mesverrum · Observability Architect · ✭✭✭✭✭

So I spent a couple years at a very large enterprise as they went into their devops and modernization journey. There the devops implementation was essentially designed around empowering devs to directly provision and manage their own infrastructure, preferably via on demand automatic tools, cutting out a lot of what they…

The simple answer is you need to frame your mind that UDT and IPAM can't actually source data from each other. There is only the most minimal amount of crossover. Makes more sense when you consider that they were both developed entirely separately so the devs couldn't assume that someone had both modules until someone in…

You see in your screen shot it says"status set manually" which means someone had previously set up some kind of alert that forced the node status to display as warning. Just click them and revert them to normal, and check the alert actions in your environment to figure out what is changing them and maybe stop doing that,…

The tooltip in red is giving you a clue, not all device manufacturers make it so their SNMP counters actually update at a high speed. From the look of this you are very close to the speed at which the PA refreshes the data, but every ~5th poll you hit them too soon, which gives you a dip and then the next poll you get…

For transient, short lived errors like that I think you might be better off going for a packet capture approach. That will give you a lot more detail about what exactly your servers are doing when they drop communication. Anything polling based is pretty unlikely to capture the issue and even if it does all it will do is…

Looking at those jobs there is not really any impact except that you will start having working backups again.

Its very simple to do and has been available for years by using the alert engine to set custom properties. You can create an alert trigger that essentially says "yourCustomProperty is empty and node location is not empty" and then in the trigger action you would use the action to Set Custom Property = node location. Here…

From the look of whats in here this is being used in a summary dashboard in the custom query widget, so another approach would be to use the search box as a way to filter. Could tick the box for enabling seach and copy in the whole original query to the second box and then add a line like this in between the tmp definition…

NCM backup jobs generally are just going to run the equivalent commands to a "show running config" and then saves whatever gets returned to the cli. It's not likely, but possible that you could have set up some kind of task to restore configs or do other things so the best way to be sure is to go to the NCM Jobs page and…

I have always treated that deployment health page as just some dev's best guess, not the gospel of how to do Orion. It's not giving you any kind of measurement driven performance analysis and saying these are definitely problems that are impacting your system, its just comparing your data to a collection of hard coded…

You are probably going to want to take a step back. Step 1 was mentioned to you in another thread recently, you want to install SWQL studio and get acquainted with the data that's available to you. Intro to SWQL Studio One of my colleagues wrote this blog series that walks through some real world scenarios in how to build…

I'm curious how many alerts are being generated on a typical day for you?

I had this example powershell script in my repo github.com/.../AlertArchiver.ps1

The swql is going to be something like Select things from table... Where ( datetime > 'your jan start timestamp' and datetime < 'your jan end timestamp' ) Or ( datetime > 'your feb start timestamp' and datetime < 'your feb end timestamp' )

There are samples in many languages here, https://github.com/solarwinds/OrionSDK/tree/master/Samples The big difference between the Orion API and most other APIs is that most APIs have specialized endpoints where you make very simply defined queries, but Orion is basically an open door into the database. So instead of…

That widget doesnt exactly use SWQL, IIRC its actually older than SWQL has even been around. The syntax is describe when you hit the edit button Application.Name like '%orion%'

I think you may be right about the custom status issue, you could rebuild your alert so it is targeting the node instead of the interface, i cant recall off hand if the condition builder GUI would let you do that or if you would have to do a custom alert with swql/sql.

My first guess is that the devices with Not Applicable arent sending any flow on any interfaces. On the example your showed where we did get flows then it looks like the UI shows the poller hostname for all interfaces on that device, as long as at least one interface is actually sending flow.

A few things, that is SQL not SWQL, important distinction to maintain. Also, I've done similar chargeback reports in past companies and yes it can be an monster of a query and its best to run it inside SSMS or the database manager because in a large environment it would almost never be able to complete within the Web GUI's…

Just as a heads up to you, you posted this in the network performance monitoring section which is a totally different product than loggly that you are asking about. This article might help, https://www.loggly.com/blog/best-practices-for-client-side-logging-and-error-handling-in-react/ but your best bet is probably just to…

So this is a fun one and depends mostly on how much of a fudge factor you are willing to accept in your reporting. The simplest solution is to find out how many minutes would be in your reporting period and take the percentage of availability and multiply it against those minutes. So for example 1 day, 1440 minutes except…

I like that you were able to pin this down and bring it to the community, i do not like the change. I can see why someone at SWI might think that it would have been a beneficial change, the message payload in many of the OOTB example script monitors is just a slightly more verbose version of the statistic. So it might have…

In my case it was done by running a scheduled SQL report each day (not SWQL, you can't update with that) which would do something to the effect of select n.nodeid, n.caption, n.MySerialNumberCustomProperty from nodes n where n.MySerialNumberCustomProperty is null or n.MySerialNumberCustomProperty = '' ; update nodes set…

So the problem with SNMP devices is they are not very consistent about what OID they expose serial numbers with. For some vendors it is a dead simple "call this oid and you will get the serial number" and others are "call this tabular oid and some of the results you get will be serial numbers, but some of them wont be and…

are these devices windows servers? I dont think those two values would populate for any other type of nodes.

Don't have a data set to confirm this, but at a glance I would assume there is duplicates being double counted. The master unit from a switch stack would show up on both the nodes table and the switchstackmember table. Just a word of caution about accuracy of the contents that this kind of query would spit out. 

Yes, although if you don't know how to do a sql replace yourself I'd be extremely nervous about trying to explain it to you via a forum. There are lots of tiny syntax mistakes that are silly easy to make when doing a table update. If there is a DBA at your company that can back the db up with you and run through ithe…

Pretty sure thats not how cloudgenix devices work (or most SDWAN for that matter). They dont keep a local config that you would need to back up or could reload via SSH commands, they just phone home to their central control plane and get the configuration from the mothership.

In solarwinds up/down is normally determined by the server answering pings, so the first thing to check is if it does or does not reliably answer pings from your polling engine. Is this server on a particularly bad network connection? Are there firewalls in the path that could be causing problems? 

Get two monitors, open two browsers, side by side and do a manual comparison of all the trigger and reset conditions.. There is not report or other easy strategy that will do this correctly . You export and import them, or can compare alert names across environments with a script , but just because you have two alerts with…