mesverrum · Observability Architect · ✭✭✭✭✭

There was a previous thread where he asked for help building a report auditing logins to orion, I'd assume this is the next phase of that inquiry. Who is in orion and where did they come from

Sounds like it, but the are no pollers for Sam apps. When you create an app it creates all the components, and I checked the db and see roughly what I would expect there for wmi counters and such, but it seems like it never actually kicks off the real initial poll until you edit it. I think the verb is missing something…

Yep, basically vman adds all the datastore capabilities and forecasting, basic host metrics is already considered to be a feature of NPM/SAM

From my experience it is a bit vague because the workloads can vary pretty dramatically when you are running quad stacked pollers. I've definitely worked with clients who heavily use stacking and they were using 24 cpu/32 gb ram and had lots of capacity to spare, but your environment and needs may vary.

I definitely have run into it in the past. It was at least a year ago so I don't remember the exact details but I remember we spent a ton of time snmpwalking different Juniper models before we pinned down which oid's we were missing and I believe we were able to rig up a solution that was good enough for the client at the…

I assume they already told you, but I also want to point out that the official recommendation is for the db, app server, and all polling engines to be set to the same time zone or else you will have serious problems correlating data and events.

A major point I see people messing up is that groups only inherit up/down status, so something going critical will not impact the group statuses at all. Just to keep in mind as you build out your monitors.

Check the inetpub folder of the server that hosts your website and confirm that there are icons at the default path /Orion/images/StatusIcons/Small-Unknown.gif Maybe some kind of proxy/content filter/iis trickery you guys have set up that would be stopping you from loading them.

This is one of my queries that should get you in the right direction. I avoid using agents when possible due to these same issues but now that I think about it this wouldnt need much changed to get what you are looking for. Agents probably won't populate the credential stuff correctly but who I can't confirm that right…

In addition to that query (glad to see something I posted out in the wild) you can also use the new custom tiles resource and apply a filter to the tile. And to show something with an actual alert on it

you cannot use wildcards with != in sql, you should do relatednodecaption not like 'usxxx%'

From what you describe of the message you are getting it sounds to me like the $log variable is empty when your email goes out. If i were troubleshooting this I would launch powershell.exe under the same account you use for solarwinds, then try and execute these bits of the commands from the script $computer = 'caption of…

^ this, nodes don't have MAC addresses, network interfaces do, as they are a part of the networking protocol. Sometimes people treat a device as having only one MAC because in a simple sense a workstation often only has 1 network port built into it so it only has 1 MAC, but most servers have multiple nics, and at the…

I know I had one client who was setting that AD proxy up while i was working with them. He had said he got it working as far as a POC but I never sat down with him to see all the details.

You could get a reasonably clean result using UNIONS for each category of objects we want to add to the report. This one works in the the custom query resource, I've posted it report before and I keep meaning to revisit it to improve it, but the technique is solid. SELECT n.caption as Node, '/netperfmon/images/vendors/' +…

Another method, if you don't want to waste lots of SAM licenses on this, would be to enable asset inventory on all your servers (which you probably want to do anyway) and then set up a custom report that lists out any server with contraband software installed on it. This wouldn't catch things that don't add themselves to…

I'd think the same, except it shouldn't be terribly difficult to programmatically set the IP as used as I hate to do anything manually. IPAM 4.9 API · solarwinds/OrionSDK Wiki · GitHub

Yeah, it's a pain point and has no easy solution because each type of component has really widely different situations that can cause them to display as critical, and nothing built in tracks them for us. So at this point the best that can be done is to build up a mess of SQL/SWQL to test for each scenario and basically say…

This is the SQL custom variable I wrote a while back to try to tackle this situation in my alert messages, it works for most of the "standard" component types but I haven't gone back to have it cover all the edge cases with the appinsights or components with multiple statistics. It could be more efficient but i didn't know…

I cannot tell you how often I have had to fuss around with scripts to realize that I'm either passing an array when I'm not supposed to, or passing a singular value when i need an array, or passing an array with 1 entry that powershell automatically converted to a singular.... The joys of code

This would only show UnDP based custom pollers, which typically represents a tiny fraction (in fact usually 0) of the OID's Orion is polling.

Looked into this, the multiple object chart does actually work if you add the volumes themselves as members of the group, but doing that is clunky and too much work. So I wrote a custom swql query that you can use in the Custom Chart tool that works much better. Don't need to add the volumes to the group, it will…

Okay so I had time to sit down and play with this one to get it working select ((select count(recordtime)*100 as normallatency from orion.ipsla.jitteroperationresultshourly where avglatency <143 and operationinstanceid like 91)/(count(recordtime))) as Percent_Normalfrom orion.ipsla.jitteroperationresultshourly where…

Yeah I always write that alert with a volumetype contains 'fixed' because of the inconsistency between different vendors in how they report themselves.

I've been doing this for a few years now and never knew that page existed. I've always just trusted that the downloads I pull from the solarwinds customer portal were good to go.

Probably want to post your own question rather than commenting on a 9 year old thread. I'm not quite sure what you mean it will not read the space in your caption... do you mean you are trying to do a mid string wild card? I can imagine that the GUI wouldn't let you just drop a */%/_ inside the string but you could…

I've always been partial to this technique as well Automatic Dependencies Based On Custom Properties (Node Location)

You can go to swql studio and open up orion.views and there is a pink icon for a verb to clone view contents, right click that and invoke to pull up a gui for executing the verb. Give the viewid of the node details for asa site to site vpn tab as the source, add your new view as the destination, invoke. Problem solved.

Just to add on this, I typically discourage running the report tool and a machine that I'm trying to use for other work because it can bog things down terribly for hours while it generates reports. Hope your analysts are patient.

He's looking at the master db table, that is all generic sql server stuff. You need to be looking for a "catalog" like netperfmon or solarwindsorion, then there should be a dbo.nodes table with the bulk of what you are asking for.