mesverrum · Observability Architect · ✭✭✭✭✭

No, you cannot stack licenses inside a single instance.

Agent is supposed to be lower overhead than both WMI and SNMP, and SNMP is lower overhead than WMI. The agent initiates all of it's data collection locally based on it's own timer instead of your poller having to do the work of establishing a connection (Only for WMI, SNMP is using UDP), then requesting metrics, the node…

Normally nothing in SW is checking for those kinds of things, but as a catch all you can usually write a powershell script to identify anything you want and have SAM run that powershell and store the results.

The factor that controls how you have to do these is based on the specific versions of Orion/Windows/SQL you have installed and how high you can upgrade them before a hard limitation forces you to either upgrade or migrate. In your case, NPM 12.1 can be installed on server 2016, but as far as I can see in the documentation…

First, did you uninstall the Openmanage/insight/whatever software from the servers after you p2v them? If that software is still running it likely has the stale data in it. Assuming that the software is not running but SAM still shows stale data the way I might try to clean it up would be to list resources on the server…

I would not recommend beating yourself up too much trying to fix whatever it's telling you about on that page, because I find a lot of them are red herrings or non issues

That field has generated a good amount of trouble in the past, basically it is a derived value and doesn't exist as a column in the database anywhere that you can reference directly. Since the dynamic group rules are somewhat limited I don't think you would be able reproduce it using those. -Marc Netterfield Loop1 Systems:…

From what I can see you probably need to edit your template so it knows that C:\Documents and Settings\tetra> is a prompt. They explain it in more detail deep in the admin guide, but these links discuss the virtualprompt option Adjust, modify or change a device template used for NCM when the prompt is just a > or # -…

You are correct, there's no native capability to correlate neighbors to group objects. Best that I can think of would require some kind of script that periodically updates the group membership based on the neighbor table.

The best way to monitor against processes that are still up but are not actually doing the thing they are supposed to is to come up with some way to test that resulting action directly. So if the process was w3wpe.exe i would have to set up an http monitor against the address it is supposed to be serving up. If the process…

That all looks fine, and yes you would need a separate machine for Mobile Admin and in most cases you would want to make sure that machine is sitting in a DMZ since it is pretty common for people to want to hit Mobile Admin without having to connect their phone to a corporate VPN.

Correct, there is no command or scheme available through the GUI to remove nodes automatically. Remove-SwisObject coupled with a query to find which nodes you want to remove is the common way to automate this task. I expect you could probably just embed this all directly into the decom scripts you use in vra to destroy the…

This report breaks out all the alert action settings so you can find which alerts have those values in them, use it inside a custom query resource --Alert Configuration and Actions Report select ac.name as [Alert Name] ,'/Orion/Alerts/Default.aspx' as [_linkfor_Alert Name] ,case when ac.Enabled=1 then…

It can be done using the API, you would query ip addresses that show up in the vim.virtualmachines tables that aren't already in orion.nodes, then create a discovery against those IP's Discoveries are not the simplest part of the API, but the documentation about using them is here: Discovery · solarwinds/OrionSDK Wiki ·…

I've heard in the past of people who said they had to just delete AD groups from orion and re-add them to get them working again, but never run into it myself.

You can't enter a subnet into IPAM without it having a range, so I'm not 100% sure what you are looking for. So far I haven't found anything you can't do in IPAM via the API as far as creating any kind of object, or setting any properties on those objects. Figuring out the syntax can be a bit of a process but you should…

I have two thwackpacks, I use mine to travel with it fully loaded on planes 4-8 flights every month for the last 4 years, my wife uses my "spare" bag very often as well. Neither of ours have had any issues, although mine is finally starting to get a bit worn across the bottom.

SQL doesn't have a data format for subnets, so solarwinds is storing them as a string and you are trying to greater than against a string, which tends to be a complete mess. I expect the way I would get this to work would be a fully custom SQL alert condition that breaks the last octet off with a substring, converts it to…

Add a custom query widget to your node details page and paste this into it, should do what you are asking SELECT Caption as [Interface] , Detailsurl as [_linkfor_Interface] ,'/NetPerfMon/images/Interfaces/' + Icon as [_iconfor_Interface] , tostring(InPercentUtil) + '%' as [RX Util] ,case when…

Read only is fine, but in cisco land running a restricted credential tends to only show you the parts of the configs that you are allowed to edit, so there is some cisco specific manipulations you have to do to make a read only account that can actually show a complete config See this thread on their forum for discussion…

In the compliance reports the policy is where you define the logic for which nodes are subject to each rule. You can key into your custom properties to say only devices at site X should have line Y on them, while site A should have line B

To your first question I can answer that ncm doesn't support capture groups from regex unfortunately. Not sure on your second point about the automatic remediation. Might need to throw that to support and if they say that's WAI then you will probably want to open a feature request regarding changing that behavior.

The alert engine doesnn't do IF logic. Like d09h​ mentioned, the most scalable way to do this is to set up a single alert, but create a node custom property (I'll call it ContactEmail for this example) that includes the appropriate email contacts for each node. Something like nodes at site1 would have their ContactEmail as…

I don't believe IPAM keeps historical tables with dhcp usage, only the current value.

Are you using the 2960c for layer 3 stuff or just layer 2? netflow is (usually) a layer 3 protocol so I could see that as a potential hiccup.

Most likely there is an issue with the netflow timout settings on your router. For Cisco gear there are typically two values to keep an eye on, the active timeout and the inactive. inactive is measured in seconds, active is in minutes, but in either case you want them sending data at least once a minute to keep the flow…

Actually you can do this with the custom table resource, on the columns you want it to count instead of listing individual objects you just go to where it says data aggregation and choose "count"

Just as a datapoint in this study, the vast majority of the clients I see with existing Orion installs have no rules configured at all for the syslog or trap viewer, or maybe they enabled the one built in NCM RTCD rule. They are working under the assumption that they can treat Orion as a SIEM and just firehose events to…

At a glance try removing your special characters from the name, otherwise the syntax looks about right. To make my scripts I have always just gone in and made one example of the logic I wanted by hand and then copied that filter into my script to modify as needed. The definitions are EXTREMELY fussy about having the exact…

This was one of the very first SWQL queries i taught myself because it was such an obvious gap. Add a custom query resource to your view, edit it and paste this code in. Then check the box for search and paste the same thing into that, but remove the comment marks from the last line. select vm.displayname AS vSphereName,…