mesverrum · Observability Architect · ✭✭✭✭✭

I don't remember if there is a built in event for "statistic value has changed", but if there isn't one you could an alert like that with custom SQL, something like (keep in mind that this is off the top of my head, the column and table names will be different) select componentid, currentStatistic, historicalstatistic from…

There is an older thread about how to add things to the discovery ignore lists that may be useful for you. I haven't used this technique in a while so I don't know if the sql may need updating but it worked pretty well in the past. Automatically ignore volume/interface types that are discovered via Network Sonar Discovery

From past experience with hacking up the Appinsight templates the reason they don't allow people to disable individual components is usually because under the covers they are all tangled up in a web of scripted queries and such that causes issues where disabling one component inadvertently cripples a hand full of other…

Just got this in my inbox from meraki "Hi Marc- We are excited to announce the latest addition to the our ecosystem: Meraki Insights. This is a powerful analytical and performance tool that leverages all the information coming through your MX devices. This will empower you and your teams to quickly identify issues, visibly…

I've been meaning to write a script to do this, just putting a note here so I can update this post when I get around to it, unless someone else beats me to it.

grantallenby​, That guide is for using the free netflow traffic analyzer but the actual NTA orion won't parse them. Last time I ran into this was about a year ago but, if I recall correctly, it looked like the issue was that NPM/NTA always tries to map the source interface field back to a network interface from Orion, but…

My understanding of Meraki devices is that you cannot actually pull CLI versions of the config up, they keep it all there in the cloud. If you want to audit changes you are supposed to review the log files via their web console or maybe you can grab them from the meraki api, but that thing has been a work in progress over…

Honestly it would be quite a massive undertaking to get that and have it be truly accurate. You'd basically be needing to join almost every table in the database back to the engines table and sum up the byte count for each row. There are hundreds of tables depending on which modules you have. Ultimately I am hard pressed…

SELECT a.Node.Caption,a.node.ObjectSubType,a.Node.StatusLED as nodestatus,a.StatusDescription as appstatus,a.node.Vendor,a.Name as aname,a.Components.Name as cnname,a.Components.StatusDescription as componentStatus,a.Components.ComponentID, a.Components.Disabled ,a.Node.CustomProperties.Environment FROM…

As far as documentation goes it looks like it still isn't mentioned, Windows Server 2012 and SQL Server 2012, 2014, 2016 and 2017 Support - SolarWinds Worldwide, LLC. Help and Support but I can confirm I installed 6.4 at a client office on SQL 2017 last month. I remember because we had a bunch of hassles stepping them up…

I would suggest you use the sql scripts available here to deal with this kind if thing.https://ola.hallengren.com/sql-server-index-and-statistics-maintenance.html It is doable to use Orion alerts to trigger a sqlcmd based script but it is probably not necessary if you have a reasonable maintenance plan in place. I find…

The UNDP tool doesn't allow you to get any more granular than the OID, you can manipulate things at the presentation layer by playing around with things in a custom table or custom query resource, but those will come with their own problems, such as showing up even if the node doesn't have the relevant UNDP applied.

Is your account set up to be a full admin of all the modules? IIRC only admins are even supposed to see that thing but maybe theres some permissions trickery at work.

Have you tried using just the value for warning/critical threshold after you set the object to use dynamic baselines? I would expect one of two things, it shows the correct threshold and you are all done or it shows the placeholder variable for ${use_baseline} and you are in a hard spot.

I've run into this problem before, for some reason queries that use count/round/sum etc have errors when you try to load them into the website unless you put an order by clause on them, forgot about that. So in this case it is an easy fix, add this as the last line ORDER BY SVG1_Weekly -Marc Netterfield Loop1 Systems:…

alphabits​, I ran into the same problem when I first started converting things over. SELECT COUNT (RecordTime)*100/3759.0 AS SVG1_WeeklyFROM Orion.IpSla.JitterOperationResultsDetailWHERE Latency > 120 AND OperationInstanceID like 105 This is the SWQL version of your first query, im sure you can see the differences and…

Orion doesn't require physical hardware, a vm is fine. You can stand up a fresh server with evaluation licenses for up to 30 days to run them side by side while you move everything across. Ultimately when you feel like things are ready you just release the licenses from the old server and grab the new keys from the…

You will notice that several of those models reported back the same sysobjectid, based on the fact that the ID is shared across a product line Solarwinds cannot be more specific than that when using sysobjectid to find the Machine Type. You can set up a custom node details poller and change the OID that Solarwinds uses to…

I was able to whip this together fairly painlessly. Could be faster but it's not excruciating Did that like using the custom chart resource, gave it the names of two of my interfaces Defined the time period I wanted to go back, told it the units to display, set it to show with a stacked area and include the sum It took me…

Also worth pointing out that SW recently acquired the ARM product, not a part of Orion (yet?) But it is a dedicated tool for monitoring user permissions and it is ultimately MUCH more powerful and efficient for this kind of thing than rigging up Sam monitors and powershell.

To get details about LWAP's you should be polling the controller, you'll usually find what you need there since the LWAP's themselves hold almost nothing useful locally.

Assuming your query works in SWQL studio but not on the web console then try throwing an "order by" at the end. The way the web console parses certain commands requires you to specify the sorting it should use.

This is a pretty standard use case for IP Address Groups. You can Define a group with all of the scanners IP Addresses in it and then display all the traffic originating or destined for that group. These pages should get you started IP address groups IP Address Group Conversation Filtered View -Marc Netterfield Loop1…

You should include a capture of the exact setup of what you are sending, because it looks like you must have a syntax error in there, the query you say you are trying to send does not include any * but the error message is choking on some bad syntax near an * so something isn't adding up. Also mrxinu​ wrote that document…

It's been a minute since I ran an SNMP Walk against an ASA but if I recall correctly the ASA does not support the OID's that tell you about connected devices, Checkpoint may be similar. Topology related OIDs polled by the Orion Platform - SolarWinds Worldwide, LLC. Help and Support

Changing those values after the fact will not fix it if the alert was already active. Change them to trigger each time the condition is met, clear out any currently active instances of the alert. The way that LM stacks alert events up on the node is a bit problematic for alerts like this, you will always only have a single…

This should be what you are looking for Configure website URL for Alerts and Reports - SolarWinds Worldwide, LLC. Help and Support -Marc Netterfield Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

Do you have your own instance of Orion or are you trying to import Orion data into some completely different monitoring tool? Orion doesn't have any built in functions to proxy all the data it collects to anything, but there is an API that they might give you access to poll for reporting. It could be possible for them to…

Glad to see things like this. When i got my first job that had Solarwinds I pressed them hard to set up rules like this for any use cases where we knew there was a clearly defined SOP. Automate away the first 2-3 steps of basic troubleshooting and only escalate if needed, record and report on the results for future…

There are zero places in the API to touch any credentials tables. Been a pain point for me in a few cases as well.