mcbridea

Ah! Now I understand. The prize for answering you own post is a leather mini skirt! ;)

You could also have the group status roll up set to Show Worst Status and alert off of the group.

If the PCAP does not show flows then there is a problem with the exporter or something is eating them. The lack of a firewall indicates it is probably the exporter. There is an issue in some IOS where it appears that the exporter is working but it does not export until the device is rebooted. This may start flows and it…

Looks like we were typing and posting at the same time. You are correct, tables are now allowed because they, by definition, have like data types and scales.

That behaviour is typically due to view restrictions. Is there another admin account you can use to see the settings on your account?

Good catch Corey - my info was for the CAT 4500 set up.

Yes - Sedmo's logic is correct and more stright forward.

Good to hear it's up and running!

can you give me a config snippet I can test? I'll make up the Ip Addresses

Please open a ticket so we can further investigate.

We don't really make that granular of a recommendation but why dont we see what the thwack community recommends/uses?

Create an IP address group in NetFlow Settings then use Traffic view builder to build a view of that subnet.

Take a look at the Upgrade Instructions in the Customer Portal.

South, Did you loose custom HTML or all customization?

I see. I'm not sure of that feature in NCM but I'll mark it for the PM to comment.

Everything you can do in basic exists in advanced and you have the option of using either. I always yuse advanced too, just sounds more debonair. ;)

I will have to let PM answer for the overall plan but be aware that we cannot promise features here.

We are aware of this issue and are actively working it. No update to share as of now.

Hang in there a little longer - SP2 will be coming down the pipe soon and it deals w/ performance.

Please open a support ticket and we will help you through this.

They are probably allowing UDP 161 for SNMP now and just need to add UDP 2055 for NetFlow.

You could modify the Total Bytes Transfered by Interface - This Month report and add a field for Interfaces -> Errors_Discards -> Recv Errors this Hour and another field for Xmit. Then change the report time frame to Past Hour so you have apples to apples. Otherwise you can create it from scratch as an Advances SQL Report.

I'm not surprised that ping does not see the losses. IP SLA is sending packets at 20ms intervals so it is much more granular. I'm wondering if there is a problem on the circuit. Is this VoIP over MPLS? If so, have you specified the proper VRF in IP SLAM? can you get the circuit tested? The thing that surprises me is how…

I'm not sure what is going on here but suupport will be able to help. Please open a ticket with them.

Can you send me a PCAP of the flow export?

Sure. Go to Settings -> Manage groups, select the group that you want to add members to and click add and remove objects. On the Show Only: pulldown select Applications. Then add the apps you want into the group.

I changed the alert delay from 2 hour to 1 min (for testing) and it worked as written.

That is easily accomplished in Advanced Alert Manager. Here is an example for a node CPU alert. Also see this paper on Advanced alerts. http://www.solarwinds.com/support/Orion/docs/UnderstandingOrionAdvancedAlerts.pdf

Hi Jason, I haven't done anymore playing with this feature but it's still on my radar. Andy

The email not going out and the restart not happening make it look more like the alert didn't fire. Can you post the trigger and suppression? Andy