jm_sysadmin · Sr System Engineer · ✭✭✭✭✭

My network team is using alerts from Cisco software to do this so I can't confirm if this works. In Orion I would use some combination of the status below, did you try disassociated or disappeared? 

I think you will want to build a view with your stuff, then add it to the menu bar. Since you manage a cluster, you could just find your cluster and add it to the menu: https://support.solarwinds.com/SuccessCenter/s/article/Creating-and-Modifying-Menu-Bars-Video?language=en_US…

Does it work on other pages? This looks like a summary page. I am using that widget, but with no iframe on node pages. It works (Orion version 2020.2.4) My code looks like $(document).ready(function() { $("tr").filter(function(){return $("td:last",this).is(":empty");}).hide(); }); ${Caption} in ServiceNow ${ServiceNowID}…

I have had this, and I never did get to why it happened. My fix was to add in another Alert Action, and recreate the Incident task. The new one, Identical as far as I could tell, worked. I assume it was some JSON or data type related thing. 

If you are using SAM or SCM think about WinRM at the same time

We don't use the secondary at all, the primary is an alias in front of some traditional HA elements, a GSLB to get it to an active Data Center, which is in front of VIPs that have the various SMTP relay's in it. All SMTP traffic goes into security appliances first, then into our mail systems.

This is a topic of conversation for many of us. Microsoft and windows doesn't include a read only/ auditor type role that we might want. First lets talk about those Domain Admins rights. Nobody wants those to get out. If SNMP gives you what you need on Domain Controllers, then sticking with it isn't bad. If you need more,…

How do you normally deploy software to your servers? This is just like any other installation, and in this case it will add a service that runs as System for monitoring going forward. 

Are you on the latest version of the SDK? (use the beta it fixes copy/paste in SWQL studio)

Yes. Use the API or directly query SQL. GitHub - solarwinds/OrionSDK: SDK for the SolarWinds Orion platform, including tools, documentation, and samples in PowerShell, C#, Go, Perl, and Java.

Anything you do adds load, but the impact isn't noticeable when its used. I have had real time stats following to dozens of user with multiple things up during issues and barely moved the CPU and Ram. 

Under settings from the top menu do you have an option for manage dashboards? Does that do what you want? 

Alerts have actions that will let you send data elsewhere. I would think using the get or post is likely how you would do it https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-using-get-or-post-url-functions-sw1058.htm If the doesn't work, simple option like sending traps or syslog may help,…

If you are looking for data via SWQL I'd look in: Orion.APM.ActiveDirectory.Replication I am not sure what widget you are hoping to use, but you asked for a number, so maybe the KPI? SELECT Count (SourceNodeID) as [Number of DCs with Failures Replicating] FROM Orion.APM.ActiveDirectory.Replication Where…

I needed a very similar SWQL statement, I think I got the custom properties correct. I like to group based on Status not status description to keep the groupings smaller. SELECT Count( NodeID) as [Count] , N.CustomProperties.Team , Case When N.Status = 0 Then 'Unknown' When N.Status = 1 Then 'Up' When N.Status = 2 Then…

I think this will do the trick: https://thwack.solarwinds.com/product-forums/network-performance-monitor-npm/f/forum/88937/orion-urls-for-firewall-whitelisting/ @"m_roberts" started collecting it, and I think its a pretty complete list. 

I agree, in the SAM component you can filter it out in the following sections. It sounds like you aren't getting false positives, I think you find out about events that were asked for. I think getting more specific on the criteria will help. That said, SAM is not a great replacement for SIEM tools. Typically those tools…

@"janobi" advice is what I would say, but also see this link for hardware sizing: Multi-module system guidelines for the Orion Platform (solarwinds.com) 

@"karem" First I want to make sure you know that this isn't support, this is the community replying in this forum. If you want the official word on what to do, definitely open a case at https://support.solarwinds.com/ I suspect that they are pretty busy right now with all the upgrades happening, so I am happy to share my…

It didn't use to be there, I think was added 2 or 3 years ago

WinRM can be configured to replace WMI. its typically used for PowerShell remoting, but it can do a lot more as well. Take a look at: https://thwack.solarwinds.com/resources/b/geek-speak/posts/what-is-winrm-how-do-you-configure-it There is a free tool to configure it on a bunch of devices at once. If you don't want to, you…

You didn't include the alert's Trigger actions screen, I assume that you have an escalation after 12 hours to email again? The Evaluation Frequency is typically fine at a minute (it runs the query to trigger or close alerts) but you can change it if you don't need alerts to trigger or clear quickly. Do the alerts resolve…

Reboot the server, and start the Configuration wizard again from the Start menu. Its hard to say what happened without a deep dive into the logs, but that often fixes install issues. I would also say that you can open an Incident with Support. Evaluation installs can get assistance too. support.solarwinds.com/

Just don't include any SNMP or WMI credentials in the discovery profile for the ICMP sweep. Then it shouldn't try any. Also, your SecOps guys should know about this exists, even if preventing failed authorization attempts is admiral in its own right. Orion will be noticed eventually, even if well configured. Monitoring…

How far have you made it? Is the device added into Orion? https://documentation.solarwinds.com/en/Success_Center/orionplatform/content/core-adding-devices-for-monitoring-in-the-web-console-sw851.htm Is the interface gathering information? If not, add…

All those unknown should clean themselves up, just make sure to discover the interfaces that replace them. 

Change the Group By to use the Columns from the SWQL views we have like: Group by N.NodeID, N.Caption, C.ComponentName, A.Name, C.StatusDescription, N.StatusLED, N.DetailsURL, A.DetailsURL, C.DetailsURL Order by N.NodeID ASC

OK, so there still is a template for SQL performance stats, I would look at that as a start to replace AppSight info. But lets look at stuff in AppInsight and I will talk about the areas so you can decide if there is anything you care about adding. 1. The App details are useful, but you know what you have. Sometimes…

Add AppInsight for SQL to the cluster IP, between DPA and AppInsight you will have all the data you need. Add AppInsight for SQL to an active SQL Server cluster node (solarwinds.com) There are templates for SQL server Services, and windows server cluster that you may want to consider as well. For the VM side you want to…

I have used it a few times, and it should work, show me what you want to do and we can work through it. Below is an example that I used. (the order by gets ignored I think but you can do 'stuff' to order it in the widget I think)