jrich

One more thing to tack onto this. If you can also make it to where users can view the processes but not add them to monitoring. If you can make it to where there is a rights assignment or an ability to show only certain columns in RTPE to specific users or groups that would be great.

What about listing out the active processes on a server and CPU and Memory statistics for each process? This would make it so much easier to determine what application process is using up too many resources on the server. Any ideas on if that would be possible? 

We implimented this and it does work beautifully.

I agree. Having a restart notification tied to SNMP value changing or the service being stopped or started on a windows server is an issue. 

Wow really? Ok. Is this domain joined and are you using a domain user or local user? I assume you have the UAC slider all the way to the bottom. Can you see anything in the security log of the target server when you try to poll it? Is the target server on a different network?

We also deployed from the media and not from a build system or WDS deployment and no other policy changes had been made. This occurs on both domain joined and workgroup machines.

aLTeReGo, We think we found a better way to combat this. Using this old KB article from Microsoft, adding the LocalAccountTokenFilterPolicy dword value has solved the issue. Here is the KB. This did not require a restart. http://support.microsoft.com/kb/951016 This should not interfere (hopefully) with the Metro UI like…

Hey Byrona! A colleague of mine may have found a better way to deal with this. It is still a registry change but it is an add. Basically, what we are doing is modifying the HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System key by adding a DWORD value called LocalAccountTokenFilterPolicy. Setting this value to…

It effectively disables the UAC component. I've done it as a test and I'm able to poll my servers but the problem I have is that if I do this I know I might be reducing functionality or breaking parts of the MetroUI. Also, who's to say Microsoft comes up with a patch that resets this value back to its default. Disabling…

I opened a case about this as well. A little more about this. The case tech had me run wbemtest. I ran it from the poller that is local to the datacenter that the server is in after verifying with my networking team that they did not see anything in syslog that would be preventing the traffic. I am unable to pass the…

Byrona, Were you able to use the registry key change I suggested? I've had 100% success when I modified that value to 0 instead of 1 in the registry. Also, are you using a Domain authenticated user or a local user to poll the devices?

Sure. Here is the key. The value is set to 1 by default so changing it to 0 effectively disables UAC. Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System Key: EnableLUA Value data: 0 I've had to do this on every server I've attempted to add to NPM that runs 2012. The only thing I am…

How were you able to discover the cluster VIP? I am unable to pass SNMP credentials to the VIP at all in a 2003 or 2008 cluster in order to discover it in NPM. 

Hi Andrej, Thanks for the reply. Unfortunately this did not resolve my issue.

@ Sean, Thanks for the links. I've downloaded the two alerts and successfully imported them into my alerts manager and enabled the "Alert me when a managed node last poll time is 10 minutes old". I have a server that I have stopped SNMP on but have yet to have that alert trigger. I also did the same with the "Alert me when…

I had to disable UAC and make a registry change in order for this to work. The only other thing I can think of is to make that change. The problem is, as I've noted in another thread, Microsoft has made it to where the slider doesn't matter anymore. I've had to make a registry key change in order to be able to poll 2012…

Rob, I accidentally hit the suggest as answer to your question when I was attempting to reply. Your issue Rob, appears to be that you are monitoring the Physical Node instead of adding the virtual IP address as a node to be monitored and then assiging all of the clustered resources (Exchange services and Disks in failover)…

Hi Shuth, Thanks for the reply. We went a little different way with the logic and did Vendor Icon Contains Cisco ASA and then, under the Interface property monitor did Physical Address has changed. This way we didn't have to deal with custom pollers. Solarwinds detects that the interface's physical address has changed when…

I know this post is from several years ago but we're running into a similar issue where we are trying to get Solarwinds to alert off a Row Label rather than an ID. Is this possible at all? 

@ Sean, I don't see those new Advanced Alerts in my Alert Manager. Where can I get those Advanced Alerts? I did a search on the downloads section and haven't had any luck.

I am curious how you were able to discover the VIP via SNMP in order to add the disk resources in NPM to be polled. Reason I ask is because we have tried this on numerous occasions in Windows 2003 and Windows 2008 and now R2 and we have been unsuccessful discovering the VIP via SNMP. I am able to ping the device from my…

Just tested your SQL and I can confirm it does work. I found 15 devices that have failed a poll. One was a windows device that someone had disabled SNMP on so I couldn't even query the server yet NPM still showed the device as up. Kudos to you sir and thanks again!

Yeah, I think 30 minutes is a little long, maybe 20, but either way the customer would alert us also if it was going on. I'll give this a try. I just wish that NPM would allow that LastSystemUpTimePollUTC trigger was viewable from their builder. I'll build an alert and see what it catches. Thanks again for your help, I'll…

I did some further testing just now and I guess it doesn't like special characters like () [] and such. I was able to identify just one word in the string and it found that but as for the whole text string with characters it didn't want to look for it. I'm going to try and just use alpha-numerics and see if it still fails…

In theory you could add localhost as a node and never reboot your solarwinds box and then the node would always be green. The problem I'm running into with this though is that I have multiple customers as well and I'd like to have a node that will always be up and also show the customers where their websites are on their…

In my Alerts manager under Network Nodes ---> Polling Details I do not have a option for LastSystemUpTimePollUtc . Do I need to run this as a SQL alert instead? I am running SolarWinds Orion Core 2010.2.1 SP1, APM 4.0.1, NPM 10.1.1 SP1, IVIM 1.0.0.

Will test tomorrow and get back to you on the results. Right now I have two servers where SNMP is stopped so I'll make the change in the advanced alert to check for uptime differences. 

 Sounds great!

Thanks Earl, Turns out that UAC was enabled. I went ahead and added that registry entry as well for good measure.

Did you ever find this out? Whenever I go into alert manager and try to build an alert for this event the only status's available are Unknown, Up, Down, Warning, Shutdown, Testing, Unmanage, Unplugged, Unreachable. Where is the status for changed?