marcrobinson · Observability Detective · ✭✭✭✭✭

Adam, I like you explanations, as I omitted this from my answers. I agree that the Top1 is ugly, but can work. I was thinking about your isnull too. This might also work, instead of the case function. I tend to forget that hosts can be deployed without a vcenter so I didn't think about trapping that condition with…

${N=SWQL;M=SELECT E0.Host.DataCenter.VCenter.displayname FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0 WHERE E0.relatedhost = ${N=SwisEntity;M=Host.HostID}} Bad multiple things - edited the query above. And multitasking is bad.... Just say no to it. 

${N=SwisEntity;M=Host.HostID}${N=SWQL;M=SELECT E0.Host.DataCenter.VCenter.name FROM Cortex.Orion.Virtualization.TriggeredAlarmState E0 WHERE ${N=SwisEntity;M=Host.HostID}}

@"adam.beedell" Hey Adam - I hadn't looked at the cortex entities. That clued me in. I also agree that the vm triggered alert condition is a new entity also. I was able to get the following to work, I added both the name and displayname. The name returned only the IP address for me also. The displayname gave the actual…

 Yeah that should work. I did a quick test using a mock up with that alert type and scope. No goodnik. I tried a couple of variations - also no good. This is a weird one. Already bumped the feature request. 

Are on the SolarWinds (Orion) platform with module licensing (NCM, NPM, etc) or are in the new world of HCO/Hybrid Cloud licensing. Depending on the tier, you get NPM, UDT, etc. This is one of the few times I will recommend looking at the new licensing variations now. 

Also check the maintenance log. swdebugmaintenance.log It should be in C:\ProgramData\SolarWinds\Logs\Orion\ typically. You want the most recent one. Number 6 above is the one I would investigate, as this one relates to db performance. The daily maintenance routines also will affect performance. Your high cpu may or may…

Going to assume that the scope is set to transaction. Take a look at the following. last error message: ${N=SwisEntity;M=LastErrorMessage}

I wonder if an NCM policy would work in this case. Hmm a group might be needed to run the second job on affected systems. Something like policy audit of x runs job x. Now that x is compliant, policy B notices, and runs job on group B. 

Definitely agree with @"bobmarley". The alert entity (node, application, component, etc) will change the swql variable formatting in the alert email action. The only thing I would add is that after creating the alert, switching the view to action manager will allow you to edit, and re-edit the actions assigned to a given…

Tabs and rotating tabs for NOC views? Otherwise, one could load the modern dashboards into in iframe inside the custom html widget. It would be an ugly experience, but that should work. 

unfortunately, the packet loss that I have been getting from Microsoft endpoints limits the utility of the data. You can resolve all the paths and public IPs of a public service endpoint. Everything up to that point is pretty solid. So it is still helpful, but you don't get the "hey there is latency at Microsoft Service…

@"adam.beedell" A positive experience with azure? Ok, it is not all bad, but Microsoft has not standardized security across the azure/o365 space - and that is a big part of the headache. Using the built in API monitoring templates, there are some limitations, that come to mind as it wants numeric data or formulaic words…

Generally, it has been chased down to whitelisting email from external senders (your front end mail filtering) and client side email filtering rules. There have been a couple rare instances with Pingdom email, but you can check here Pingdom Service Status for status on their internal services. As far as tracking email…

I like your modern dashboard. I have played with it for a NOC, but wish I could have tabs with it. I use a the classic for a NOC to rotate through several screens. One thing I have started to play with are timely charts/tables - if X happened within last Y hours, display what X is. Other than that - maps can be useful to…

When you go into settings, then account management and edit a user or group, It would be the Default Summary View. Changing that view changes where users go when they click on the logo in the top left. The "Home Page View" sets the view they see after they login. 

I agree with @"bobmarley". Your polling rate should be above 75% typically. I tend to use the main polling engine just for discovery and to park nodes for later migration also. The main poller is responsible for a lot of the solarwinds platform duties - ie alerts etc. Keeping it happy is honestly a good thing. If you have…

Yes - you edit that copy. I kind of follow what you are saying as this is the next step: You can assign as the default view for that type of device. When editing this copied (and renamed) dashboard, select Add Widgets and search for 'universal' and check the following ones. These should be some of the more useful: *…

@"fop" Please add the link to this feature request, so we can all bump it up. Calling the bumpsquad! As to your pain with Microsoft and Azure - umm you are not alone. I get very similar reactions when I talk to the Azure Architects. This is often mentioned with a comment to wait two weeks, Microsoft will update Azure to…

RabbitMQ is still part of the SolarWinds/Orion platform. I would not disable it. I have not run into your issue either. Do you have a method to whitelist it in Trigeo? SolarWinds Platform 2023.2 System Requirements - look for traffic on port 5671. 

Copy the default node view. Rename it something like Vertiv Details. You will need to add widgets based on the undp data. You can take the swql and create widgets like the radial dials or charts based on things like time on battery too. The swql that you use for the reports can be modified for the alerts. Universal Device…

2023.2 includes fixes for the retention, and I believe a few other fixes for the maintenance. 2023.1.1 also included some fixes. As far as monitoring, I have heard of people monitoring this log with a SAM component. Lemme see if I can find a quick pointer. EDIT: I recall this being done with powershell in a template. But…

separate syslog db is one of the recommendations, if for no other reason than this. 

Agreed. Also check latency/port exhaustion to your SQL server. There are some windows events to look for, in particular Event ID 4001 from SWService. The message will be something like the system is unable to open a connection to the sql server. Since those are logged in windows events, you can search after the fact for…

Your post just made my day! Thank you for posting this and suggesting DPA as an eval to get to the root of the issue. This is definitely an issue for those of us with large environments or limited compute power. 

Hmm, this might explain somethings.. Good call. 

gotcha. then ignore my thoughts about changing scope. 

Looking at similar that I have - I used component status = down/up for trigger and reset and specified the component name or id in the scope. This does change it from and application to a component alert though. 

Lets start by changing the evaluation to 5 minutes, and setting the trigger condition must exist for more than – to 45 minutes in your test system. You can play with that persistence trigger to force the alert to make it is doing something too. Otherwise, you can reverse the logic - if a file shows up - alert. I am…

Check the latency to the sql server. Also check to see db maintenance is running. Maybe have a dba check to see if additional indexes should be created too. (IT shouldn't but your mileage may vary as much as mine has on this last option.) What modules do you have? If you have NPM or HCO, then you can use netpath to dig…