mesverrum · Observability Architect · ✭✭✭✭✭

Comments

  • Unfortunately the database stores that data in an XML layout that makes it a real chore to parse out, you could see an example of what you'd be working with using this query in SQL SELECT * FROM [dbo].[AlertConfigurations] Specifically your are interested in the Trigger and Reset Columns, an example of one is below for the…
    in Is there a way for an alert email to contain in its message body the 'trigger condition' and 'reset condition'? Comment by mesverrum July 2017
  • If you go to Applications > SAM Summary > Manage Applications > Application Monitor Templates > Create New Template > Add Component Monitor, then select either Process Monitor - SNMP or Process Monitor - WMI based on what you are polling the nodes with, then you can set up a process monitor by typing its name in. But I…
    in SAM Application Discovery Comment by mesverrum January 2016
  • I dare say that powershell might be a better way to find this than LEM, for a few reasons I will get into later but to the immediate question: Windows service starts are associated with eventid 7035, so if you filter against SID *7035* that should get you all the service start events that you are recording. Probably filter…
    in How to use NDepth to find services run as Administrator Comment by mesverrum February 2019
  • To the best of my knowledge the built in syslog receiver in NPM doesn't support secure syslog, at least I never saw any mention of it but I've never tried. Hopefully someone from SW internally can chime in. As far as the 17777/8 they are using the tls as configured/negotiated on your Windows servers SWIS - Encryption over…
    in Application Communication Encryption/Authentication Comment by mesverrum April 2018
  • Under the new SAM licensing model APE's are free and unlimited. Under NAM APE's are also free and unlimited. The HA covers the whole server pair and everything on it, and with NAM licensing you can have as many HA pairs as you like. I suspect that you will not have anything to worry about.
    in Anyone running NAM & SAM Comment by mesverrum August 2019
  • SWQL is a little less flexible with complex queries than SQL, you can do them but sometimes the formatting needs more than just tweaking the table names. In this case you need to do that as a nested select, or join the selections, what you have is more a series of separate queries. I'm about to start working with my client…
    in SWQL Query Multiple Select Problem Comment by mesverrum July 2016
  • Alertconfigurations is current, definitions is legacy from older versions.
    in Orion SQL db Alert Definitions table, query for keywords in TriggerQuery Comment by mesverrum February 2019
  • It is possible to apply report limitations that are independent of being an admin or not, but it is kind of uncommon. Under your account/group you should see report limitations like this, most people it is default. Then go to the Report Manager screen and check like this to see if any limitations are being applied to the…
    in Report Permissions Comment by mesverrum March 2018
  • The tool for adding in custom SNMP OID monitors is called the universal device poller, SolarWinds Orion Network Performance Monitor Universal Device Poller UnDP - YouTube But The UNDP does not have any built in color coding to reflect states. It can display the whatever the of the OID is, and you can show those in Atlas,…
    in How to add a custom OID to monitor on a Cisco Router Comment by mesverrum February 2018
  • Applications are just a grouping of 1 or more components, they inherit their status from their worst component. Components will normally be in just a few states: Up - Everything is good Down - Solarwinds either cannot complete the test that the component requires, or the component has completed the test and failed. For…
    in Different between application status & component status Comment by mesverrum March 2018
  • Don't make the object of the alert a group, the object of the alert should just be nodes if you want an alert on each node.
    in Trigger for each group member in a group? Comment by mesverrum March 2018
  • I think you are going to be out of luck, I've never come across anything in the system that tracked when a report was run historically. I just ran some in my lab to test and could not see any historical record created in the events or audits. 
    in Scheduled Report History Comment by mesverrum March 2018
  • And just to clarify, the all alerts resources are sensitive to view limitations, but only for the category of objects in the limit. Its kind of weird how it works but if you put in a limitation based on a node property then it will only show you Node alerts with that property, but it still shows all alerts for any object…
    in Active Alerts display by Host Name Comment by mesverrum July 2019
  • timt​ I poked around and it looks like IPAM.subnet.comments is what maps to that field
    in IPAM: how to export subnet properties via SQWL Comment by mesverrum June 2017
  • There is a feature where an alert can over ride a node status and set it to something different. I personally avoid it because it can be kind of a pain to make sure the status over rides work correctly and I trained my users to know that the node status is only indicating that the node is reachable from Orion and we use…
    in On the world map, is it possible to have the nodes change color when they pass a certain percent utilization? Comment by mesverrum January 2019
  • Just like it says, 12.0.1 won't install onto SQL 2017, you would need to upgrade in place to 12.2 or newer, then migrate the upgraded DB to your SQL 2017. Or you can do something funky like installing the current release and taking your backup and restoring it on a compatible version, then upgrading that, then migrating it…
    in Unsupported Version of SQL Server Comment by mesverrum April 2019
  • Solarwinds themselves doesn't usually test all the possible network devices to see if they work, they work under the assumption that if your hardware has SNMP then there will be some degree of compatibility. Depending on the device and what information the vendor made available in SNMP you will have different metrics that…
    in how to find devices tested/accredited for Solarwinds NPM,NCM? Comment by mesverrum August 2019
  • Given the extra overhead groups put on your system I would suggest just setting something like a true/false custom property and applying an account filter against the property instead of a group, but otherwise I believe you are on the right trail.
    in Account Limitation to See Nodes Comment by mesverrum August 2017
  • There is no public documentation of the table relationships, and you are correct there are many table columns that are not explicitly identified as being keys that you will have to comb through. Successfully combining two databases is extremely difficult and in most cases it doesn't go well. Hopefully you have plenty of…
    in Is there any document descibing the SolarWinds Orion DB including relationships between tables? Comment by mesverrum October 2018
  • Do your actions involve an escalation? If there is not then they basically all happen at the same time, or within milliseconds. It doesn't wait for step 1 to proceed to step 2. If you want to let the ncm action complete before your email goes out you usually need to add in an escalation and let it wait maybe a minute or so…
    in Reordering Alert Actions Comment by mesverrum July 2019
  • It can be done using a feature called a universal device poller. Any time there is an SNMP based bit of information you want to collect that Solarwinds does not collect out of the box you can just tell it the OID you want to have it check. This video demonstrates creating them SolarWinds Orion Network Performance Monitor…
    in Avaya serial numbers Comment by mesverrum February 2018
  • Given that SWQL doesn't support most forms of explicit casting you just have to develop within the constraints you have. Why does your 2018-03-08 have to be manipulated as a string? Is there not a way to use any of the currently defined 34 SWQL datetime functions to get the same effect? SWQL Functions · solarwinds/OrionSDK…
    in Issue with nested DateTime(Concat('2018','-03-08')) Comment by mesverrum March 2018
  • Mostly the same Select Distinct data.Name, sum(data.TotalPowerLoad) as TotalPowerLoad, data.location FROM ( SELECT distinct (substring(n.Caption,1,16)) AS NAME, cs.ComponentStatisticData AS TotalPowerLoad, n.location FROM orion.apm.CurrentStatistics cs JOIN orion.nodes n ON n.NodeID = cs.NodeID WHERE…
    in SQL to SWQL Conversion Comment by mesverrum March 2019
  • Solarwinds is capable of receiving netflow data from all versions of Cisco. The key question I think you have is if your cisco devices themselves support netflow and the best way to verify that is just to talk to your vendor. For the most part switches do not support flow regardless of the license they have applied because…
    in LAN based vs IP based - NTA Netflow Comment by mesverrum April 2017
  • encapsulationdown​ Do these switches have any kind of UPS? From the switch itself there is no way to distinguish between hard power failures and the device just not being able to answer a ping due to network or config problems, but via a SNMP enabled UPS or some other kind of environmental monitor you can monitor incoming…
    in Dealing with power issues. Comment by mesverrum June 2016
  • Groups get their status from the members of that group, not any children of those members. To cause the effect you are asking for I believe you would have to actually add the interfaces you are interested in to the group. Not too hard in a small environment but could be a pain to do with a lot of groups.
    in Groups showing worst status including interfaces? Comment by mesverrum February 2018
  • The published recommendation is to make sure the ape has under 250 ms of latency between it and the SQL db.
    in Additional polling engine Comment by mesverrum July 2019
  • At this time there is not a built in integration with other Meraki devices besides the AP's. You can enable direct SNMP polling for the firewalls and switches but from the people I spoke with you might find the available OID's are pretty limited compared to what you would see from most other firewalls. SNMP Overview and…
    in Meraki devices monitoring Comment by mesverrum September 2017
  • You could steal a play from the solarwinds built in alerts for Top CPU and Memory processes. Step 1, trigger alert and the action is to launch your script to tracert (l33t Tracer-T video​ ) add an escalation, wait maybe a minute or two for the script to run, now the trick is that one of the final actions of your script is…
    in Pings, traceroutes or other output into email alert Comment by mesverrum June 2018
  • The no data available placeholder isn't due to the system being slow in any way, it means that resource is charting out some metric that your object hasn't had during the applicable time window or Orion hasn't been able to collect the data. I've not seen that particular resource fail to have data though. I'm not 100% where…
    in Top 20 Page Requests by Avg Server Execution Time - Widget is hidden on dashboard Comment by mesverrum November 2018
Avatar