jeremymayfield · Executive Director of IT · ✭✭✭✭✭

SEM excels at real-time log collection, normalization, correlation rules, and automated responses — far more than core Orion Platform alerting (which is node/metric-focused and lacks deep event correlation for threats like these). Core Orion alerts can handle some basics (e.g., time-based traffic anomalies via NTA or…

We'll see when the store is online if there are items needing purchased..

Here is the exact solution for your requirement in SolarWinds (SAM / Orion Platform). Since your Windows nodes are added individually (not as cluster objects), the built-in “Service Name = ClusSvc” report doesn’t show anything because the Cluster Service (ClusSvc) monitor is not enabled by default on most nodes. You need…

No — the SolarWinds Platform (Orion) audit logging for the SWIS REST API (Swis.RestEndpoint) does not log the detailed actions or specific queries performed by the API calls. Even after enabling the ServerSpecific setting to allow auditing of successful Swis.RestEndpoint logins (which is why you're now seeing those "User…

Yes — it is possible, but with some limitations because ExtremeCloud IQ (XIQ) APs are not full Orion nodes. They are child entities (thin access points) under the single XIQ Orchestrator node you added via api.extremecloudiq.com. How Child APs Appear in SolarWinds The XIQ controller shows as one node (Machine Type =…

Yes — your initial thinking is correct. Adding one Azure cloud account in SolarWinds (Settings → All Settings → Manage Cloud Accounts) consumes zero SAM node licenses and gives you monitoring of all discovered Azure resources (VMs, databases, storage accounts, App Services, etc.) plus basic performance metrics (CPU,…

Yes, SolarWinds can cover monitoring the availability of these digital channels using its synthetic transaction monitoring capabilities, which simulate real user interactions (like logins and specific actions) to proactively check if critical flows are working end-to-end. This is handled primarily through: SolarWinds…

Yes, this is a known issue tied to Meraki deprecating certain API operations (not the entire v1 endpoint, as the Meraki Dashboard API remains v1-only and the version itself is not deprecated). The full Meraki API v1 is still active and receiving updates (e.g., v1.66.0 in Jan 2026 per recent changelogs), but individual…

The AD Replication report you're referring to in SolarWinds (likely in Server & Application Monitor (SAM) under Reports > All Reports, or a custom report based on the Active Directory Replication template / AppInsight for Active Directory) typically shows high-level replication status (e.g., successes/failures per naming…

The "FQDN Lookup diagnostic timeout" in the Deployment Health tab (under Settings > My Deployment > Deployment Health) is a common but frustrating Active Diagnostics result in recent Orion Platform versions (2025.x+). It occurs when the diagnostic test itself times out (default ~30 seconds for many checks) before…

The SolarWinds Web Help Desk (WHD) REST API is notoriously under-documented for advanced querying, and sorting is one of the pain points many users hit (including in THWACK threads from 2025 with the exact same issue you're describing). The default sort on /Tickets (or /tickets.json) is indeed by lastUpdated descending…

(assuming API auth via API key or basic auth; adjust headers as needed): $baseUrl = "https://your-whd-server:port/helpdesk/WebObjects/Helpdesk.woa/ra/Tickets.json" $apiKey = "YOUR_API_KEY_HERE" # Or use Basic Auth $headers = @{ "Authorization" = "Basic…

Required: Your Bearer token$token = "<REDACTED>" Build the payload - WRAP in "other_asset"$otherAsset = @{ name = "Cisco Switch-Old-Test" description = "Test Item" manufacturer = "Cisco" model = "Catalyst 3560G 48 Port PoE+" serial_number = "FOC14564Y86" ip_address = "0.0.0.0" # Note: changed from 'ip' # status_id = 123 #…

The 422 Unprocessable Entity error from the SolarWinds Service Desk (formerly Samanage) API typically means the server understands the request structure and syntax (e.g., valid JSON, correct endpoint, auth), but it cannot process it due to semantic/validation issues in the payload — such as missing required fields, invalid…

Yes, this is a known change/behavior in ARM 2025.4 (starting with build 2025.4.0.381 and carried forward in 2025.4.x updates). It's intentional design from SolarWinds to align with role-based separation of duties and reduce the risk of over-privileged admins accidentally (or intentionally) performing bulk operational…

Best practice for Azure Application Secrets in SolarWinds Orion Platform (SAM / Cloud Monitoring for Azure): Your company policy (max 180-day secret lifetime) directly conflicts with the old SolarWinds documentation that still says “select Never expires”. Microsoft no longer allows unlimited secrets anyway (hard max is now…

The SolarWinds Free SFTP/SCP Server is a lightweight, standalone free tool (not part of the paid Orion Platform or Serv-U MFT product line), designed mainly for basic secure file transfers like uploading IOS images or configs to network devices. Updates, Fixes, and Future Enhancements This is a free utility, so it does not…

=============================================SolarWinds SWIS – Bulk Import Nodes from CSV with FULL SNMP MonitoringWorks for SNMP v2c (easy to extend to v3)=============================================Import-Module SwisPowerShell -ErrorAction Stop === CONFIG ===$OrionServer = "your-orion-server.domain.com" $Credential =…

Yes — you're hitting the exact classic gotcha with SWIS node imports. Creating the Orion.Nodes row (even with ObjectSubType = "SNMP", SNMPVersion, and Community) only creates the basic node record.It does not register the SNMP pollers (CPU, Memory, Uptime, Details, etc.) and does not run the resource discovery that the…

Very cool, thank you.

The Product described in the table is a Network Monitoring System (NMS) — specifically, a centralized, web-based, on-premises monitoring solution designed for multi-vendor network environments. This specification outlines requirements for a comprehensive enterprise-grade NMS tool that matches or closely aligns with several…

What you are seeing is a known behavior in **SolarWinds Virtualization Manager / VMAN polling of **Microsoft Hyper-V environments. When checkpoints exist, the standard VM disk fields often return the active AVHDX delta file, not the full disk chain. However, the Chargeback report uses a different dataset that aggregates…

The formatting limitations you are encountering are a known constraint within the Solutions/Knowledge module of SolarWinds Service Desk. The editor is intentionally simplified and does not fully support rich formatting from external sources such as Microsoft Word, and it strips certain elements (particularly embedded…

For an environment with approximately 240,000 tickets, the conversion of SolarWinds Service Desk from standard ITSM to Enterprise Service Management (ESM) typically results in several hours of controlled downtime, but the exact duration depends primarily on data complexity rather than just ticket count. In most comparable…

The behavior you are encountering in SolarWinds Engineer’s Toolset Desktop v2025.3 is expected. The legacy Alerting Engine used in the desktop Toolset does not expose a TLS toggle, and historically it only supported: Plain SMTP SMTP with authentication Opportunistic STARTTLS (if the server allowed fallback) However,…

In SolarWinds Network Configuration Manager (NCM), the variable picker for NCM.Interfaces[] is populated directly from the Orion Interfaces inventory table. The platform does not natively support UI-level filtering of that dropdown inside a Config Change Template. As a result, when a node has many ports, the list becomes…

Yes—organizations migrating monitored systems from on-prem to Amazon Web Services commonly face this exact issue in SolarWinds. The short answer: The THWACK method you found can work, but For Linux agent-based nodes, the safer and more scalable approaches are SWQL updates, API automation, or agent reconnection methods,…

The behavior you are observing is common with SolarWinds Service Desk because outbound notifications are sent through Amazon SES infrastructure rather than directly from your internal mail system such as Microsoft Exchange. Security gateways like Mimecast frequently flag these messages as spoofing if SPF, DKIM, or DMARC…

Your observation is correct: SolarWinds Network Configuration Manager (NCM) does not ship with built-in firmware upgrade templates for newer Cisco Catalyst 9200 / 9300 (Catalyst 9000 series) platforms. The default templates in many NCM builds cover older models such as 2960, 3560, 3750, and 3850, which is why you do not…

As long as we keep getting 3K points per month, I say it works for me for now.