jrouviere ✭✭✭✭✭

All of the Third Party content for Patch Manager is published and stored in WSUS. Patch Manager can still help with the management on the client side, but the clients would need to be reaching out to Microsoft Update directly or you would need to expose the WSUS server so that those clients can connect. Additionally Patch…

If that's the case you may be able to update it in the application monitor itself to overcome the issue:

The Reports Console is just a desktop application that gets pointed to the Manager. You can install the AIR console if you would like, early on I preferred to use that as it's a little snappier, but the web console is just fine for me as well, I leave it mostly to your preference.

OK, you may want to start over with the Detach Unauthorized USB Device template rule as it has a pretty good starting point for the correlations you're working with. You will want to clone the Authorized USB Devices group and edit it to have a unique name and contain an "approved" device for testing. The template rule is…

I think there's a small mistake in the last line, instead of @( $uri ) it should be @( $nodeUri ) , correct?

Did you enable debugging on the application to review the logs? That's the jist of it, we're likely going to get a pointer for the next piece of the puzzle by reviewing what's in the debug logs. The point in revealing it was just sharing my story on how I've discovered and resolved similar issues by enabling the debugging…

That is a different error than the one reported in this post. I would suggest giving the steps above a try as they will likely help you in determining the cause of the error. To recap at a high level: 1) Does this error happen on other machines with Reports installed? 2) Is port 9001 open from your machine to the LEM…

If you use the newish Manage Entities page you can filter multiple ways. Group membership still isn't an option, but if you were using custom properties wouldn't be difficult. Customize the Manage Nodes / Entities view in the Orion Platform In your case if you're disinclined to use custom properties, how are you selecting…

Not that I'm aware of. Everywhere I've seen the event messages (such as in the OLM.LogEntry table) they are stored entirely in one field. I don't know of another mechanism that would parse the message for you in the alert.

I forget exactly how I found it, but the networking guys wanted to see the actual message so we've been using it for a little while, glad it worked!

Good call. That works from the SWQL Studio. The script code between the Unmanage Nodes and Unmanage Applications is virtually the same though, right? So what would be the difference?

If you click on the failed message on the Network Discovery page does it tell you the details? Or are you able to post a screenshot of where you see the failure? Additionally, is it failing because you've hit your license limit on how many nodes you can add? Also, if you haven't checked, check the core.businesslayer.log…

Thank you!

OK, I see it now. I don't know if mseverrum has a tip for this, but sometimes I find that the group by doesn't honor a custom named field. So in this example your issue is in the Group By line, you can verify this by removing [TriggerObject], from that line and your query will work. You should be able to change that line…

Ah, wasn't even thinking of anything else, instead of "A.Node.CustomProperties.Location" you should just be able to sub in "A.CustomProperties.Reporting" from what I provided before: SELECT A.Name, A.Node.CustomProperties.Location, count(A.Components.ComponentID) as Components FROM Orion.APM.Application A group by A.Name,…

Bogdan is correct that complex alert conditions in would be a way to do this. When you turn on this option you basically get two sections for trigger actions and you can limit the scope of each section just like you would do with a single trigger condition. So the scope of the first trigger could be Server A and Service =…

Normally I would say just use the criteria in a search and that should work, but after trying to do the same it seems like both filters *should* work. Still I would go with the templated one as that should be more thoroughly tested overall.

You can find information about retention by reporting in the LEM: Success Center There's no hard coded number of days that LEM keeps data, it's based on disk size. As the disk fills LEM will purge the older data, basically as mesverrum stated. If you need to retain more, then you increase the disk space allocated to the…

The level (critical) and reporting of being unable to ping the agents is the one I dislike the most. 6k nodes, but having a handful not respond to a ping at the moment the check is done doesn't scream critical to me.

The Authentication piece is handled by adding the credentials to the Credential Ring in Patch Manager. Your nodes would then authenticate the credentials for the task (oversimplifying, but I think you get it). Patch stores the credentials and then uses them as needed, the only time it is directly reaching out to a DC would…

Anything is possible, but you have to have the data in the database. If you're not using DPA, how are you getting the SQL deadlock information? Do you have SAM or another monitoring tool that's able to poll the data? We do some of this in our environment via SQL Experience Monitors or scripting with SAM and then set up the…

That's direct from the Customer Portal. It's the same runtime, just as a separate installer so it should work fine for your needs and is provided like that for cases like yours I don't think the runtime itself has been updated for a while, however the reports software itself is kept up to date with the console version so…

Looks good to me. I follow your description, but with some things I have a field of probabilities and don't want to make too few/many assumptions. If you're getting some data, but not what you'd fully expect then I'd entertain the event normalization piece (data not being normalized for "reasons"), but it's a pretty small…

Unfortunately the application template I have is using Perl scripts and your errors indicate an issue in Python which leads me to believe it might be agent related. You could try to change the Preferred Polling Method to Agentless under the Advanced settings (when editing the application template) as a work around, but I…

Not the OP, but we've had this product for 6+ months and pretty much does what it says on the tin in my opinion. We hadn't needed some of the other features that make sense, like exporting logs, etc, but those seem to be added at a decent clip. We've been able to add the syslog message to the Orion Alerts in the same way…

Make sure if you're using 32 bit vs 64 bit, such as from my earlier example: C:\Windows\system32>c:\Windows\SysWOW64\cscript.exe /e:python c:\python34\Scripts\test.py You can change the bitness on the application template if you just want to try it that way, screenshot above as well. For the temp file, Orion copies the…

When you edit the template, above Component Monitors, there's an Advanced menu that's a little hidden. Expand that menu and the bottom option is Platform to run the polling job on.

You can review the task for any options I overlooked, but that's the sum of it and there are additional suggestions in the material I shared. The Shutdown or Reboot task that I shared previously is similar to running shutdown /i from a command prompt and has similar options available there.

My language of choice is Python, so maybe you'd be able to use this, or translate it to Perl for your needs, but what I think would be easiest overall for your case is to turn the "etime =" entry into the statistical entry. So you may have instances where you see etime = 'XXX' or something else, and then you can set…

The main thing that comes to mind is to edit the chart in the report and then at the bottom use the "Group results by" to group by the IP address field that you would like. So either Source or Destination if those are fields you have in your report or by the IP Address Group similar as the instructions here on step 7:…