mesverrum · Observability Architect · ✭✭✭✭✭

Another thing that sometimes jams me up during CW is if i have APE's and web servers that are still running their solarwinds admin services they tend to keep writing to the DB and it can sometimes cause locks and contention that slows the CW bigtime.

Realistically you probably won't get too many people active on the NPM forum who don't like it. Generally people who dislike a tool don't check it's forum except when they absolutely need to. With that said, when I was a consultant I always found that SolarWinds strikes a relatively unique niche in terms of ease of use,…

Is the action running under a specified user account? Can you try to CMD launch the same script from the same account? If one isn't specified you might try testing it using your cred to compare

If the topology of your gear is being picked up nicely then each group will get their automatic map and when those work they are great, but i find that I'm never quite that lucky and end up preferring to build my own mapping. Since I know that I wouldn't personally be interested in spending a lot of time doing anything…

Without the vman license you can get os metrics, some vm metrics, esx server data, but no data store stuff and no VMware alerts/events (but there's no reason you can't just alert on those events directly from venter). Hardware health for the enclosure might be doable with custom snmp pollers.

Are your ncm devices completing the inventory jobs?

By chance do you have the additional web servers behind a load balancer? I've seen behaviors like that when one of the web servers need to be restarted. New browser or other people get routed to a different server. Could be something totally different but that's a guess.

I had to chuckle a little at the idea that SW would provide the guidance on how to change your AD and device accounts. They provide a monitoring tool, not an all inclusive system administration robot. The situation is really unfortunate but ultimately we are all professionals and I would hope that it should be within our…

I got impatient before and killed my install midway and ended up in a similar situation. Tried a lot of ideas to get it working again but in the end the simplest solution was just a complete uninstall on the server and then starting fresh. You can just launch the installer from CMD with the -uninstall flag and it will…

I specifically checked for agent problems when i finished the patch, everything checked out for me so that tells is at least that this issue is at least somewhat environmental. Any time the agents give me any attitude I tend to get results with reinstalling it on the node, if you haven't tried that already.

Do some googling around Dark Halo APT, that's what they've been calling some of the previous hacks that have now been traced back to the Solarburst compromise. None of what I have seen specifically mentioned hypervisors, but they have said the culprits are extremely capable of gaining access and switching the accounts they…

... here on this SolarWinds IPAM forum I would guess most of the users run the SolarWinds IPAM tool. It does all of the things you described.

The compromise has been somewhat documented at this point, it's no longer a "we have no idea what could have happened" and more a matter of reviewing the indicators of compromise and confirming if they do or do not apply to your environment.…

It's a matter of expectations I suppose. SW isn't always the cheapest but tools that cost less generally either give up something in terms of user experience or capabilities. When I was consulting a few times I was set up to do head to head comparisons against a rep from other companies and I those clients all ended up…

Every layer there would be a custom property, clients, locations, sites. If you want to see their status aggregated then the all nodes widget can be sorted by up to 3 layers of custom properties so it would end up looking almost identical to the group tree you describe. If you do already happen to have corresponding…

the hf1 to hf2 jump only took a few minutes in my environment, but the install for hf1 when i did that a couple months back took a LONG time for me, about 4 hours. To keep eyes on what the wizard is doing i run a powershell tail on the config wizard log file while it runs get-content…

Seeing this made me have a small panic attack but i can say I applied the patch yesterday and my alerts to launch scripts are still operating as expected. Do you have any kind of error messages associated with the failures or are they just not running anything? For the sake of comparison this is one of my action strings…

If you have a lot of alerts and don't want to click around in the GUI too much I wrote this script a while back for my environment. https://github.com/Mesverrum/MyPublicWork/blob/master/AlertArchiver.ps1 You could tweak it to copy alerts directly from one instance to another if you just set up a different $swis for each…

^ application load is a little murky but is based primarily on component count and types of components. Each non-stacked polling engine should be good for about 10k components, once you get past that you either need to start slowing your polling intervals or budget for buying a license for an additional polling engine

Alerts are retained for the same amount of time as the events, which is 30 days by default but you can increase it over a year if you want. https://support.solarwinds.com/SuccessCenter/s/article/Increase-Events-Retention?language=en_US

So in almost all cases where someone showed me an environment with 600 groups in it I could usually see a fairly clear pattern where they didn't even need those groups, they just needed to get a better understanding of how to use custom properties. There are a few exceptions but to be honest those exceptions are usually…

Yep, it's doable http://solarwinds.github.io/OrionSDK/2020.2/schema/Orion.APM.ComponentSetting.html From there you can see the componentsettings allow crud actions. If you haven't poked around in there the way it works is anything that is just inherited from the template will be under componenttemplatesettings, and if…

This forum mostly focuses on the Orion platform, which is a self-hosted set of modules such as SAM (server metrics like cpu/mem/disks/response as well as process and application monitors for things like iis/apache/nginx) and WPM (synthetic web transactions). Orion does not currently have a real user monitoring module.…

It's not supported, but you can export out the connectors/tools from SEM and under the covers they are just a really elaborate set of regex rules. It has been a long time since I did it, but I have rebuilt one of them myself for something custom and then imported it back in.

You could just rename the component directly, but for people who want to get into the weeds there is a custom sql variable, i've done a lot of text manipulation within those, could be as easy as select top 1 replace('${N=SwisEntity;M=ComponentAlert.ComponentName}','Service: ','')

It's tricky to do the absence of a thing with the GUI driven options, but you could just do do it fairly easily in SQL if you know that.

The tool doesn't natively support lookup tables like that, but I have done similar things by just directly creating them in SQL and displaying them with the custom table widgets.

It's just a quirk of the UI, you can't delete a volume that has changed from the list resources view, you have to do it from manage nodes, expand the node, then check the volume you want to remove and delete it.

https://support.solarwinds.com/SuccessCenter/s/article/SQL-Server-Performance-optimization-and-best-practices?language=en_US

So this is really a conversation about your underlying infrastructure more than its even a sql question really. Benefits of keeping them on a single instance, less sql licensing required $$$, less admin overhead. Downside is mostly around performance limits, but its more in theory than reality. A competent SQL admin can…