mesverrum · Observability Architect · ✭✭✭✭✭

I had a suspicion they might be ordered by the SNMP OID used, but I just tested that and can confirm that it is indeed not alphabetical, nor is it based on OID. I also tried sorting by every column in the database and none of them seemed to match up to the order that I got on my combined table. Sorry I couldn't pin down…

Yep you got it, take the last run time, add whatever your frequency is to that, now you know when it will execute again

In order to do topN with sql/swql i usually join a subquery that just gets the list of topN objects sorted by whatever aggregation i want to sort by. So assuming you want top 10 apps by total traffic over that window it would be like this (didn't test it, may have typos or something) SELECT F.TimeStamp As Time, A.Name AS…

Perfstack doesn't include any time filtering capabilities right now, so thats out. You could use a custom chart but unless your company changed your retention settings you wouldn't have anything more granular than hourly data available beyond the detailed retention period, which defaults to 7 days and hourly averages only…

I have wrestled this pain many times. Unfortunately the account permissions in Orion are not that granular. It is an all or nothing situation where you either have permission to edit all nodes or none. What I have seen some companies do as a workaround is to leverage their admin accounts within the domain as the one that…

Try this query in a report or custom query resource SELECT ComputerName, we.component.application.Name as [Application], SourceName, tostring(tolocal(TimeGeneratedUtc)) as [Timestamp], Message FROM Orion.APM.WindowsEvent we WHERE computername like '%' and we.component.application.Name like '%' and Message like '%' As it…

Status codes are outlined here in the DB SELECT StatusId, StatusName, ShortDescription, RollupType, Ranking, UiOrder, Color, IconPostfix, ChildStatusMap, DefaultIconName, CategoryStatusMap, DisplayProperties FROM Orion.StatusInfo

Looks like the account the report is running under is failing to log in, double check what account that schedule runs under and make sure it still has access to the web console

When you query the controller in snmp it gives you a list of all the thin aps that it has. If the ap isn't checking in with the wlc it will register as down, although the default behavior in Orion is to just delete them when the WLC says they are gone unless you tweaked the setting to keep aps after the wlc stops listing…

If you want to be notified immediately on changes you should be using the RTCD feature instead of scheduling so many jobs. Configure real-time change detection in NCM

There is no built in way to send test messages from orion agents to the console. What kind of message are you trying to send? You can simulate/force alerts from the orion console if you want from the screen where you edit the alert actions. -Marc Netterfield Loop1 Systems: SolarWinds Training and Professional Services *…

Piggybacking onto curtisi​​'s comment here, if you are trying to think of this in the same way you would do alerts in Orion you will become very frustrated because it works on entirely different principles. LEM is event driven, so you can't set up behaviors like "alert me until this is acknowledged" because LEM doesn't…

Using a SQL variable in the alert message will always only give you the first cell of the results, it is intended to pull a single value not an entire table of data. I've seen people work around it with various tricks such as making a top 10 list by putting the variable in there 10 times and shifting each one by using…

I have found that in some environments where we upgraded from versions without that feature to the ones that had it I would have to edit the subnet and specify the engineid to use for polling. Since the value didn't exist or wasn't used in older versions it was NULL for all my subnets and jobs weren't running.

Not all handset models report MOS, are you getting MOS scores for any other calls on these handsets?

in SNMP bits per sec is an incrementing counter that gets polled every x minutes, and the difference between the last poll and the current is divided by the interval. So it is always an average across a period of time and short bursts don't show up. That's common to all SNMP based polling tools. You would also measure bps…

This may have some clues Tips for executing external scripts and batch files with alerts - SolarWinds Worldwide, LLC. Help and Support I often find that it is some issue with the system account from the orion not being able to remote execute posh on the other hosts and having to set the orion services to run under a domain…

This is your best bet, most of the API work being done is using powershell though, so there are a ton more examples in that section of the github GitHub - solarwinds/orionsdk-python: Python client for interacting with the SolarWinds Orion API

This is the report I use for checking on my node credentials, set it up as a custom query. SELECT n.Caption AS [Node Name] ,n.detailsurl as [_linkfor_Node Name], '/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Node Name],n.ip_address as [IP Address],n.detailsurl as [_linkfor_IP Address],c.Name AS [WMI…

Hopefully not to derail you entirely, but why would you create a report like this in RW? there's nothing there that couldn't be done in the Web based reports. Sooner or later SW is going to stop carrying that legacy 32 bit RW into new releases so it doesn't make sense to build new content that relies on it.

It would seem that your NTA is doing netbios lookups for an address that it saw in the environment. I looked up that address and it is a Mikrotik router, those were recently known to be compromised as part of a bot net so i wouldn't be surprised that it is probing your environment and NTA is trying to look up a name for…

A few ways you can do this. If you know that these are the only rows you need and they would never change order then you could set up separate UNDP pollers for 1.3.6.1.4.1.476.1.42.3.5.3.2.1.4.1, 1.3.6.1.4.1.476.1.42.3.5.3.2.1.4.2, 1.3.6.1.4.1.476.1.42.3.5.3.2.1.4.3 and 1.3.6.1.4.1.476.1.42.3.5.3.2.1.4.7 Otherwise you poll…

You should edit the page settings for that view and double check what resources you have on the page. If you see anything that might have a name with anything relating to pcu/power then go ahead and remove those widgets from the view, I wouldn't expect an NTA vew to need any of those widgets and those are the ones that…

You basically cannot do that through the GUI. Unfortunately the grouping function in orion isn't easily tied to alerts. What is generally easiest is you should create a custom property that will track these nodes for you, and then you can go to the custom property editor and one of the options you will have in the drop…

In the past when I have had to deal with this the workaround I used was kind of a mess but it gets the job done, way faster than typing in 700 values by hand. Create the custom property you want to populate the drop drown for, but don't restrict the values yet. Grab a list of as many IP addresses as you need for your…

You can script to launch the exe and parse the return code using any of the script monitors.

A lot of the templates provide relatively more 'robust' monitoring than you absolutely need if you are license constrained. As an example, for internal websites or things that aren't under active development the appinsight for IIS template is 30 licenses and gives way more metrics than most monitoring teams really need.…

I think your NOC users are misunderstanding SAM, it is not a ticketing system so it has no mechanism for assigning anything to anyone. If they try to use it as a ticketing system they are probably going to become incredibly frustrated with the fact that it is missing all the features one would expect from a ticketing…

Except in cases where clients have intentionally avoided doing so, Solarwinds has has the NCM and NPM databases merged since 2014. At this point that is the preferred way to have things, there is not any problem with having them run together. The automatic merging was only built into the installer for NCM around version…

the lem usb whitelist is under Manage groups, look for user defined groups with USB in the name