marcrobinson · Observability Detective · ✭✭✭✭✭

Dont do away with Syslog. Yes Log Analyzer (another syslog server) is part of HCO. But I would consider setting up specific SNMP monitoring over Traps any day, every day, always.... Traps are a bit chatty. This does depend on your devices/needs too. But Universal Device Pollers are amazing at eliminating the joy of traps…

Ditto to what @"Seashore" said. You start an evaluation of SWO to create the token required to link your HCO to SolarWinds for the Anomaly Alerting. The anomaly alerts will be getting more improvements/capabilities over time too. What it does is send specific metrics up to SolarWinds that are used for these new alerts. The…

A BIG YES on using custom properties for interfaces. I would consider not using groups, but that is just me. I have setup special interface alerts using a simple yes/no custom property and the alert scope just looks for yes on that property. It is simple and works well. 

To follow up with @"jm_sysadmin" - Try WBEM TEST: Introduction to WBEMTEST - Configuration Manager | Microsoft Learn It can validate WMI from your polling server and give error messages to help isolate what is wonky and where. It should be on your systems by default - and you can run it on the affected system and remotely…

Ok. I see. I was thinking of another app-id thing. How to Configure a Custom App-ID - Knowledge Base - Palo Alto Networks Utilizing App-ID Override on the Palo Alto Firewall - NetCraftsmen, a BlueAlly Company Manage Custom or Unknown Applications (paloaltonetworks.com) I will poke around and see I can get someone more…

Are you trying to monitor the PA via API? Network Insight for Palo Alto - monitor Palo Alto firewalls with NPM (solarwinds.com) Unless I am mistaken, you are referring to Port 17774 for API usage, and this port is used for the SolarWinds api itself - to connect to your SolarWinds instance for API calls. This port is not…

I have to agree with the comments here. Netpath is underused in this space. It does a great job of describing visually what is happening with a link. Netflow is also useful - confirms your data usage and where it is going. Also - Have to agree with monitoring traffic - should never be zero traffic. SAM has a variety of…

Agreed with Adam. I think I can say 100% no for the first question. I am reading it differently. It will not remove the application when you rediscover, it just will not add new applications as that option was unchecked. On the second question - the ignore/dont add option becomes very useful. Otherwise, you will most…

On to the questions: * "Using agent would give us more accurate data"* Not necessarily. It is basically the same data. The agents do things a little differently, but the agents are still querying WMI at some point. The other comments also discuss this. * When I asked if the intent would ultimately be to swap all Windows…

Vinay has given a solid answer. I would take his thoughts and add a couple more. HCO is different not because it is a license change to a subscription, but it does, as was pointed out, bring a suite of modules/features along with HA licensing. If you are not ready/planning to utilize all the new features, then HCO becomes…

First - you are talking about NCM? If so, are the failures randomly occurring or is it mostly the same ones? I would look at the NCM job session logs. It creates a log of files, but the detail is excellent for troubleshooting. If it is usually the same ones, or one that is always failing - try a manual backup and see if it…

@"vinay.by" That is a one the best explanations I have seen for this. The only thing I would add is that the words, not the math can be confusing. We tend to think that Total is the sum, not Overall Average or just as simply - average from both transmist and receive as it is in this case.

This thread explains a few things... I have viewed these as limitations on swql. Instead I use joins that simply work, even if it is ugly. Subqueries and the inherently linked properties have been hit or miss - particularly on where you use them in your swql statements. I will start tracking them when I run into them now…

"What he said" 

Welcome to the cloud! I am not familiar with AWS monitoring, but azure monitoring gets into similar limitations. The bigger part of this is ensuring that your cloud credentials have access/rights to view what you want, and that the data is available via API. Now you get to create your own api pollers. I just checked the…

There are a number of issues - the agents would need to be reconfigured to point at the new instance of solarwinds. The older version of the agents can present a problem - you want to match the version on the solarwinds instance. While this could be done, depending on the numbers of agents and your ability to manipulate…

"but then all have issues with the vmware adapter being unknown as well" That is a loaded sentence. My first thought has to do with upgrading the vmware hardware and tools on the targetted nodes. Have you listed resources and noticed new vmware network adapters? That would at least explain that problem. I noted your…

But going with your current filter, you could modify it to match partial name or IP for a longer list. I still recommend custom properties though. 

If this is something that you plan to do again, I strongly recommend custom properties. You can create a simple yes/no property and call that property in your where clause where it is set to true. That allows you to set and remove that value to multiple nodes without having to touch the alert or make an alert that does not…

Also, NTA is underrated as a tool. Combine NTA with Netpath (part of NPM) and you have some very useful and quick to deploy tools. The QOE agent is one of the few agent tools that is also very useful. It is essentially wireshark-lite that you install on a node and can target specific application traffic. NetPath…

Hmm just saw this. Good recommendations on discovery and it refers to NPM. Discover your network with NPM (solarwinds.com) Add discovered devices to NPM (solarwinds.com) This is a nice NPM chart on monitoring: What should I monitor on my network? (solarwinds.com) I looked over NPM, as it used to focus on snmp devices and…

I agree with your assessment of the agents on windows. Unfortunately, provisioning wmi permissions creates its own headaches too. Usually that is a one and done for each version, but still - why did Microsoft even think that Admin rights were a good idea for their core management instrumentation?

DItto. You can run them with different windows server OS. But things get weird with windows patches and .net behaving slightly differently between the server OS versions.

You have it correctly - assuming that you have NPM and SAM or HCO. Agent/WMI is the preferred method for windows - just pick one. For Linux based servers, you can use snmp or agents (see link below). F5 load balancers do have special monitoring tools in solarwinds. See those links below for usage and applicability. The…

Please ask for an escalation and emphasize that your system is down. You can also reach out to your customer success rep/account manager and ask the same of them, but they may need your ticket number. If I understand you correctly, you are trying to migrate your existing windows 2016 servers to new windows 2022 based…

Here are two links to help you get started. The first is a good description of status and how to understand it. There are several more links in this document too. The high level node chart on this page is helpful to get the overall idea of node status codes. The second link provides good troubleshooting for nodes and how…

FYI - this is not something I do every day. I did look over some notes, and the netobject is apparently used with older verbs. The URI is related to newer verbs. 

I suspect the call completing is related to successful login. Going to poke at this, but the detailsUrl for the node has slightly different formatting - /Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:xxxxxxx where xxxxxxx is your nodeid. But, try NetObject=N:8042 and see if that works. If it does…

I dont believe that things have changed since that thread came out.

There is no direct connection that I have seen either. You can also create a dataflow to your solarwinds sql db and point PBI at that. It comes down to what you want and what you are most comfortable with.