mesverrum · Observability Architect · ✭✭✭✭✭

If licenses are tight this template might be helpful https://thwack.solarwinds.com/t5/SAM-Discussions/Check-All-Services-Which-Set-To-Automatic-Mode-Are-Running/td-p/330187 Instead of 1 license per service it uses 1 license to cover all auto start services. It could be edited to just cover the Orion related services if you…

I haven't tried it, but if it was me I'd be checking the db to see what changes when I uncheck that box and then write a script that does that in bulk. It might be as simple as setting dhcp = false but I'd want to test it out to be sure, could have extra steps that I'm not aware of

Most likely it will just show up as java.exe, so you would just set up an snmp process monitor for that name. If there's multiple java processes on that server you'd need to add command line filters to specify which instance of java is associated with that app.

l expect you are correct with your guesses, nta most likely since it tries to resolve every address that was accessed by any flow record in your org.

If your devices support it this document outlines the relevant OIDs for retransmissions on Cisco gear. You'd just set up some UNDP for the info you need. https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/61860-fixTCPhang.html

I keep a bucket of code in my github on my signature and I know last week a few other MVP's were talking about setting up a repo but I'm not sure that it's in effect yet. In the mean time this thwack post also has a pretty solid collection…

He made it web based, nothing to download anymore. https://contactgray.co.uk/gsock/

Are you by chance doing discover by scanning AD groups? From what I have observed in the past, if you manually do a discovery and enter an IP address it gets added as a static IP, dynamic is unchecked. If you enter a hostname it will show up with the dynamic box checked. AD scans use hostnames as well.

This article goes over it, basically the same process since almost a decade ago Custom Maps for Group Details Page

Nope, the F5 integration is basically set up as an all of nothing type of deal. And since there are no custom properties for the F5 objects you can't add a tag for example to say "alert on only these and ignore those." You have rely on things like filtering against the naming conventions and such in the F5. Most F5 admins…

No, real time performance analysis is a user setting, but the feature in general cannot be removed. Unless you want to get fancy and create your own custom version of that widget with javascript, but then I'm not sure how you would handle optionally adding/ removing links based on the user unless you get really deep in the…

Nope, eoc maps were just a slightly changed version of Atlas.

Kiwis is a tool from a much older era, they dont expose a searchable api like that. Depending how you install it you might not even have a real database underneath it, the default is just an MS Access table. Assuming yours is installed with a legit DB like sql server or postgres I'd suspect querying those with your tool…

This might be useful as a reference, i don't really use escalations in my case but its a model for how to get around the alert history and related tables --report on alerts triggered select ac.Name ,ah.Message ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name] ,case When…

The event viewer is controlled in the user settings under SAM, are you an admin there?

I have successfully set up the HA failover to update my dns entry of the virtual hostname before, my biggest problem was usually questions around dns propagation and the fact that IIS remains active on the down server which can cause issues with people having literally cached addresses in their browser session.

Orion is not an general purpose event collector, they have some capabilities around receiving syslogs and snmp traps specifically but there is no generic http event collector in the platform.

Have you run an snmp walk on the 2110 to confirm that they respond to all the relevant hardware health oids? https://support.solarwinds.com/SuccessCenter/s/article/Hardware-health-OIDS?language=en_US

What kind of notes? Meta data about the reportv itself or node notes or alert notes or something else?

I ran it on mine and it worked fine for me exactly as written, takes a while to run though, maybe your are running into timeouts?

I just ran through a training program on ARM from one of the team who ran it before the buyout, and they mentioned there would be a conflict between running orion and arm on the same server due to the fact that they both use RabbitMQ.

Ughhhh that's going to put a cramp in my upgrade plans if they don't resolve it. That's one of our major use cases for SAM these days.

I run my environment in GCP, it's been there for about 2 years. About 9000 nodes right now. At the time we made the move Cloud SQL wasn't able to do MS SQL, it was only doing the more linux native styles so we stood up a instance of Server 2016 and installed SQL. Also hosts a couple other databases related to our team but…

I'd love to see a list of this too.

Probably best to just wait them out, the new tables use columnstore indexes and with the way they bundle up data you really don't want to be making inserts or deletes after the fact. Notably deleting a record from a column store just adds a tag in SQL that the data is "deleted" but doesnt even remove it from disk, so…

So to do what you describe you should add the column called Classifications to your table twice. The first one will act as the label, and the second one you hit the drop down for data aggregation and select count. Probably want to change the name of the second column as well while you are in there. You can see some…

You kind of hinted at a big issue right away, some of the reports are quite large so you don't know if it contains the data you need. What that tells me is there is too much fluff and distraction in the report. For example with my bandwidth utilization reports I have them filtered to only show me interfaces that match my…

This should work as a SWQL query, you will get at least 1 datapoint for every hour you polled that device. Another thing to watch out for is any timestamps older than the detailed retention period (7 days by default) will only have 1 poll per hour in the DB and after 30 days you would only have 1 data point per day stored.…

I cooked this SQL query up that looks like it would do the job for a custom SQL alert on the custom node table poller. It pulls the current status and timestamp from CustomPollerStatusTable, then looks at the historical CustomPollerStatistics table to find whatever data we have that came in between the current timestamp…

I imagine you won't get a whole lot of traction in discussing free traffic analyzers on the vendor's forum of a paid traffic analyzer tool. Since the other tools you mention are all pretty classic Linux stuff then the most typical free Linux-centric answer these days is going to be something like sending layer 3 flow data…