davidmaltby · Principal Architect

We're currently in regression testing with the product and all I can say is that it should be out very soon. As for collecting on different ports, you would need more then one collector to do that. That is a feature that we might consider adding in a future though. Thanks,

So in the two cases that we've been specifically looking at. We are seeing in the PCAPs that the TCP traffic is coming through only on a particular interface. I really don't know how to match your Thwack user name with the individual PCAPs. So here is the findings. If the IP number matches your nodes, then I guess you know…

I've just pinged Tech Support to find out where things are at with your case. Did they send you a hotfix to install? We now have one for customers with your situation. I'll try to make sure that they contact you soon. Thanks, David

Yes, disks have time and time again been shown to be the bottleneck of performance for our customers (as well as in our tests). You mentioned that I have worked with you before, but I haven't associated you with your Thwack name. Did I have you throttle back the checkpointing that SQL server does? It would have been where…

Yes, you want the "SolarWinds Real-Time NetFlow Analyzer" forum. Here's a link: http://thwack.com/forums/99.aspx Thanks, David

If there are no more stored flows in the database with conversations involving an endpoint IP address, then its DNS information is deleted from the database during the nightly maintenance.

Let me know how it goes. We've had great results with our pre-release testers.

We've worked on a possible solution that we would like to try with you, but you'll need to contact support to get it. Let them know that I've been working with you on Thwack. Thanks, David

Just to clarify on your request. Is there a standard path, and you are interested only when another path is used? Or are you wanting any change in paths to be alerted on? For instance: Maybe your standard path is A -> B -> E And you would like an alert when the path changes to: A -> C -> E But if it then changes to A -> D…

In our lab, we have been testing with an Adtran device without issue. Don't assume that all models aren't supported. Thanks,

Also, I'll log an issue in the UI, that when you set the root folder to a UNC path, that the service needs to be running under an account that has access to this location.

You know what? After playing with it for a while, I think that you can get what you want.. Here's what I ended up with.. (I've attached an image.) First what you need to do is isolate the resource in Orion that you want to display. In my example, I did the following steps: * First went to the Orion website with the…

Yea, I agree with you. It looks like we'll need a sniffer log where you are trying to perform the Cisco download. Our tech support can take it from there. Thanks,

Thanks for your comments. This had already been logged in Dev as a feature request, but I've indicated in the request that you also would like this feature as well. Thanks, David

Sorry, the number of rows in that in the top 10 are important for me as well to understand if the size of the datasets that are causing the issue. Can you open up the EOC.PollingService.log files and see if there are errors in there that are time out type of errors as well?

Do you mean that they are running without any DNS name resolution? If so, then we wouldn't be able to verify the signed binaries. Also, do you see anything in the TFTP logs that are located in C:\Program Files\SolarWinds\Engineer's Toolset\Logging that indicates that an error occured? Thanks,

That error points to an incompatiblity issue that the Infragistics controls that we use have with IE8. See a posting on their website: http://blogs.infragistics.com If you read the first post, you'll see the same type of error that you are getting. It appears that they are still working on fixing the issues. The last post…

Yes, somewhat. But here are the details, just to make sure what you're thinking is how it is..... The Details tables store the conversations summarized by the minute . Each of the detail stores stores 15 minutes worth of data. By default we store at least an hours worth in the details tables. Therefore for a node, there is…

So, you're not limited to only the local accounts in your scenario. (if that is what the policy is limited to) You could use accounts on the domains that the EOC machine is part of or trusts if you want. But yes (to an extent), if Joe Blow, is in an untrusted domain from the EOC machine's perspective, then you'll either…

You've told me the statistics, but you haven't told me how y'all are detecting this. Is it with SQL Server Management Studio, with SQL Server's Performance counters, or with some 3rd party tool. I'd like to know, so that I can either determine whether its our application, or your SQL database team is misinterpreting what…

Its not the FlowCorrelation table that is causing the issue. It is the data in the NetFlowDetail_X and NetFlowSummaryX tables. If you look at the values in the TotalBytes column, for all of these tables, you'll see that some of them are negative. That is the cause of the problem. To find out which tables have these…

I'm unable to reproduce. From the NTA home page, I selected an interface and from that interface page, I selected a protocol listed in the Top 5 Protocols. I changed then changed the Named Time Period to 24 hours and could not reproduce. Further from that page, I then then selected one of the Applications on the Top 5…

The Toolset 9.2 Service Pack 1 is currently in regression testing. It contains the fix for SwitchPortMapper mentioned in the previous post. I cannot comment on an exact date for its release, but it will be very soon.

It is safe in that the FlowCorrelation table only keeps a resolution of DNS resolutions. Once you delete it, of course, the IP addresses will not have a way to resolve in your graphs, until new NetFlows come in with those IP addresses in them. Then the service will see that they are not in the FlowCorrelation table and…

It probably is because you've had the service running. The data in the details table, by default only stays there for 1 hour. That fact that you found negative data in there indicates that the issue is with the NTA service (the collector) and not with the web page. I am pretty confident that this is the issue that I was…

It is most likely that we do not have the MIBs for this device in our database. We can verify this if you could look up a value for us by performing the following steps: * Open up the MIB Browser and set the IP Address of the device (in this case 10.2.222.1) * Navigate to the sysObjectID node with an OID of 1.3.6.1.2.1.1.2…

PeteF,FG4 stores only your uncompressed data. If you reduce your 4 hour uncompressed down to 1 hour, and restart the service, then when the next night maintenance occurs and a shrink is performed on the database, then that disk will reclaim the space. I've also looked up the details on your exception and have informed Tech…

Yes, reviewing your diagnostics, I see that in your Summary2 table, you have over a billion rows. Because of the issue in 2.2.1 where table in Summary2 never got collasped into Summary3 and hence never was groomed out of the system, this table has grown to this size. I've given your tech support rep. instructions and T-SQL…

Ok, I've found the bug. If the host name contains just 1 period, then the first letter was getting chopped off by the service. I have fixed this bug and it will be in the first service pack for NTA 3.0. If you want it to display right, you can change the entries in your FlowCorrelation table. Execute a T-SQL query like…

Currently we're in the last iteration of the 3.0 development cycle and have fixed this issue for that release. If resolution to this issue is critical at this point in time, please contact our suport and we'll see what we can do. This issue could be described as a rounding issue. The data is getting associated with the…