mesverrum · Observability Architect · ✭✭✭✭✭

Since you aren't getting many bites specifically in Orion you'll probably have to just adapt an example from any other rest API Posting JSON to a restful API with vbscript - ThomasCremers The closest orion specific thing I could find to the vbscript style is probably this perl script sample. OrionSDK/query.pl at master ·…

Unfortunately not able to work in SolarWinds NTA if you don't poll the device with SNMP and if you don't have the relevant interfaces monitored because NTA uses the SNMP interface index to correlate flow data to an object. With that said, you can cut down the amount of data you collect with SNMP by turning off the various…

I wish...

I did it in sql for a client before, since it was a one time deal it could likely be optimized and will likely need some evaluation for false positives and such, but it gives you a starting point. It checks for references to the CP in the alert configurations, alert actions, group definitions, account or view limitations,…

If you want an off the shelf solution SolarWinds sells Enterprise Operations Console as a platform for viewing data across multiple Orion instances. On the other hand if you want to roll your own answer then Orion has a pretty robust API, but it's very different from typical API's in that it is really just an abstraction…

As far as iseries goes SolarWinds supports SNMP to collect some very high level system resource metrics, and essentially for anything else you have SSH where you would hopefully be able to figure out how to pull what you need from the command line. There are third party companies who sell a modified version of net-snmp for…

In SQL turning a single row of data into multiple rows is a bit tricky, and SWQL is even more limited. You could probably do something with a UNION. Can you post the query you have now to make it easier to give a concrete example?

The Orion API has verbs currently for the following actions, I haven't personally played with them much but it looks like they can handle the typical use cases. I have found that I normally don't really need to mess with it because every client I ever worked with does an AD integration and just sets up perms based on AD…

I don't recall ever seeing anything visible in the Orion UI that shows that info, but that does sound like a good feature request, i just went ahead and made the FR if you want to vote it up.…

Ipfix sends template packets periodically so you maybe could capture a wireshark sample and spot them there, I haven't grabbed on of those in a few years though. https://www.plixer.com/blog/understanding-netflow-and-ipfix-templates/

Apm componentsettings or apm component template settings

That looks perfectly valid, to be sure when you say SWSQL tool you mean swql Studio right? Not the solarwind database manager.

If the installer was set as the sam only poller at the beginning then don't mess with services it says to install. Don't worry about what you think it should or should not do, just do what the installer says.

Usually that's a clue that something is wrong with your polling engine or the creds you are using to poll the device. Does that node actually show current cpu info and such?

Yes you will get a duplicate of the data for each device that reports traffic on any summary or aggregate page. Solarwinds makes no attempt to dedupe the raw data. When viewing inside NTA you almost always will be filtering down to a specific node or interface any time you want to avoid seeing duplicate data. As far as…

Seen this in a couple environments, that widget doesn't seem to be spreading the bits out correctly. You'll see that it is 0 % then every 9 minutes it jumps to whatever. What it should be doing is averaging out the bits across 9 minutes. So if it says you were at 300% on 100 mbps then really you averaged about 33% across…

Solarwind npm stands for network performance monitor, this forum has nothing to do with node.js. Totally different stuff.

In order to avoid self recursing groups they don't let you automatically add groups to other groups. You could build such an automation using the API but they explicitly decided not to make it a built in capability.

Also, I just tried it out a few ways myself and it seems like the syntax they have in the SAM SQL syntax help must not be correct because I could get it to load without syntax errors using their recommendations (pe.AvgPercentCPU) but it wouldnt match any of my components in my environment, even when i did things that…

Curious what they are intending to collect. Splunk itself can process raw flow data the same at NTA does but maybe they are trying to have Orion do the bulk ingestion and then only push some specific event data to Splunk to save on costs?

I'm just going to jump in here and point out that increasing this value to 1 year is going to kill the performance of your Orion server unless you have the most minimal of incoming syslog data. NPM's syslog capabilities are not set up with the intention of acting as a long term repository of syslog data or for very chatty…

It's a good challenge to set up a monitoring platform for an environment of that size. Make sure you review the architecture and scalability docs and don't try to skimp out on your database server, that's by far the most important part of the infra. Once you get your system installed I think the first order of business is…

My environment is 100% in GCP. 10 APE's, 4 web servers. Those decisions were made way above my pay grade and we had to lift and shift everything 2 years ago. Everything is about as fast as it ever was so that's nice, initially it was costing a pretty significant chunk but we've managed to get our billing down to around…

I dug through my pile of old SWQL queries and came across this one that looks like it should help. SELECT top 100 tolocal(TimeStamp) as Timestamp , cs.Component.Application.Node.Caption , cs.Component.Application.Name , cs.Component.Name , cs.Component.DetailsUrl as [_linkfor_Name] , cs.DynamicEvidence.ColumnLabel as Label…

Last I heard you can use the API integration to get the Health checks, but nothing about iRules was being pulled across natively out of the box. If you want to get fancy and have SAM it's probably possible to cook up a solution with a script monitor or maybe with the newer API pollers.

For a query like that you can also do this to save some miles on your keyboard IsTest = 'False' and IsWorkstation = 'False' and MachineType <> 'VMware ESX Server' and ISNULL(DevicePurpose,'') <> 'UPS'

Try using the legacy charts, i don't think perfstack based charts allow us as much control of how they show up.

There is a join from the nodes to the events table, so my first guess would be that your nodes have been down so long that their down event has aged out of the events table, 30 days is the default for that. Based on that specific edge case I went ahead and rewrote the query I usually use for that kind of outage duration…

Assuming the routes aren't still on the network gear itself then just go to active alert and manually clear it. I don't remember what the reset condition should have been but it probably should have been something like reset after 24 hours if you don't want to manually clear them.

Yeah, the key words to look for in the gui for that kind of thing is cpu multi, that's where they store the per cpu metrics. You probably also need to update your web console settings to allow charts to display at least 32 items to get them all on the chart.