m-milligan ✭✭✭✭✭

Yeah, that's what we found - all failed logins (GUI and API) show up in the audit log, but successful logins from the API do not. 

Me? I always do this with the API or SWQL Studio. I'm responding to the OP.

This will do join all 3 tables: SELECT top 100 n.NodeID, IPv6.IPAddress as [ipv6_dotnotation], IPv6.IPAddressN AS IPv6, m.MAC, m.DATETIME, n.DisplayName, n.IPAddress, n.NodeDescription, n.Description, n.Vendor, n.Location, n.Contact, n.IOSImage, n.IOSVersion, n.CPUCount, n.MemoryAvailable, n.TotalMemory FROM Orion.Nodes n…

You can't do it in SWQL. To use parameters with SWQL, you'll need to use the Solarwinds API to execute a SWQL query. Then, you can pass in the parameterized query and the parameters. For example, in PowerShell you'd do this: $IP = '127.0.0.1' $swisQuery = "SELECT NodeID, Caption from Orion.Nodes where IPAddress = \@p"…

NodesData has 48 columns, so you'll need to populate a lot more columns than (IP_Address, Caption, ObjectSubType, RediscoveryInterval, PollInterval, EngineID) to make Solarwinds happy. If you really need to do this with a SQL INSERT, pick a representative ICMP node that's already in your database and take a look at the…

How complex is the condition in your primary section? If you're expecting to write the secondary section as a custom SWQL alert, you're probably best off writing the alert condition as a single SWQL query. Can you describe the primary and secondary conditions here? 

I did something similar with PowerShell and IE. Here's some code to get you started. $min_days_to_expiration = 60 $exitcode = -1 $statistic = -1 $message = "" $max_ready_wait_msecs = 1000 $ready_wait_increment_msecs = 100 $max_load_wait_secs = 10 $uri = 'https://companyapp/details/moredetails/somedata' try { ## Create a…

Excellent! We just configured HA and this is exactly what we need here.

Sorry, I thought I was replying to a different message. I didn't have this problem (although I clearly need to learn to read the entire post before responding).

Thanks!

Thank you! I knew it was out there!

I, too, would like to be a beta reader!

The "Critical" status refers to the status of deployment health checks, not the overall server status (confusing!). To fix the two servers showing critical, click on the "Deployment Health" tab. On the left, click "Severity" and make sure the "Problems" box is ticked. That will show you which checks have problems. Fix…

Try replacing AND StartTime.EventTime >'2022-02-24' with AND StartTime.EventTime > DATETRUNC('day', GETDATE()) That way you don't have to change the date in the script every day.

Here you go: Node outages for the last day with duration - Reports - The Orion Platform

This will provide the Node caption, IP address, Start/End times of the event, and duration of the event in minutes. SELECT Nodes.Caption, Nodes.IPAddress, StartTime.EventTime AS DownTime , ( SELECT TOP 1 EndTime.EventTime FROM Orion.Events AS Endtime WHERE EndTime.EventTime > StartTime.EventTime AND EndTime.EventType = 5…

Great! Your trigger condition should be:

What's the difference between unmanaged and maintenance mode?

This alert trigger will create an alert when an ESX host is unmanaged:

You can use SWQL date functions to create the start and end dates for the BETWEEN() function. This will limit the range to events between 00:00:00.000 today and 00:00:00.000 tomorrow: WHERE (i.DateTime BETWEEN DATETRUNC('day', GETDATE()) AND DATETRUNC('day', ADDDAY(1, GETDATE()))) This query does what you need:SELECT TOP…

The query, as written, finds the last event (usually recovery), not the last Down event. You need this clause: WHERE i.EventType = (Select e.EventType from Orion.EventTypes e where e.Name = 'Node Down') This version specifically finds the last Node Down event: SELECT TOP 10 n.Caption,n.Status,aggSub1._max AS…

You can get a lot of the same detail with this SWQL: select --top 100 AlertID , AO.AlertConfigurations.LastEdit as [AlertLastEdit] , 0 as [ConditionIndex] , NULL as [Type] , EntityUri as [ObjectID] , AStatus.LastUpdate as [TimeStamp] , AO.AlertActive.AlertActiveID , NULL as [ResolveOn] , Context FROM Orion.AlertObjects AO…

It appears that there is not a corresponding SQL table. I queried Orion.LicenseSaturation in SWQL Studio using the WITH QUERYPLAN hint. When a query pulls data from SQL tables, the query plan will show an OptType of "ProviderPassThroughScanOp" query - that's the text of the SQL query that's sent to SQL Server. This is my…

@"WinterSoldier", use LEFT OUTER JOIN instead of just JOIN. That will force the query to return all rows, including those where NodeID is NULL.

Look in Orion.APM.CurrentStatistics, specifically the ComponentPercentCPU and ComponentPercentMemory columns. If you're working in SWQL, you can drill down from an Application as Application.Component.CurrentStatistics.ComponentPercentCPU and Application.Component.CurrentStatistics.ComponentPercentMemory.

You can do this report with the Dynamic Query Builder. Create a new report and add a Custom Table. For your data source, choose Nodes. Here's a sample query (I'm reporting on Nodes and limiting them by Caption): Now set up your table like this. As you add columns, you'll have to choose Component from the "Orion Object"…

It sounds like you want to account for two things: (1) absolute CPU utilization level, and (2) spikes in utilization. Here's what you need to do. First, set custom thresholds for the node using the "Node Thresholds" settings. You'll want to establish thresholds based on the normal sustained CPU load for this node. For…

That's good when the original recording was created with the deprecated version. However, I have recordings that were created with the new recorder. Those are the ones that need decoding.

There's still no built-in way to delete stale nodes. However, you can automate it a bit more by creating an alert based on a query similar to the one you linked to. Add a trigger action to either (1) call your delete script with the NodeID as a parameter, or (2) use the Solarwinds REST API to delete the node via an HTTPS…

Check the Solarwinds Job Engine service on your polling engine(s). Does it run as LocalSystem or does it run as a user account? If it runs as LocalSystem, try this: * Create a Windows user account (or a Windows domain account) * Make this account an Administrator on the server (or add the domain account to the local…