marcrobinson · Observability Detective · ✭✭✭✭✭

@mesverrum I dont know why I never thought of it before, but I have been beating my head against the wall on a swql, not a sql query (Which works) to get the devicetemplate for NCM nodes. Device Templates are not in the NCM nor Cirrus entities. I didnt look at the CLI entity until seeing your post. Thank you! I am loving…

The information on the net name can be found in the Key-value pairing in the below swql entities. There ought to be a better method to do this, but this is where I have found that information. The query should generate a list of the services and their net names. The joins bring the two entities that have information on the…

A big part of the issue with WMI has to do with how security was setup in wmi and windows. You can script/gpo a response to permit non-admin accounts to grab data. But you will need to account for variations in operating systems. 2008 and 2016 will require subtle tweaks for example. If you want event logs, that is another…

Is there a thread in NPM for this? I would like to follow this discussion.

I was looking forward to the IPAM 4.6 upgrade until I read this. It sounds a bit like the growing pains from the NPM 11/11.5 upgrades. As much as I was planning an NPM 12.2 multi-module/multi-poller upgrade, I think it may be wiser to wait until this gets resolved. ding​ - can you follow up on this mega-thread if a new…

Here is a swql version. But it looks like it triggers on any difference, up or down that meets the threshold. I am still sorting that bit out. SELECT v.FullName, v.VolumeID, AVG(vh.PercentDiskUsed) as DISK_Used FROM Orion.Volumes v JOIN Orion.VolumeUsageHistory vh on v.VolumeID = vh.VolumeID WHERE vh.datetime> ADDHOUR(-2,…

I am on 12.1 HF1, Orion 2017 HF3, and this suggestion worked on a poller also. Disabled the cleaner, copied the files (from the backup repo in my case), and ran config wizard. I was using the scalability installer to actually install everything on a new poller. Thanks for posting this solution!

We had a problem with it returning the same profile name every time. This custom variable has been working for us, but it is not elegant. I am using NPM 12. I call the top 1 job (single job) and use a where clause to reorder and filter by successful jobs and timestamp in descending order. ${N=SWQL;M=SELECT Top 1…

This appears like it might work. It should only alert when the controller is online and the ap is offline. I briefly tested it and it looks ok. I make no guarantees.

I know this is a bit late, but were you ever able to test this alert logic?Specifically if the controller went down, would the thin AP's still alert?

Looks like removing the view limitations and resetting them is the answer for now. Thanks for looking into this.

Make sure you add the variable for the alert notes into the email. ${N=Alerting;M=Notes}

Hey adam.hert​ Thank you for the reply. Any chance you can look into unlocking feature requests for Loggly too? There does not seem be a permitted location for Loggly Feature Requests. Thanks Marc

Its the older style charts that have five or so metrics with the line charts. I don't believe these have been migrated to perstack format yet. (Image from the orion demo site.)

Ditto to removing the mount points. If you want to spend more time, you could use a node custom property - "Allow_MountPount_Alerts" with yes/no option, and have a mountpoint only alert exclude nodes with it set to no. Volume custom properties can also be used,but they apply to each volume individually. 

Agreed - there is no easy way. You can setup a policy/agreement with other teams/customers where you turn off mute and/or remanage everything over 90 days. My use of 90 days as a limit is arbitrary. Contact the support team about anything over XX days in maintenance mode. Create a list (ugh) of exceptions if you need to.…

I havent run into this with 4.6, but I believe another hotfix is coming.

I have a related question - I want to create audit alerts for the same purpose. Who created what transaction, who put what transactions where, etc. I don't see these event listed in the audit alerts for trigger condition - action type. Are these things captured as audit events? Thanks Marc

I am using SAM 6.6.0 and it does not want to parse the XML. The browser delivers the three line xml information just fine. But SAM wont parse the text properly. Weird. I will keep digging in case I missed something. Side note - WPM really really ought to handle XML too.

mesverrum​ - more on your point 3 - you can share that map with your NOC and that will make those connections obvious (for lots of teams). So when something goes red, its not just noise.

Thank you for the information. I had a similar issue with an iframe in a custom html (external) web resource. It would display on another summary tab, but if I combined it with pre-existing reports, the iframe would load, but nothing else. I added the iframe closing tag, and it works in the NOC, also on a separate tab,…

Serena, As mentioned in my post above, I ran into this issue installing a new poller in an NPM 12.1 environment. I just completed another new poller installation to same 12.1 environment. THe difference was this time, I stopped the config wizard after the scalability installer ran, then applied all the necesary hotfixes…

I have not heard back on my request about viewing or editing that list. But they will run that report for you and increase your limit if you open a ticket with support.

I would have expected to see Performance Analyzer in that list too. What version is this instance running?

Has anyone thought about how to do this beyond just a few certs/websites? Binding all the ports just to make the ssl monitor work is something of a hard sell. I have seen some script monitors and that might be the only way, other than not using SAM.

Good question. If the WLC is down, then you can potentially suppress the ap’s from alerting. Otherwise, I don’t think I have seen a good answer. Please Please please tell me if I am wrong. Having the suppression grab the correct wlc in the alert seems to be a mystery too. -Marc

I noticed that this alert scope allows you to select a WLC by controller name in the properties. This seems to indicate that It wants a one to one relationship between the waps and the wlc. I hope not, as it would involve creating an alert for each wlc and its related wap's. In the advanced section for my alert above, I…

I dont know if the workaround above will help you, but removing view limitations from both the original and any copies allowed us to set each view individually with the correct view limitations. Please post any updates if you can. Thanks Marc

Biggest challenge - History's Mysteries. Who did what and why... WHY. WHY!!!!!!

Old method - create a custom property for volumes- "Mute_Volume" with a yes/no value. (Assuming yes means mute, and is not default value.) In manage nodes - expand the volumes for this server, then select the D volume, and click edit. Change the custom property value to yes. Now update the logic in the disk alert scope to…