ecklerwr1 · Sr. Network / Systems Architect · ✭✭✭✭✭

Personally I wouldn't right away. If you're not affected you're not affected right now. I'm not sure right now is the best time to be doing upgrades until the dust settles if you're not affected. That's just me though. I definitely wouldn't upgrade until the 2020.2 HF 2 version comes out possibly today. Your version, if…

SolarWinds Orion Platform 2019.4 HF 5 < 2020.2.1 HF 2 SUNBURST Malware Backdoor HIGH Nessus Plugin ID 144198 SynopsisAn application running on the remote host is affected by a malware backdoor. DescriptionThe version of SolarWinds Orion Platform running on the remote host is 2019.4 HF 5 or later but prior to 2020.2.1 HF 2.…

If your software appears on the Security Advisory page, load the Orion Core Hotfix 2 when it is released scheduled for December 15 (today). It says it was 2019.4 Hotfix 5 that had the problem. If you aren't on HF5 I think you might have dodged the bullet. Of course you could always contact support to make sure but that's…

Helpful info to search for hashes from SANS: https://isc.sans.edu/forums/diary/SolarWinds+Breach+Used+to+Infiltrate+Customer+Networks+Solarigate/... What you should do at this point: * Verify if you are running SolarWinds Orion version 2019.4 through 2020.2.1HF1 and if so, assert which networks are managed by it (likely…

Helpful info to search for hashes from SANS: https://isc.sans.edu/forums/diary/SolarWinds+Breach+Used+to+Infiltrate+Customer+Networks+Solarigate/26884/ What you should do at this point: * Verify if you are running SolarWinds Orion version 2019.4 through 2020.2.1HF1 and if so, assert which networks are managed by it (likely…

Might have to get some verification from support. Sometimes the database schema changes between versions and this is where you can run into problems. As some have suggested what if you used new servers and patched version from tomorrow and restored your SQL server from a date prior to the APT versions? So basically a…

This is good in case you're not on an affected version and someone still thinks it's smart to upgrade to 2020.2.1 HF2 right now! I'm not sure why anyone would think this is a good idea right away but... that's just me. Bill

A Disciplined Approach to IT!!! Threat Detectives was the BEST! Thomas and Dez on the case! This was so awesome! https://play.vidyard.com/oQGoXyDKEi4GtSYSPHmoiT?disable_popouts=1&v=4.2.27 Bill

We're using nothing but the HTML5 interface.... flash isn't even installed. Can't wait now for the new reporting. I know that will be big undertaking to get the reports added in. Bill

I'm really looking forward to the new reporting engine! Bill

Telepathy ie. mind reading. Bill

I'm not using a bunch of VMware appliances but I can relate to the volumes and interfaces turning to unknown but I think this is because VMware changes this around a lot... at least I've always had this problem ie. not just now after an upgrade. I often see the vNIC's all changed around and half the interfaces turn that…

@Georgiy Is there link in thwack somewhere to how to email the netflow webpage graph urls in scheduled email for netflow reports? I thought some of the netflow graphs were built on the fly so wouldn't show up... for example the ones from the traffic builder graphs.

Thanks G... really cool :}

Problem has been fixed in and code post: * The status of this bug is Verified. The Fix for the problem is tested. * The fix is contained in the next major release following any or all of the versions listed in the "fixed-in" section. Fixed-In 12.2(46)SE 12.2(46)SE1 12.2(50)SE 12.2(44)SE3 12.2(50)SE1 Show interfaces showing…

Then you wouldn't need a very big LM license at all it would seem and get around the license limit! I'm sure this isn't what was planned but it might work pretty well.

thnx for the tip jcooler but still doesn't work in report writer... everywhere else fine. I'm going to hang on to that tip on "set nocount on" also though 'cause it may help sometime later :}

Roger that Roger... all's workin' now

I thought I was onto something but it does not match what I see on the webpage top talkers... not even close: this ran with following filter: I share ur pain Mike

I bet they will go away especially if the SQL server isn't in a VM. I know some people seem to be able to make everything work in a VM but at the same time I can't tell you how many people have had problem with it. The solarwinds guys seem to make it sound like you can run everything but the SQL in a VM without issue. From…

That's it and a great overall guide too... there's a lot going on when update especially, like I said before, if you're still on 11.x.x NPM.

Sounds to me like Debbie got to the root of the problem... I'm checking my 3750 code now as well

@Stephen- I'm running on 2k3 but it's good to hear things looks better so far with NPM 9.5.1. Keep us posted on this as I would really like to get my NPM up to 9.5.1 also. I've been having great experience with the NTA 3.6RC3. Finding out that the issues that arose during some of the post NPM 9.5SP2 Service Packs with…

Yes please do Bharath we are all interested in hearing about upgrade/update experiences... good or bad :}

@gbutler Could you share your error handler function used to log info when you get a failure?

I only have a couple custom SQL and they aren't required as much now as they used to be... one was for duplex mismatches which NPM is supposed to be doing on it's own now I think anyhow. I've really tried to keep things simple and not go too far outside a somewhat "normal" configuration anymore like with did in early 9.x…

Hi Marie- The problem is with two of Roger Wong's links in his post above: Additional tips for customizing tooltips: Customizing Web Console Tooltips Valid variables for tooltips: Tooltips Variables List <--This one doesn't work Descriptions of the variables: Basic Alert Engine Variables Advanced Alert Engine Variables…

Yes keep us in the loop! I update vicariously through you byron!

You're right sotherls... it works fine from the web now or from Management Studio... just not in report writer. Looks like scott hit the nail on the head... report writer has some kind of bug in it with some SQL. Anyway thanks for all your help sotherls! I hope this helps out txnogas since it was really his request :} I…

This I'm not sure of... just now preparing to upgrade my production environment to 12.x I only have it running in a lab right now without any Cisco devices... it's all VM's in there. I will keep you posted though. I'm curious if others have noticed these rec drops on any of their ASA interfaces?