monitoringlife · Monitoring Engineer · ✭✭✭✭✭

Were you ever able to determine this?

aLTeReGo​ no stress at all. Thanks for the time and assistance looking into this!

I have been making a template with all the event log components I want, then crafting an alert for the application monitor status. In the alert test I include "${N=SwisEntity;M=ApplicationAlert.ComponentsWithProblemsFormatted}" to detail out all the components that are not healthy. Seems to cover most use cases for my…

Do status is not equal to 'up'. Depending on your environment you might need to exclude 'unknown'.

Do you have SAM licenses for App Insights for SQL? That has a deadlock component.

I am a little curious why there are different variables being displayed between trigger condition editor, and trigger action editor.

I also notice the menu will not load if your having any issue with SWIS (SolarWinds information service). There is a setting you might need to hit to enable the 'mega menu' after the upgrade. Check with support before doing this one as its in the advanced config.

I did a few tests and was only able to get it to populate on a few of my devices. I'll look around in the database but another glace at the variable explorer does not show interface. If you can add the circuit info as a custom property on the node, you can easily add this to the trigger action.

At 400 sites NetPath is not optimal. To add to David Smith's post, you can setup an alert for the BGP or route change alert to notify you if something happens at the site.

What version of SolarWinds are you running? Can screen capture the error your getting? Here is what it looks like for me in edit mode:

dgsmith80​ I agree that it looks like an issue with DB Maintenance. I suspect its during the roll-up of the table from detail to daily and there is a blank/null entry till the next polling interval. We tested moving the maintenance window forward and back an hour and the issue moved with it. I will look into custom…

Groups can have other groups be the parent dependency. Groups membership can be dynamic (query, custom property, etc.). With 1,000 locations I agree there is no easy solution. The only thing that comes to mind is using the API and leveraging your CMDB. We use our CMDB to populate custom properties, those properties are…

FQDN is not all that helpful so I pulled in the NodeName: SELECT N.NodeName, C.Node.Fqdn, UserName, Password, Owner FROM Cortex.Orion.WindowsCredential C Join Orion.Nodes N on C.nODE.NodeId = N.NodeID

No problem, glad it helped. Don't be to hard on yourself I did the same thing with leaving the SELECT and FROM in there, and often do when I copy it over from SQWL Studio

I'll let others weigh in on detecting the service restart, I didn't find anything. You can track alert actions by viewing alert history. Here is dashboard I use (sorry I don't remember the post to give proper credit to the creator): SELECT DISTINCT ahv.Name 'Alert Name' ,last24.Qty 'Last 24 Hrs' ,lastseven.Qty 'Last 7…

You can put the full message "${Message}" in the alert/email, or loop it into an external program to format it (what we are doing).

Any recommendations or things to focus on for us studying?

I would open a new thread as this question already has the answer set. But to get you started here is what I did:

I ran over the document and seem to be within threshold. I have two additional web servers and wish the document was more detailed. It does not get into determining users per AWS, only says to get an AWS if your over x users.

I would download SWQL studio. You don't need access to the database directly. I find it easier to work with SQWL studio because you almost never need to join tables.

I also get negative values, did you ever figure it out?

I am running into issues with TFTP on one of my APE (in HA). Did you ever get this resolved?

Is this the feature request your referring to? Log Analyzer - Allow searching for varbind name / value pair

My log database is 4,000MB. From my 'VMware Events': 37,000 events in the last 30 days (around 28,000 last month). Full disclosure I drop 'informational' events. Edit: I also have traps/syslog (which also goes into this DB now?) so take my total database size with a grain of salt.

I have been dropping 'informational' events as they are not actionable. 1. 2. 3.

You might also like this dashboard (sorry I don't remember the post to give proper credit to the creator) 'Custom SQWL Query' resource SELECT AccountID AS [NAME] ,CASE WHEN AccountType = 0 THEN 'Orion Service Account' WHEN AccountType = 1 THEN 'Local Orion' WHEN AccountType = 2 THEN 'AD Individual' WHEN AccountType = 3…

I wrote a ton of stuff but decided to move it to a feature request ( ). I don't want to detract from what KMSigma posted, as its unrelated to his original posts content.

serena​ Thanks for looking into this and raising the issue. Please feel free to reach out with a UI session if your team has any questions.

aLTeReGo​ Thanks for looking into this and replying with the existing feature request. It looks like the one you linked is marked as 'Implemented' with notes it was part of 'SAM 6.2'. The linked example is what were doing with 'Orion General Thresholds'.

For those wanting to use SQWL or the API Windows/WMI SELECT C.Node.Fqdn, UserName, Password, Owner FROM Cortex.Orion.WindowsCredential C SNMP SELECT N.NodeName, N.SNMPv3Credentials.Username, N.Community FROM orion.nodes N WHERE N.ObjectSubType != 'wmi'