mesverrum · Observability Architect · ✭✭✭✭✭

To be honest you do not want to poll the hosts directly with SNMP at all if a vcenter is available. Orion tends to be more likely to have a hard time piecing things together if you are polling some stuff via vcenter and other stuff via the hosts directly.

The latter, if you give them management they can manage any nodes they can see, but with the account limitation they will only see nodes that match the criteria you set up on their account.

That one is written for any group, but if you want to specify a single group then just add to the WHERE section a line saying and groups.name='your group here'

I also just learned that SCCM adds some join functionalities to WMI queries, but I'm not sure if you have to do the queries within SCCM to have them or if it installs something that enables all WMI calls to leverage them.

Like I said, if you go to the custom property editor (all settings> manage custom properties> check the properties you want to work with then view/edit values) you can use the group by options to filter to only nodes in a particular group and then select all the nodes in the group at once and bulk set the property.

When I find myself in that position I usually end up just spending a day or so going through the existing alerts, taking notes on figuring out what they were intended to do and starting to plan out how to condense/improve them. Then I build my replacements and give them all the same prefix like !Alertname so I can find…

Just curious, wouldn't it be preferable to just change the polling ip instead of deleting and re-adding? This way you can still hold onto historical data and any custom properties. delete re-add also would ruin any dependencies that involve the node as a parent or child, and any atlas maps you have. Seems unnecessarily…

Yeah unfortunately there's no easy way in the gui that I can think of to make an interactive search and save it to a csv. For myself I'd just execute the report in SWQL studio and then you can save the results as a csv from there, but that's not something you'd want to have end users doing.

10 gb is a small netflow db, i wouldn't worry about anything until you are north of 50gb. With fast storage performance is acceptable at larger sizes

Yeah using the built in GUI it's not possible to use the number of polling intervals, its hard coded by units of time. Fairly certain that's just because it seemed easier to code it was way back when the alert engine was first created. I've done it in SQL and SWQL but it did add an additional layer of complexity to pull…

NPM without SAM only gives hardware health info for network devices, nothing for servers.

I think rschroeder​​'s point is that netflow as a protocol doesn't support the granularity a security team needs. It was not intended from it's origins back at Cisco in the 90's to be a detailed tool for analyzing specific data as much as it is a ballpark tool for measuring which way the wind is blowing. In many cases you…

If you are still using the free Aerisweather account I saw that they require you to renew the account every few months, I expect that is what happened in this case.

You can install it on your workstation or anywhere, it is a client similar to SSMS

Mute has no effect on availability calculations. If the node goes down during the mute period is will be calculated as normal. There's no built in provision in Orion to calculate availability outside of scheduled maintenance windows, only the raw availability.

Basically you want to ignore groups for alerting purposes, the object with the alert on it is a node, so it has to be node level information to be involved in the alert. Go to the custom property manager and you can use the sort by on the left, select group, find your group and set the node properties for all nodes in the…

Are you running the latest version of SAM? I'd seen that before at two clients when the feature first rolled out and there is an item in the 6.4 release notes indicating they resolved a bug relating to the groups and sam templates. If you arent fully updated I would start there, if not push it to support and they may not…

Beside just including a link to the component details page in my alert message I can't think of anything easy that would give you messages for each individual event within SAM. I always consider event log monitoring to be a "nice to have" kind of feature in SAM, it does what it does and can give you a general idea about…

In most environments I would say an events table that is larger than about a gigabyte would be weird and potentially cause issues. Also a factor in this could be your event retention setting (you can see this under all settings > polling settings), I see a lot of people change this from the default 30 days to something…

I believe in the past I have seen issues where the config wizard it set to use auto detect for the SQL auth type, so it tries local sql auth first, fails, then does windows based auth with the same cred and succeeds. I could see maybe that causing the issue? You can confirm if you look at the sql server error event logs…

This query is a good one to demo that SELECT n.caption as Node ,n.detailsurl as [_linkfor_Node] ,'/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Node] ,n.ip_address as [IP Address] ,n.detailsurl as [_linkfor_IP Address] ,'Edit' AS [Edit] ,'/Orion/Nodes/NodeProperties.aspx?Nodes=' + ToString(n.NodeID) AS…

Basically the device can only support so many snmp requests at once, you need to reduce the amount that you are asking from it. Either disable some of the polling features like routing rables/vlans/neighbors or do not poll as many interfaces as you are and see how it goes. You might just add it into your Orion and then…

Ah I assumed you had made that query yourself. There is a tool on your orion server called database manager that you can use to browse the tables and look for things, for this purpose I think the query would be select * from cpumultiload where nodeid= (your stack nodeid)

Well for what you are showing I would write it like so select n.caption as Node_Name , n.Description , n.customproperties.Network_Zone , 1 as [TotalResourceUnit] count(i.status) as [Active_Port_Count] from orion.nodes n join orion.npm.interfaces i on i.nodeid=n.nodeid where ((i.InterfaceName like '%eth%' or i.InterfaceName…

Since tdanner is one of the main developers of the api I think you can take his word for it when he says the api doesn't support that at this time. They seem to add new commands to it every few months so I'm sure it just comes down to time and resources versus demand. @designerfx has the right idea with the feature request.

Screenshot from my lab on how we do this, this is the variable in the to line (note that there is a glitch in the latest versions where it won't let you do mroe than one variable in the To: line, this is fixed in current hotfixes) Then as an example this is how that property is populated for a xen server to alert the…

The only people who can change those are the ones with permissions to customize views. I generally try not to have more than a handful of people able to build views or else you run into problems like this. 

In the UNDP tool there is an option to create a transform, the thing thats a little lame about it is that the resource will display the raw value as well as the transformed one, so it's a little meh.

Ok so this is as far as I'm going to do the leg work on this because I expect it will take care of 90% of use cases. Feel free to follow the model and add on if you need one of those other cases. Also, the replace() function is brand new in Orion Platform 2017.3 (NPM 12.2) and later, if you aren't up to date then just use…

I found an article with some relevant syntax examples, looks like @contextnode.Caption should do the job https://thwack.solarwinds.com/community/solarwinds-community/product-blog/blog/2012/12/18/a-few-tips-for-creating-ncm-co…