marcrobinson · Observability Detective · ✭✭✭✭✭

Ok, this got me thinking. I worked out the ip, but never bothered scripting the port. I will drop some swql with the variables formatted for a component alert. --Returns the component url that is tested ${N=SWQL;M=SELECT cts.Value FROM Orion.APM.ComponentTemplateSetting cts JOIN Orion.APM.Component ac ON…

In the "I want to alert on" question set to Node or Component? If it is set to Node, then Node type of objects will occupy that drop down list, as shown in your screen shot. If you set it to component in the "I want to alert on" section, the list above will show component fields. 

@"adam.beedell" What version of swql studio are running? THis works in 3.1.0.343

I am not sure if you need swql to do this. This custom variable will return the node ip: ${N=SwisEntity;M=Application.Node.IP_Address}

Your description points me to the network configuration. While netpath is great, it may be helpful to run a simple traceroute to see if it matches what you think should be happening. For your DNS issue - you will need to dig deeper or provide more detail. Does that external IP have a dns entry? IS that external interface…

In Network Discovery there is an "ignore list" and you can add those Huawei switches to it. Hopefully that gets you past this issue. Having the next rediscovery date stuck is generally not a good sign for polling and system rediscovery (not the network discovery). You may want to dive deeper into that particular issue too. 

Orion 2020.2.6. HF 4 still has this display limit. Looks like it is a cap on 4 flow charts in any given perfstack. I am open to suggestions if this is really a limit, or a bug in my environment. 

Just to add to this - been there, done that. Had to create a custom web interface to the sql back end. Then had to spend time care and feeding of the sql back end. Dropped kiwi + sql entirely for something that could handle the data. If you really need the power of a sql back for syslogs, please reconsider and look at…

I just wanted to bump the comment up about voice routers. LOTS and LOTS of interfaces. Oooh - One more thought, I am starting to think that hitting the back button may not necessarily cancel an ongoing scan, but it would refresh the page and detect the recent list resources job. Whether or not that last list resources job…

I think I know what is happening. If you scan a node recently (list resources), then list resource again. The notice that you are viewing a cached version of resources with the timestamp of that scan will show up. Next to it, you see the Force Refesh button. I am not sure, but I think it will do this for up to a day now. I…

The scope/ request URL has most likely change from something like https://manage.office.com/api/v1.0/blablablah to something like https://graph.microsoft.com/blablablahGraph documentation feels a lot like a trail of breadcrumbs. Anyone familiar enough with Graph to comment further? IF you are using the new API poller this…

I suspect that the Request URL might have changed, if it was not permissions. But - I have noticed that things change unpredictably in Azure. 

I threw in several of the diff functions. SELECT ONO.Caption, ToLocal (OAS.SuppressFrom) as SuppressStart, ToLocal (OAS.SuppressUntil) as SuppressEnd, DayDiff(OAS.SuppressFrom,GetDate()) AS Muted_DayCount, WeekDiff(OAS.SuppressFrom,GetDate()) AS Muted_WeekCount, MonthDiff(OAS.SuppressFrom,GetDate()) AS Muted_MonthCount,…

Try this, it lists start of suppression, end date (if scheduled) and day count. It also converts to local time. SELECT ONO.Caption, ToLocal (OAS.SuppressFrom) as SuppressStart, ToLocal (OAS.SuppressUntil) as SuppressEnd, DayDiff(OAS.SuppressFrom,GetDate()) AS Muted_DayCount FROM Orion.AlertSuppression OAS JOIN Orion.Nodes…

Interesting dilemma. I have a similar loadout but have not seen that issue. I do not split nodes for a remote site among different pollers by habit though. If I need to offline a poller, then I will split those nodes up. Unless you have HA for pollers, that is about the best you can do. Based on the examples below, It…

Old thread. Here is a swql variable that will get it. THis works with component alerts. You would need to update the component id variable if using an application alert. THis should work from orion 2019 forward and probably older versions of SAM. SELECT cts.Value FROM Orion.APM.Component ac JOIN ORION.Apm.Application ap ON…

This was the answer 8 years, the site has updated since then. Here are some updated links and ones that cover the current alert formats/variables. Adding alert specific variables into email generated by an alert in Orion Platform General alert variables Variables in the Orion Platform Use properties and macros in alerts…

Consider using NCM session trace - just know that you can create a lot of files with it. The session traces will have lots of extra details to look at. Enable session tracing when troubleshooting a connection issue (solarwinds.com) , Generate session trace logs for NCM and NPM modules (solarwinds.com) and NCM How to Read a…

SQL or SWQL? While similar they wont work in each others spaces. Where did you paste this code?

Application component polling allows you to choose at the component level. Unfortunately, I have not found a direct answer for just node polling. @"Seashore" I tend to agree that it might be negotiate, which used kerberos for domain accounts and ntlm for local accounts. But this is still a guess. I will post here what I…

Good luck and I hope this continues to work for you. I am sorry about the tech support rep going MIA. You have probably heard this elsewhere - but you can call back into support and give the ticket number to get a another rep. I have done this on occasion - the original rep was unavailable and the issue was urgent. 

I have not noticed that. Open a ticket with support? also try another polling engine if you have one. You can look at the log files on that web server/primary polling engine, start with the apollo web logs. 

Another ditto here. Custom properties in the alert scope are just awesome. You can do some interesting grouping too. If the alerts are based entirely on a custom property value, not just filtering production tiers, then you can split apart nodes on a single property. I use some of the yes/no properties to scope alerts, and…

Sounds interesting. I do most everything in swql (reports and alerts) now, but nothing complex like some of the reports i see here. API programming with powershell and python - total noob. Trying to crack those nuts and look at them as modularized scripts. API auth, then Call #1 etc. The idea is reusable bits that those of…

Looks like this might be related to the log on locally requirement. 

Bump please. 

Short Answer - Yes you can do this with PRE-defined text. Look at the predefined Microsoft 365 Admin Center API template is one good example. Longer answer - the text that you convert must be pre-defined, so the conversion does a quick text match and the number can be substituted. See image below from the template. You…

Yes, you can report on the string value. I have had to create reports to do it. I was using swql. You will need the value-to-monitor ID. This SWQL query can produce that and gives you the names of stuff to help isolate what you want, and then some. SELECT vtm.ID, vtm.RequestDetailsId, ap.Name as APIPoller, vtm.DisplayName,…

So far so good. I tried joins and linked entities and both worked with intellisense again. Thank you! Thank you! THank you!

I am hoping that one of more experienced vnqm users jump in. But - first thoughts - you may need to create those sla operations on the routers then monitor them. VNQM can create the operations given the credentials to do so. Its fairly simple, but I will note that NCM is the you may need when you want to remove those…