mesverrum · Observability Architect · ✭✭✭✭✭

This is a solid SQL solution to this problem, I just wanted to add in an example of doing it with SWQL, this is an older query I had used in the past before NPM 12 redid their native F5 integration. Demonstrates pulling data from several UNDP pollers, icons, links, etc. Along with that I also had some other queries that…

I've done pretty elaborate tricks to consolidate data with SWQL, but they always struggle with that interactive element. These days I am finding what you are asking for would probably be very easy with a javascript custom HTML resource (assuming one is a front end web dev, or friends with one). I'm just still working on my…

Just make it ${N=SwisEntity;M=Node.Caption} and it should work

Haha well at least i'm not crazy. I checked the logs previously but nothing jumped out at me, I'll crank up the logging levels with the adjuster and see what I can find in there

This is the right track, I have a report on the number of times an object has triggered a specific alert that I will post when I land.

There's not maybe a public or internal url holding those images that your users would reliably be able to load is there? Instead of adding the image to the payload of the email just put in an <img> that points to the company website or something?

It's pretty easy to do in SQL, just left join the nodes data to the asset inventory software table on nodeid's and software name = 'whatever' Where software name is null. I'm on my phone but hopefully that psuedo code gets you close enough.

Right now I believe the only SW product that can use anything beside MS SQL Server is DPA.

you don't have anything in the query that is narrowing the results to the interface that triggered the alert, its just selecting the first interface it sees on the table isn't it?

So it sounds like if websites is set correctly you probably just need to restart the services or would you need to do a config wizard/db maintenance to have the value propagate the value out? -Marc Netterfield Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems *…

Yes it does, dpa tracks the number of executions and the total amount of wait for all queries and charts the changes over time.

Can you paste in an example of a windows file audit event in LEM? I don't have any in my lab to look at to see how they show up

Ugh i just saw how the forum seems to have broken up the formatting of that query because of the HTML. I had to remove the syntax highlighting and comment about the white space characters but that should work now.

It has mapped the device type to the wireless controller view. I don't know where the logic is that they use for that decision but you can over ride it by going to settings > view by device type and changing it there to the ASA view. Out of the box unknowns, asa's, and several other device types get the wireless controller…

NIST stopped publishing their vulnerability feed a few weeks ago in the format the NCM was taking it, so the vulnerability feed feature is not currently working. You can still do EoL stuff as described in the admin guide.

The more recent versions also include the web based ssh tool, but that does not pass along credentials for you to log into the device or anything, it just saves you from having to download putty.

https://support.solarwinds.com/SuccessCenter/s/article/Use-DirectLink-account-to-share-views-with-non-Orion-Web-Console-users

From the orion side there is nothing that a p2v would really impact directly that should cause problems. Obviously p2v has the normal baggage it brings with it compared to a fresh server but nothing that would specifically be an issue in orion. Don't mess with the ip or host name and it well be invisible to orion.

This is the syntax I use for status icons on applications ,'/Orion/images/StatusIcons/Small-' + a.StatusDescription + '.gif' AS [_IconFor_Application]

I'm struggling to find the document mentioning it but I recall reading that using tls 1.2 only is only supported in the lastest versions of npm and sam, You might give support a call to confirm.

This worked in my lab for SNMP based nodes to automatically add any new up interfaces, the verb it uses doesn't work on wmi or agent nodes though and I didn't make as much progress on the alternative method of handling those as I would have liked. This would presumably be run as a scheduled task on the orion server, using…

This is a series of posts written by mrxinu​ that was helpful to me to get started. https://loop1.com/swblog/dig-deep-with-data-mining-in-solarwinds/ https://loop1.com/swblog/using-the-rest-api-to-get-the-most-out-of-solarwinds-part-1/ https://loop1.com/swblog/using-the-rest-api-to-get-the-most-out-of-solarwinds-part-2/

Also keep in mind that these are all guidelines and not a hard cap, i've built environments far in excess of those counts and you just have to make sure you have a high powered backend to support it, as well as making sure you are minimizing any possible losses to efficiency.

I'm really happy to see that this cert is covering as wide a range of things as it does. I was worried it might not be as technically rigorous but it appears like they did a good job with the scope and depth of it.

the swql queries work pretty similarly to sql but there are a few small changes to commands that you can see if you read through the documentation, for the last 7 days average cpu you'd be doing something along the lines of select avg(cpuload) from orion.cpuload where daydiff(datetime,getdate())<7 group by nodeid

The alert variable syntax does change depending on the type of object you are alerting on, your best bet is always to use the "insert variable" button to get it right.

Pretty common glitch, restart your services on the main server and it should update the lists to include your property.

You can definitely put these together using the web based reports and there are examples under Historical Netflow Reports Just as a word of caution, when building reports for Netflow endpoints you will always want to filter it down to traffic over only the closest interface(s) to the endpoint. If you just added up all the…

I try not to make any estimates of cpu loads would actually look like, they are SUPER variable depending on the type of polling you do, how often and a bunch of other things that come into play. If you are provisioning a real physical server then I would probably shoot for something with 16+ cpu for something with hundreds…

Pretty sure the agents are locked down to a specific engine ID regardless of using server or agent initiated, but the best way to find out is to test it out. I've seen many cases where there is a mismatch between what server the agent thinks it should send data to versus what poller thinks it should be getting agent…