SAM 6.2.4. Before SAM 6.2.4, a failed WMI or RPC query for the Windows Event Log Monitor component resulted in a status of "Unknown". After SAM 6.2.4, a failed WMI or RPC query for the Windows Event Log Monitor component results in a…