jaybone

Another vote - we had a VPN down event last week, but NPM showed it as up the whole time. Didn't know there was a problem until the business unit that uses it started complaining they couldn't talk to the partner org.

Bumping this. It's crazy that we have to jump through hoops to get basic info from our monitored nodes. I've got my HP stuff being monitored via the OS's IP address and WMI (gets all the Windows stuff not exposed via SNMP) and the iLO's IP address via SNMP (gets better hardware health info - e.g. RAID battery status -…

We have some Dell servers I'm supposed to monitor that only have the iDRAC exposed to our network. I have zero other visibility to these devices. Being able to get hardware health from it iDRACs would be huge.

@"sja" wrote:Hi @"jaybone" Sorry you are right some type event you can alert on... I think you could move the thread to "NPM Alert lab" there some SQL gurus that could make custom SQL alert .. SELECT TOP 100 EventID, EventTime, NetworkNode, NetObjectID, NetObjectValue, EngineID, EventType, Message, Acknowledged,…

Sorry for the thread necromancy, but I'm wondering if this actually works for anyone. Running 2020.2.1 HF2, I've got the following selected, but in testing against a Windows host, it's not discovering a newly-added array that's initialized and mounted as D. I would expect that the checkbox for "Fixed Disk" would cover this.

Hi, thanks. I'm not following you. There is no such option. "Alert on" has 135 possible things to choose from, but Events aren't one of them. The only thing I'm seeing in there with the word "event" in it is "Auditing Events." I'd think that changing the trigger condition from "Field" to "Event" would let me alert on this…

Like I haven't been doing that for two days. All I've found are people complaining about similar things, and dicey user-created scripts from 8 years ago. I know how to create alerts, but can't find what the criteria are for creating one based on this.

Still just running as-is, and annoyingly spamming everyone with DFS alerts every time a DC gets rebooted.

That's essentially what we're using. We took the AppInsite for AD templates, copied and stripped them down to just a subset of the included monitors.

Thought I did this months ago, but apparently I got distracted by something shiny... That did the trick, though, thanks!

These are great, thank you! While not specifically addressing the original problem (old .exe based alert doesn't appear to parse regex properly) it definitely produces the desired outcome. Probably just as well, since they've been moving away from those .exe tools anyway - I have to imagine they'll stop being supported at…

This is not working; we're still getting SAM alerts about some DFS stuff (specifically, "Communication with Partner") when a DC is rebooted. Might be a timing issue? The groups' refrersh frequencies are set to 60 seconds. The DFS monitors are set to 300 seconds. If that 300 seconds comes around and finds DFS problems in…

Right, like I said, I can disable it, but is there a way to get rid of it entirely? I'd like to de-clutter the tree, but disabling polling leaves those servers in there, just gray.

Thanks!

Seems to have fixed it. Before the agent upgrade, new folders were being created every 25 minutes. It's been almost an hour and a half since the upgrade completed, and no newly-created folders are in there.

Will do, thanks.

SNMP doesn't get us the Hyper-V info. I'm currently just adding the iLO interfaces to monitoring, and querying those with SNMP. I supposed I could also put a second IP address on the hosts and query those with SNMP, but the iLOs are already configured. Either way, or even deverts's suggestion to use a custom SAM monitor…

Did you ever get a resolution to this? I'm seeing a over a dozen "failed" s2s vpn connections that never existed in the first place. All of these are just attempts by outside entities to establish a connection to us. Mostly ShadowServer (just doing what they do, I guess) but a few from random other entities.

Guess I spoke too soon. That second node is broken in a different way. It's "unknown"

Any word from them when the agent might be available? I've got 38GB of this junk eating up space.

I'm 99% sure I did, but stupidly, because I was annoyed, I deleted the old version before starting over, so I can't compare.

No, that's what I'm saying - nothing looks wrong. CPU, RAM, etc are all normal. Nothing is in the red.

Ahh, OK. Thanks.

Nope. Neither searching by IP nor hostname, both of which have been the same for many years, shows any activity before my adding the node two days ago. Even searching Event Messages - All Events, This Year (i.e. stuff would have been triggering the email alerts up until it didn't) returns nothing before two days ago.

Thanks - I didn't even realize that web-based alerting could see syslog stuff, actually. I've been still using the old Syslog Viewer executable based alerts. As-written, your query seems to get extraneous stuff, though. Every time the trigger is evaluated, the alert fires, apparently because it's looking at all the syslog…

Same here.

Unfortunately, this doesn't work. The Delete option is grayed out, so you can't even try to delete it to see what it comes back with, at least in our environment. Orion Platform 2014.1.0 SAM 6.1.0 NPM 10.7 IVIM 1.9.0

Will do. FWIW, tried to replicate against another node polled with WMI and was unable to - everything worked fine with the second node. Thanks

I can't. That's the problem. The resource isn't shown under the node, so I can't uncheck it. Wehther expanding in the nodes tree or digging into the resources of the node, the HV resource is not shown. Normally, I'd expect it to show up between the last NIC and Asset Inventory while looking at the resources, but it's not…

Nice, thanks. Never even noticed that Delete button way over there. I've only ever added or removed stuff from the List Resources page. That's letting me kill the stale volumes. Any idea how to fix the similar issue with former Hyper-V servers? I can disable polling, but not remove it.