mesverrum · Observability Architect · ✭✭✭✭✭

I think he's run into a bug I've had to fix before in a number of client sites. The modules seem to do a poor job of validating the some of the OOTB views already exist and so they create duplicates with minor variations on the names. Annoying things that arent obvious in the GUI like adding trailing spaces and marking the…

Curious what thread you saw in reddit, I could only find one and nobody in that thread had actually purchased any level of premium support so I can't really use it for much of a reference point. We all know standard support has been pretty hit or miss and generally rough over the last couple years. I'm dying to see the…

I actually have set up many clients to just not do volume monitoring the built in way and instead rely on scripts like this one from alexslv that just executes powershell to identify all the volumes on the server automatically. There's usually a bit more leg work around building the process but that's a solid starting…

The problem in this case is that you are using the variable for components with problems inside an alert that should be for a single component. So it shows you the component that triggered the alert, as well as any other components that have issues on that application at that time. Unless you are using a complex alert…

your dl should be wintel@yourdomain.com is that right?

Wow I have never seen that work around for the case logic in the subject line. I always just use logic like that in the alert engine to build rules that automatically populate the custom properties using set custom property actions, but at the end of the day both methods would get you where you need to and I guess it could…

The built in Solarwinds Cert component doesn't pull back all those details, it just does the name and date of expiration and response time to get the cert. You'd probably need to cook something up as a custom script to gather those extra details.

Three retention settings are under all settings > nta settings. It's like 3/4 of the way down the page, default is 30 days.

Unless you are only going to be monitoring an extremely small environment you will most likely need to use a paid edition of SQL. From MS: * Limitations : * Microsoft SQL Server Express supports 1 physical processor, 1 GB memory, and 10 GB storage * -Marc Netterfield Loop1 Systems: SolarWinds Training and Professional…

A slight improvement would be to set the template to use the "not running" option on this service instead of reporting as down, they'd be blue and not negatively affect the availability and all that

I'd have to look at the database, but it could be that the field "sourceip" does not actually contain strings of IP addresses, it could be maybe an integer pointing back to the list of endpoints or something like that. You could validate that idea by just entering a plain integer with no decimals and see if it thinks that…

Seems like you are pretty out in the weeds with this, try this SELECT Name, DetailsUrl as [_linkfor_Name], StatusDescription as Status, '/Orion/images/StatusIcons/Small-' + statusdescription + '.gif' as [_iconfor_Status] FROM Orion.Container Do you have SWQL studio installed on your orion server? It makes a huge difference…

I've deployed lots of clients with SQL AG in the last few years. I wrote a bit about what to expect in terms of performance impact on a comment to someone else yesterday Orion Availability Groups You can definitely feel it even with fast ssd storage, but the above account from 2016 of database corruption and such indicates…

ohhhhhh gotcha, thats my mistake. testing in my lab i was using a property called owner because i didnt have physicallocation. I forgot to remove that from the order by statement on line 10, this should clear that up for you. The join was always working, i just referenced a column that doesnt exist in your db to sort with.…

Nice, my client and I smashed our heads against the wall for a full day before we gave up on this. None of us had the linux background to figure out why it didnt work as instructed.

And technically you don't have to append the custom properties if you pull the URI from the customproperties table. Thats always my preferred method, always grab the uri from the table I want to update instead of modifying the strings and hoping I didn't introduce a typo or misplace it.

It just crossed my mind, to try and get some more visibility into the downstream impact of an outage I could probably build a SQL selection for the alert message to tell how many downstream nodes that have the downed node as a parent. When I get off this plane I will have a go at it.

The meraki api is actually pretty trash tier. There are management functions built into it but almost no metrics are available to be inserted into any other tools. All the things people keep asking for are 100% not exposed to anything except their internal systems. Their model is pretty clearly to build a pretty dope…

tdanner had suggested in the past that you can do 0+yourvalue to get around the lack of casting in SWQL SWQL Query Integer Conversion

Looked it up at the PA documentation Palo Alto Networks Knowledgebase: Brute Force Signature and Related Trigger Conditions If a session has the same source and same destination but triggers our child signature, 31753, 20 times in 60 seconds, we call it is a brute force attack.The child signature, 31753, is looking for…

Didn't test it, but maybe something like this would work?

To be honest there is nothing Solarwinds specific about how you recover the database. Take it offline, try the built in repair functions in SQL Server. They often don't work so then you end up deciding what the risk level is to just dumping the data from whatever table houses the corrupted entries. I'd be worried if it was…

There is a built in alert for that called High Physical Memory Utilization with Top 10 Processes, check it out on your system

That screenshot is from under the browse components section in sam settings, it has not changed. Thread count is just a standard windows perfmon counter.

Maybe have a slower timer on your escalation? How fast is your reset condition? The escalation will not happen if the alert has reset already, but if your alert is only running once every 5 minutes or requires the reset condition to be true for a while I could see how the escalation would proceed even after the node is…

In the GUI you can always just go to the Message Center and see alert resets or triggers like so, But I find that I prefer to roll my own custom query stuff for them because I like things the way I like them and I'm sure there are probably lots of ways to accomplish this request but these are the ones I use. I've posted…

Try this one, go to the reporting tool and try using the below as a custom SQL data source then build the report as you normally would. SELECT top 20 *FROM [dbo].[VolumesForecastCapacity] forecastjoin [dbo].[Volumes] vol on vol.volumeid=forecast.instanceidjoin [dbo].[Nodes] n on n.nodeid=vol.nodeidjoin…

Probably worth pointing out that the meraki integration was specifically for meraki wifi and hasn't been expanded to cover all their other product lines. Also the meraki API has been a very fast moving target over the last year so they've done a lot on their end to expand it. Still doesn't expose everything you might hope…

jrouviere​ is right, you have to pick apart what they want from you. In some environments where I have worked with clients on LEM their auditors were looking for periodic reports highlighting anomalies, along with some kind of indication that these reports were being reviewed and investigated within a specified time frame.…

You need to uninstall that module from your servers, that should do the job after the configuration wizard runs.