mesverrum · Observability Architect · ✭✭✭✭✭

l expect you are correct with your guesses, nta most likely since it tries to resolve every address that was accessed by any flow record in your org.

If your devices support it this document outlines the relevant OIDs for retransmissions on Cisco gear. You'd just set up some UNDP for the info you need. https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/61860-fixTCPhang.html

I keep a bucket of code in my github on my signature and I know last week a few other MVP's were talking about setting up a repo but I'm not sure that it's in effect yet. In the mean time this thwack post also has a pretty solid collection…

He made it web based, nothing to download anymore. https://contactgray.co.uk/gsock/

Are you by chance doing discover by scanning AD groups? From what I have observed in the past, if you manually do a discovery and enter an IP address it gets added as a static IP, dynamic is unchecked. If you enter a hostname it will show up with the dynamic box checked. AD scans use hostnames as well.

This article goes over it, basically the same process since almost a decade ago Custom Maps for Group Details Page

Nope, the F5 integration is basically set up as an all of nothing type of deal. And since there are no custom properties for the F5 objects you can't add a tag for example to say "alert on only these and ignore those." You have rely on things like filtering against the naming conventions and such in the F5. Most F5 admins…

No, real time performance analysis is a user setting, but the feature in general cannot be removed. Unless you want to get fancy and create your own custom version of that widget with javascript, but then I'm not sure how you would handle optionally adding/ removing links based on the user unless you get really deep in the…

Nope, eoc maps were just a slightly changed version of Atlas.

Kiwis is a tool from a much older era, they dont expose a searchable api like that. Depending how you install it you might not even have a real database underneath it, the default is just an MS Access table. Assuming yours is installed with a legit DB like sql server or postgres I'd suspect querying those with your tool…

This might be useful as a reference, i don't really use escalations in my case but its a model for how to get around the alert history and related tables --report on alerts triggered select ac.Name ,ah.Message ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name] ,case When…

The event viewer is controlled in the user settings under SAM, are you an admin there?

I have successfully set up the HA failover to update my dns entry of the virtual hostname before, my biggest problem was usually questions around dns propagation and the fact that IIS remains active on the down server which can cause issues with people having literally cached addresses in their browser session.

Orion is not an general purpose event collector, they have some capabilities around receiving syslogs and snmp traps specifically but there is no generic http event collector in the platform.

Have you run an snmp walk on the 2110 to confirm that they respond to all the relevant hardware health oids? https://support.solarwinds.com/SuccessCenter/s/article/Hardware-health-OIDS?language=en_US

What kind of notes? Meta data about the reportv itself or node notes or alert notes or something else?

I ran it on mine and it worked fine for me exactly as written, takes a while to run though, maybe your are running into timeouts?

I just ran through a training program on ARM from one of the team who ran it before the buyout, and they mentioned there would be a conflict between running orion and arm on the same server due to the fact that they both use RabbitMQ.

Ughhhh that's going to put a cramp in my upgrade plans if they don't resolve it. That's one of our major use cases for SAM these days.

I run my environment in GCP, it's been there for about 2 years. About 9000 nodes right now. At the time we made the move Cloud SQL wasn't able to do MS SQL, it was only doing the more linux native styles so we stood up a instance of Server 2016 and installed SQL. Also hosts a couple other databases related to our team but…

I'd love to see a list of this too.

Probably best to just wait them out, the new tables use columnstore indexes and with the way they bundle up data you really don't want to be making inserts or deletes after the fact. Notably deleting a record from a column store just adds a tag in SQL that the data is "deleted" but doesnt even remove it from disk, so…

So to do what you describe you should add the column called Classifications to your table twice. The first one will act as the label, and the second one you hit the drop down for data aggregation and select count. Probably want to change the name of the second column as well while you are in there. You can see some…

You kind of hinted at a big issue right away, some of the reports are quite large so you don't know if it contains the data you need. What that tells me is there is too much fluff and distraction in the report. For example with my bandwidth utilization reports I have them filtered to only show me interfaces that match my…

This should work as a SWQL query, you will get at least 1 datapoint for every hour you polled that device. Another thing to watch out for is any timestamps older than the detailed retention period (7 days by default) will only have 1 poll per hour in the DB and after 30 days you would only have 1 data point per day stored.…

I cooked this SQL query up that looks like it would do the job for a custom SQL alert on the custom node table poller. It pulls the current status and timestamp from CustomPollerStatusTable, then looks at the historical CustomPollerStatistics table to find whatever data we have that came in between the current timestamp…

I imagine you won't get a whole lot of traction in discussing free traffic analyzers on the vendor's forum of a paid traffic analyzer tool. Since the other tools you mention are all pretty classic Linux stuff then the most typical free Linux-centric answer these days is going to be something like sending layer 3 flow data…

That's a legacy widget and unfortunately no replacement was added when they updated the syslogs a few versions back. If you search there was a thread on thwack where people created new versions using swql.

Basically it can't be done the way you want. You either use 1 template with lots of over rides, or you use two templates to cover two different scenarios. Creating over rides is not too hard to do via code if you have a look at the database and just insert some rows where the [key] = '__IsDisabled' and the value = 'true'…

Not entirely sure, but I can say I have seen the script components get pretty fussy about not seeing the line breaks it wanted, I had to manually inject some newlines into a powershell script before, maybe its getting choked on that? Also I don't see it pushing an exit code?