jrouviere ✭✭✭✭✭

Sounds right. Take a simple rule, logon failure. If you specify the event type, but nothing for source/destination machine, etc, it will apply to every machine/group. If you want to limit it to a specific group, you need to add that into the rule correlation.

2016 has always been supported, but the Install Anywhere packaging required some smoothing to support some UI changes from 2016 (which is why the remote installer was a work around) and there was a minor display issue once in the console not registering the OS correctly. All of that is resolved with 6.3.1 Hotfix 5: Log and…

Patch Manager doesn't necessarily work with Orion the same as a Core product would (NPM or SAM for example). Not all of the services are going to run or are necessary. Seems like the Job Engine should mostly run though. Before you spend a lot of time troubleshooting this, however, you may want to determine some other…

Hello Blake, Here's the KB article that will help you resolve this: Troubleshoot InternalNewToolData alerts in the LEM console - SolarWinds Worldwide, LLC. Help and Support If I had to guess you likely have more than one Cisco connector (or the incorrect connector) pointed to the same facility (sounds like local7 in your…

Patch Manager doesn't use the Syslog or Trap service so I wouldn't expect those to be running if the only product you're using is Patch Manager. If you have other Orion products such as NPM you may want to check with that respective team if you're planning on getting Syslog or Trap messages. In most cases it doesn't have…

This might be more of a support question. I only see a reference to JRE version 8 or later for MacOS so I can only assume similar requirements. This was another article I found in case the error you see is related: Success Center

It's possible there is some firmware issue, but I'm not directly aware of such. I would start by verifying in the ASA config that you're exporting the E 0/1 and E 0/0 interfaces instead of the Inside/Outside. The most likely piece is simply verifying the config before trying to pin down if it's a bug and looking to upgrade…

Hello Shocko, Patch Manager isn't really a solution for talking to client machines that are off the network. It's assumed that there will be network connectivity to the clients whether via WMI or the Agent. The only real work around for this is going to be using a VPN to have those machines phone home. Additionally to…

Let me premise this by saying that if you're under active maintenance you will want to reach out to Support directly. With upgrades there can be a number of moving parts that can cause issues. With only some nodes being affected it could be just the configuration on those nodes, or perhaps the data for those nodes are…

Hello Sbaird, I think in this case the issue is using wildcards in the EventInfo field. You're trying to search for a specific string inside of a string, so you're trying to find "User Account Disabled, jdoe" instead of "User Account Disabled, jdoe1" for example. By using the wildcards you're telling LEM to search the…

Is the ObjectType not a field or miscellaneous information in the event? You should be able to add that to your filter.

Two Thoughts: * It looks like you're using the Report Writer reports so you can add Summarization options that might help cover it: Report Writer Summarization Options Tab - SolarWinds Worldwide, LLC. Help and Support * This might be a limitation of those reports in general. For example, comparing to the web based reports…

Hello Jacob. I'm going to start by letting you know that you may get a quicker response if you reach out to Support to have them help you track this down, but here are some things you might check: It is possible that this is due to your 2008 R2 servers if you're running WSUS 3.0 (if that were the case your Windows 10…

There might be other issues, but one thing that I see is that you're missing a colon. It should be: echo "Statistic: 0" For example. Additionally the statistics are used to poll statistic data, if you want the component to return a down status, you need to use an exit code. Here's some additional information: SAM Script…

I believe your issue is with this statement: max(APM_ApplicationStatus.[TimeStamp]) as [Month], This results in it setting the current application status time as the Month. If you set it to: max(APM_ApplicationStatus.[TimeStamp] -1) as [Month], for example, then your report would show it as January 31st (since that's the…

Error when deploying third-party updates to client systems - SolarWinds Worldwide, LLC. Help and Support If you have the certificates in place, do you also have the "Allow signed content from intranet Microsoft update service location" Group Policy setting enabled? It will require both to work.

There's not really a timeout such as this that I'm aware of, or at least not some settings to update it. You can check your settings under Manage -> Appliances and check the Login or Settings tabs under Properties. If you're refreshing the entire page instead of the widget then you will likely have to sign in again. To…

Any time I've drawn these conclusions for our environment I've been looking at Task Manager when it happened. That being said, if you have a template against the server for the Orion Application and your Anti-Virus it might be easy enough to draw parallels via perfstack as you suggested. For example, when I'm doing an…

Display Network Atlas maps in the Orion Web Console - SolarWinds Worldwide, LLC. Help and Support

Thanks for reaching out, a few of things: * Here's our upgrade guide in the Knowledge Base with a lot of the information you're going to want to know: SolarWinds LEM Upgrade Guide - SolarWinds Worldwide, LLC. Help and Support * Additionally, each upgrade and hotfix will include Readmes on how to do it. * The Upgrade and…

I just tested with a new base account and I'm not seeing the same thing: When I created the base account, I received 403 from the Recommendations page just trying to click on the link for Recommendations from the My Dashboards menu. When I edited the account and set to Allow under Recommendations I can now get to the page…

There are several different groupings that you can set in Patch Manager: * WSUS Groups * Patch Manger Groups * OUs One common way I've seen this happen is with Patch Manager Groups, for example. These groups are not dynamic so if you create a group, drop in the server and then set up a task (scheduled or otherwise) and…

Thank you for posting this, I guess we got lucky having our ALX in place already. We might be getting a deal, but we spend much less on that license than we would for 100 nodes and we have at least 800 or so that we would need to monitor.

LEM supports sending SNMP traps in two cases: * In 6.3.1 LEM can send performance data, such as being monitored by NPM/Orion: Monitor LEM from NPM and the Orion Web Console using SNMP - SolarWinds Worldwide, LLC. Help and Support * There's an SNMP action in rules that will send information as an SNMP trap: Send SNMP Trap…

There are a variety of causes, so you will likely want to reach out to Support if you have maintenance so they can help you out with the specifics. The two things that come to mind are: 1. Your appliance is overloaded so you either need to reduce load or add resources. 2. You were previously backing up the appliance and…

If you change this from "swis.invoke" to "swis.query" does it work the way you expect?

Namely the variable you declare will change with the name of the custom property, so for example: ${N=SwisEntity;M=CustomProperties.Type} will invoke the TYPE custom property. ${N=SwisEntity;M=CustomProperties.City} will invoke the CITY custom property. So whichever is the name of your custom property you would need to put…

It might help to build off of your existing query if you have one, but the data you're looking for should be in the Orion.APM.MultipleStatisticData SWQL table.

My suggestion is to set your tasks to ignore exclusive updates when it discovers them. That way you will still update 99%+ of the updates and be behind only one update when it happens and you will need to set up a separate ad-hoc task to handle that update. You can discover this via reporting or your patching percentage…

There isn't any one report that specifically works for MSSQL events that I can see, so you will want to work within the reports for the existing events to set this up. For example, I see a lot of DROP events coming from my MSSQL Auditor are showing up as Object Audit events. In that case, the report that you can use to…