mesverrum · Observability Architect · ✭✭✭✭✭

Looking at it more I also question if that widget is really showing what you think its showing. I think its just pulling in the latest event of any kind for that node id. I'd expect there should be some kind of addition condition in the join to narrow it down to only joining the events associated with nodes going down.…

You might try changing that inner join to a left join. My suspicion is the missing nodes have been down so long that their down event aged out of the events table, IIRC thats only 30 days retention by default.

In a green field I just use native thresholds, now that you can do "x of y" for basically all the major metrics I think they are in a really good place.

You can't use the between function for calculating durations, it is just a shorthand for saying where timestamp > A and timestamp < B, its not a math function. My Alert SLA query has the calculations for comparing the time of the trigger event to the time of the close event to calculate the duration. Lines 19-21 cover…

That is strange, and maybe you are right that they are doing something weird in processing, but I would be more likely to blame some quirk in powershell profiles or something like that than trying to get into rabbit holes with the Orion devs. As you have already implied, support isnt going to be able to give you any…

It looks like I have all the things you are asking for, but they arent in a single query. This should give you enough to piece it all together how you like. Active alerts SELECT o.AlertConfigurations.Name AS [ALERT NAME] ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS…

Not OP, but have used similar CP for thresholds for years. I think mostly its just legacy, in the old days managing those thresholds as a one-off basis was just really hard to do in the GUI, especially in bulk. For green field deployments I stopped doing the properties a while back, but i could see why people dont want to…

You don't really need SWQL to do business hours reports. https://solarwindscore.my.site.com/SuccessCenter/s/article/Use-Report-Manager-to-configure-business-hours-in-web-based-reports?language=en_US If for some reason you want to get fancy with it this thread shows some syntax that should get you closer.…

Unfortunately no, there is no way to generate a bulk report of that widget. Also you can't exactly trust that widget 100% because there are lots of ways to configure an alert and this widget basically only knows if you match the "Scope" section of the alert trigger.

Just keep in mind that increasing the detailed stat retention to 30 days can roughly 2-3x the amount of storage your DB uses. This also slows down the load times of basically any page that tries to display historical stats and charts. I often kept 30 days of data in my environments, but I also had a monster database back…

Surprised that you are getting so little traction but i think its because the people are looking at this as a SW behavior thing to fix rather than just looking at it as a simple powershell problem. SCM is just going to scrape whatever powershell displays, in exactly the format that powershell presents it. Try tacking this…

There was a change to the executeSQL verb recently where it can no longer perform updates inside the DB. This is a fairly logical security restriction for them to have implemented but it breaks a lot of scripts I had written over the years. Simple work around is just to take the sql lines that the script is trying to…

Well as a counter point in modern dashboards they went away from the concept of pre designed widgets completely. There is basically just the prompt to pick one of the pre defined visualization formats and then either reference a pre-existing example of that from one of the existing dashboards or roll your own right there…

Check out this thread thwack.solarwinds.com/.../how-to-add-multiple-custompoller-to-report-as-columns

You need to write your custom query in such a way that it can be joined to the pre defined select statement that they give, because the data they are selecting is the stuff the alert engine needs in order to actually create an alert. Not at my desk today to be able to hammer out the exact sql syntax, but it looks like it…

https://solarwindscore.my.site.com/SuccessCenter/s/article/List-of-NPM-NTA-VNQM-MIBs-and-OIDs-used-for-Polling?language=en_US When it comes to discards and errors Orion is using the bog standard if-mib counters that basically everyone uses Interface Information Interface Errors and Discards OID =…

No, orion pages can't be embedded in the email content natively anymore. Used to be able to do that many years ago, but it went away for whatever reason.

Your script also needs to be using psremoting command or invoke-command or something similar to remote execute, the syntax @"bobmarley" gave would pass in the device caption as an argument that psremoting could use to find the system to connect to. Although I would suggest passing in an IP or a DNS name instead since the…

It used to be easy, but they made it much harder a few years ago. There was a directory on any Orion web server that stored the actual code of all the widgets, so you could just dump a list of all the file names in there and you would have been set. Then in an effort to make all the pages load faster they introduced the…

So getting into real web dev best practices there is no actual secure, legit way to siphon pages or UI elements out of one website and present it cleanly in another website. That whole scene is riddled with buggy behavior and security loopholes to where anyone who designs websites for at least the last 10 years has known…

Hco licensing now includes lab licenses for people who have more than 500 nodes. Otherwise I can say it's totally possible to script lab deployment if you are serious about making it happen. At my old job I could spin up our dev environment and populate it with my test batch of nodes (via a discovery very similar to what…

That oid is kind of a special case, that string will always be true regardless of the power source because it's just a list of the meaning of potential traps the device can send outbound, so I wouldn't waste any more time worrying about the setting to try and poll it. In general there are some details with SNMP that…

I haven't written code to make it happen yet on the maps tables, but in ye olden days I was dumping the contents of certain database tables to our Git repo so i could diff and restore them when I needed.

As best I can tell the db maintenance is complaining because you added an index to one particular historical table, CustomPollerStatistics_CS_Detail_hist, but there is also table called CustomPollerStatistics_CS_stg and the maintenance job assumes they should both have the same kind of indexes. I don't think anything is…

I'd suspect permissions too, but if the problem comes and goes another possibility could just be timeouts, in which case increasing the allowed timeouts in the template might be a work around.

Depending on what you are monitoring in SAM yes there are components that would be using port 445 or 135. I think some of the violations they are calling out like the user enumeration and registry enumerations are likely to be triggered by things like the asset inventory and/or SCM templates. They'd need to investigate…

I replace the OOTB gauges with a much more compact custom query widget, i hate how much screen real estate the gauges use. I keep my most used widgets in the repo https://github.com/Mesverrum/MyPublicWork/tree/master/SWQL Similar to @"Deltona" 's comment I have an alert history widget I add to the details page for every…

Some widgets are only available on specific types of views, so it sounds like you are maybe looking for a map widget that came from a group details view. Another possibility is there is just a widget called Map IIRC and when you set it up it just asks you which new map you want to display, but it only works for map views…

Are those wish list widgets or do you have swql for them? I have my own version of the last one, and to some extent the first one, but the second one would be magical if we had one that was reliable.

Presumably those servers are just generating a large enough number of logs for the log forwarder to overwhelm the resources on the server. I'd suggest maybe applying filters and stripping down the logs that you send to a bare minimum and see how it runs then. Assuming that goes well you can add things back in until you see…