jrouviere ✭✭✭✭✭

Firstly you will want to confirm that you have the latest connector version, if you check the settings for your ePO connector you will see a Tool Version at the bottom, the latest appears to be Revision 39. If it is the latest you'll want to reach out to Support. Most likely they will want a Tool Maintenance by Alias…

As Valkos states, there's no way to hard code log retention in the LEM at the moment. Instead it's based on how much HDD space you have. You can use the Database Maintenance Report to tell how much data you're storing (and calculated in Days): Success Center To increase retention you need to allocate additional HDD space:…

The short answer is that anything that you could poll from an operating system normally is available to the agent. In fact, installing the agent is usually advantageous not limiting. For example: a node with the Agent tends to use less bandwidth when communicating with Orion. An Agent is required if you want to use a node…

If you're using Appinsight for IIS it should be easy enough, you'll need to find this criteria: AppInsight for IIS: Application Pool/Name AppInsight for IIS: Application Pool/State And the certificate information is under Site Bindings, for example: Site Binding/SSL Start Date So Site Binding and AppInsight for IIS:…

The Reports Console has the Solarwinds Actions report which will report on rule activity. It groups the rules based on the action taken, not the rule being fired. You may be able to export and manipulate the report to get the data you're looking for, but I would suggest going into the Web Console directly and using nDepth…

There are a few possible causes here, but this is the one that I felt was most likely to start with: NetFlow sources and CBQoS polling - SolarWinds Worldwide, LLC. Help and Support This is taking for granted that there aren't any configuration issues with the flow and CBQoS setup on the network device itself.

I believe your understanding is solid, however, the MSMQ files don't tend to persist in a stored fashion unless something is wrong. Typically they should be processed in RAM or so quickly that they don't hang around in storage in any long term fashion. MSMQ is used for many features of Orion outside of just the netflow…

I don't know a way to do this via the UI, but if it was a critical need for some reason you could probably create your own method and reporting through API and your language of choice to do it.

wolram​ is correct, if you're checking via registry or Programs and Features you're going to see the old version. Another way you can verify if you want to do the manual checking is by reviewing the local install folder directly (C:\Windows\SysWOW64\ContegoSPOP) and you will see the update folders for the latest version.…

Virtual Machines? Any chance that these are clones or have the same MAC address? We ran into this issue with some select machines in our environment due to duplicate detection. There's two forms. One will stop you from even seeing the nodes in your discovery and one will stop you from being able to import the nodes during…

Your output needs to be in the format of "Statistic: <numeric value>" and then you can have an optional "Message: <string>" SAM Script Component Monitors - Everything you need to know Depending on how you want to roll it, I usually put some kind of if/else in the script (normally I code Python, so more pseudo-code for you…

There's a few different things to address here: * If you are using the SIMs (the physical appliances) then you are going to be out of support so that's going to make certain things a little trickier, like making sure you get the right versions, etc. * The agent should show up as the Solarwinds Log and Event Manager Agent…

When configuring the fields for the send email action (and really any action) you need to match the event from the correlation to the action. For example, in the Continuous Excessive Logon Failures rule, the correlated event is UserLogonFailure. So all of your e-mail templates need to include UserLogonFailure. This is what…

You may want to check the retention settings for NTA. If you're trying to retain more data, then NTA will keep at it until the drive is full. If you don't need 30 days, try setting to 15 days if that's enough data. I would wager this customer isn't the same size as your others which is why you haven't seen this issue…

If you still have Patch Manager installed the easiest way is going to be using either Check and Manage Computer Connectivity or Deploy Client Components. Both of those options have radio buttons to set for uninstalling the providers. SolarWinds WMI Providers actions - SolarWinds Worldwide, LLC. Help and Support If you're…

These KB articles will help you review and then resolve potential time related issues: Unable to log into Virtualization Manager due unsynchronized time - SolarWinds Worldwide, LLC. Help and Support Adjust the Vman System Time if the appliance has no internet access - SolarWinds Worldwide, LLC. Help and Support

Unless I'm misreading this, it looks like you need the URIs not the nodeIDs: OrionSDK/AlertSuppression.ps1 at master · solarwinds/OrionSDK · GitHub

Welp, I need to re-visit a similar rule that I have in my environment after looking at your case because I'm sure we have a similar issue and I just didn't carry that logic through far enough. In your case, I think you've already got the building blocks, so let me see if I can explain it clearly: In short, use the…

I believe the report "Approved Summary with percentages and computer counts" found under Reporting -> WSUS Reports -> Windows Server Update Services Analytics has most of the information you're asking for. It appears that it doesn't have classification so you'll need to add Update Classification Title as a field and then…

You are free to use MSP, MSI or EXE if you would like, all are supported packages. If you install using an EXE note that you will be limited in some options, such as being able to remove the EXE easily using Patch Manager. Uninstall a package using Package Wizard Update Management - SolarWinds Worldwide, LLC. Help and…

Yes, Patch Manager can manage two upstream servers. The primary difference is how the WSUS server gets Updates from upstream (is it Microsoft or another WSUS server, that's the main thing for Primary vs Secondary WSUS servers) so that doesn't change much for Patch Manager. What is the error that you're getting with the…

There is ${N=Alerting;M=AlertTriggerCount} Count of triggers, but it looks like it's for how many times the alert has fired in general. General alert variables Otherwise you may need to create a custom query to return the count per instance of the alert.

I'm not running 2019, but had some of the same symptoms when we were still on 2012 R2. The main things to check to help narrow it down were: How many ports are in use? and Which process is doing it? We had a few causes for our case, but the ultimate one ended up relating to the Application Dependency Mapping and the Orion…

The only thing that comes to mind is that there is a Log Off action you can set up with a rule. Do you have a rule set up with that action? You may want to disable it if you find it and then review the event correlation in case it's overly broad.

Last I checked Sparc wasn't supported. I don't think it's changed: SolarWinds Orion agent requirements

Firstly, if you're using UDLP you'll need to make sure that the devices are included in the white list. UDLP is evaluated FIRST and then the information goes to the LEM to trigger a rule if it applies. There are plenty of ways to set up the rule, but you will want to be mindful of your grouping and operators if you're…

Hello tpmobley, It looks like you have the incorrect event type. A new user event is going to show up as a NewDomainMember event, not a UserModifyAttribute event. Additionally to answer your broader question, the LEM has template rules that will do a lot of this for you if you enable them: Specifically "User Account…

Don't recall this one, so here's a couple of things that come to mind: * Can you open All Updates from the WSUS console directly (go to the WSUS server itself if it's a remote server and launch the WSUS console)? * Did you recently publish a Third Party or Custom package? If you can't launch the WSUS console, I would keep…

We're still evaluating WPM, but I believe most of the data you're after is in this table (SWQL): Orion.SEUM.TransactionStepRequests It has measurements for when requests start/stop, dns start/stop, etc, but I don't see anything about the specific error code so that may be in another table.

This might need some refinement, but this is what I put together to start with (the Orion.Volumes table only has one Disk Size field, it doesn't contain the history whille VolumeUsageHistory should): SELECT v.node.Caption as [Server Name], v.Caption as [Disk Name], count(DISTINCT v.VolumeUsageHistory.DiskSize) as [Size…