marcrobinson · Observability Detective · ✭✭✭✭✭

unfortunately, the packet loss that I have been getting from Microsoft endpoints limits the utility of the data. You can resolve all the paths and public IPs of a public service endpoint. Everything up to that point is pretty solid. So it is still helpful, but you don't get the "hey there is latency at Microsoft Service…

@"adam.beedell" A positive experience with azure? Ok, it is not all bad, but Microsoft has not standardized security across the azure/o365 space - and that is a big part of the headache. Using the built in API monitoring templates, there are some limitations, that come to mind as it wants numeric data or formulaic words…

Generally, it has been chased down to whitelisting email from external senders (your front end mail filtering) and client side email filtering rules. There have been a couple rare instances with Pingdom email, but you can check here Pingdom Service Status for status on their internal services. As far as tracking email…

I like your modern dashboard. I have played with it for a NOC, but wish I could have tabs with it. I use a the classic for a NOC to rotate through several screens. One thing I have started to play with are timely charts/tables - if X happened within last Y hours, display what X is. Other than that - maps can be useful to…

When you go into settings, then account management and edit a user or group, It would be the Default Summary View. Changing that view changes where users go when they click on the logo in the top left. The "Home Page View" sets the view they see after they login. 

I agree with @"bobmarley". Your polling rate should be above 75% typically. I tend to use the main polling engine just for discovery and to park nodes for later migration also. The main poller is responsible for a lot of the solarwinds platform duties - ie alerts etc. Keeping it happy is honestly a good thing. If you have…

Yes - you edit that copy. I kind of follow what you are saying as this is the next step: You can assign as the default view for that type of device. When editing this copied (and renamed) dashboard, select Add Widgets and search for 'universal' and check the following ones. These should be some of the more useful: *…

@"fop" Please add the link to this feature request, so we can all bump it up. Calling the bumpsquad! As to your pain with Microsoft and Azure - umm you are not alone. I get very similar reactions when I talk to the Azure Architects. This is often mentioned with a comment to wait two weeks, Microsoft will update Azure to…

RabbitMQ is still part of the SolarWinds/Orion platform. I would not disable it. I have not run into your issue either. Do you have a method to whitelist it in Trigeo? SolarWinds Platform 2023.2 System Requirements - look for traffic on port 5671. 

Copy the default node view. Rename it something like Vertiv Details. You will need to add widgets based on the undp data. You can take the swql and create widgets like the radial dials or charts based on things like time on battery too. The swql that you use for the reports can be modified for the alerts. Universal Device…

2023.2 includes fixes for the retention, and I believe a few other fixes for the maintenance. 2023.1.1 also included some fixes. As far as monitoring, I have heard of people monitoring this log with a SAM component. Lemme see if I can find a quick pointer. EDIT: I recall this being done with powershell in a template. But…

separate syslog db is one of the recommendations, if for no other reason than this. 

Agreed. Also check latency/port exhaustion to your SQL server. There are some windows events to look for, in particular Event ID 4001 from SWService. The message will be something like the system is unable to open a connection to the sql server. Since those are logged in windows events, you can search after the fact for…

Your post just made my day! Thank you for posting this and suggesting DPA as an eval to get to the root of the issue. This is definitely an issue for those of us with large environments or limited compute power. 

Hmm, this might explain somethings.. Good call. 

gotcha. then ignore my thoughts about changing scope. 

Looking at similar that I have - I used component status = down/up for trigger and reset and specified the component name or id in the scope. This does change it from and application to a component alert though. 

Lets start by changing the evaluation to 5 minutes, and setting the trigger condition must exist for more than – to 45 minutes in your test system. You can play with that persistence trigger to force the alert to make it is doing something too. Otherwise, you can reverse the logic - if a file shows up - alert. I am…

Check the latency to the sql server. Also check to see db maintenance is running. Maybe have a dba check to see if additional indexes should be created too. (IT shouldn't but your mileage may vary as much as mine has on this last option.) What modules do you have? If you have NPM or HCO, then you can use netpath to dig…

Hmm Could this affect how items are searched and reported upon in SWQL/web interface. I am noticing some odd results with underscores and hyphens/dashes in results against orion 2023.1. It looks like the two characters are treated as the same by swql now. 

I have seen this done with multiple nics. Hateful, but it worked. A real network engineer may provide insight into using acls and routing that system to where it needs to go. Note: I am not a network engineer. So I will not try to answer this one. 

Good description, the actual logic may help if you can post it. Second - you have a fun one. Ok, fun is not quite accurate. You may be able to solve this with alert trigger and reset persistence settings and changing the alert frequency. Create a copy of the alert and have it email just you for testing. Based on the…

Excellent Dashboard. @"Slamdance" beyond setting up that dashboard, some of those metrics are available in the admin section. Go to All Settings, then scroll down to the Polling Engine for quick stats on polling levels, and then the My Deployment (also seen under Settings) and go to Deployment Health. You will want to look…

Click on the Store link after the Free Tools and Trials. You can get SOCKS! And other bits of goodness, such as exam vouchers if you get enough points. 

Start with the usual things - is that one poller running significantly more components? Are there large numbers of components/templates/nodes with higher than normal polling rates on that single poller? 4 cpu? It might need more cpu, sounds like you are on the verge of 8 cpu. 

I just poked around google on that json sql error and this is one for SolarWinds support. Mostly because it looks like you are getting an error on some configuration json sent to the orion db. Not sure if I would want to troubleshoot that on a whim. Good luck and please post, it sounds like this might the first big bug…

Awesome, and you hit the issue on the head. How to do that with the api poller is the next question as you stated. I am able to test it with token also, but the token expires hourly - so another challenge there. 

The Orion.Cman.Container entity has provided me with most of stuff I need for reporting. The Orion.Cman group of entities is probably where you found the data? 

I am glad that you sorted this out. When you talk about the fields not populating on the dummy node - I assume that is the external node? The data will show up in the api poller. There 'should' be a widget on your default node details that will display the data. If not, I would check the default nodes page and look for the…

There were some bugs in 2022.4.x. I would consider waiting for 2023.2, as .2 should be going from RC to GA within the next couple of weeks. It includes fixes for 2023.1 and 2023.1.1. I am planning to upgrade from 2023.1 to 2023.2 and skip 2023.1.1 at this point. There is a fix I need in 23.2 for a bug in both 23.1…