mrxinu

Did you run the inventory job? I believe that's where this information comes from. -- Steven W. Klassen Programmer Analyst @ Loop1 Systems http://www.loop1systems.com/ http://www.linkedin.com/in/mrxinu

Y-yeah, what Quang said. =)

That's interesting - it looks like that particular package is flailing. Is it always for Microsoft Lightswitch or does the software package vary?

JOIN and INNER JOIN are the same thing. It would be chaotic if it defaulted to a LEFT JOIN.

Count me in for confused. I see a report but reverse-engineering it in my head so I can figure out where you made a wrong turn is making my eyes cross. Let's start with a screenshot of the poller configuration (with the 'advanced' tab expanded), and the report definition you're working with now.

As for the different thresholds, if you're given 10 logs directories, how do you determine which are too big? Is there a maximum reasonable size per directory or customer? P.S. I realize all the questions seem laborious but I promise that once they're all nailed down codifying the logic goes quickly.

Having one part of the path be dynamic isn't an issue but blindly searching for directories named "logs" (too generic) would be messy if there were other log directories that didn't have the things we were looking for. Not impossible, mind you, we could always peek into each log directory we find to make sure it has things…

Do you happen to have a list of all the possible path configurations?

When a node doesn't respond to a ping it goes into "fast polling mode" where it checks the node more frequently than the configured polling period (default: 120 seconds). You can't change the "fast polling" rate, but you can change how long it does the "fast polling" before it registers as actually being down.

The nice thing about using SWQL is we don't have to rely on JOINs if there's a linking property. SELECT N.Caption, COUNT(N.Interfaces.InterfaceID) AS Num_Ints FROM Orion.Nodes N GROUP BY N.Caption ORDER BY N.Caption This also has the bug undocumented feature of behaving like a LEFT JOIN, including a 0 count for interfaces…

Once the template has been created and is applied to the node then your blanket "Alert Me When a Component is Down" alert should catch it. If you want to actually remediate the issue you could do it in the script that runs the check but I'd then adjust the template to run less frequently than the default 300s (5 minutes)…

It's a component, not a template. So you'd want to go to Settings > SAM Settings > Create New Template. Add a new component and choose Linux/Unix Script from the list. In the script you have to have a numeric statistic (even if you're not using it) and an exit code (0 = Up, 1 = Down). Change the command to ${SCRIPT} so it…

That's a brilliant solution. Both of them.

Ah, they moved the code to its own repository so you could load it with pip. Here's the new link to the python stuff: GitHub - solarwinds/orionsdk-python: Python client for interacting with the SolarWinds Orion API

You idea about a supression rule is your best bet provided your "fragile" systems are all behind at least one common device, i.e Router or Switch. Looking to see if an upstream device is very effective. Agreed. If he has a single point of failure that would be great.

Here you go. I created the Bitlocker_Enabled custom property in my environment to test. This goes through and sets the first 10 volumes (ordered by VolumeID) to true if they aren't already. Import-Module SwisPowerShell $hostname = "localhost" $swis = Connect-Swis -Hostname $hostname -Trusted # get the first 10 volumes from…

Wild guess. Is 'ServerStatus' a node custom property maybe? -- Steven W. Klassen Programmer Analyst @ Loop1 Systems http://www.loop1systems.com/ http://www.linkedin.com/in/mrxinu

Can you move the thread over to the Report Lab?

You can be more surgical about the firewall, too. I think it's 'esxcfg-firewall -e snmpd' or something similar. Check out the options for esxcfg-firewall.

Hey Ritika, Two things - first, the test button on the advanced alert manager only tests the actions, not the trigger. If you configured it to write to the NetPerfmon Event Log and send an email it'll do exactly that, exactly once. Second, if you meant for the reference to the parent thread to be a link where I can read…

These other files are related to netflow if I remember correctly. You don't want to delete any of those (They aren't just old versions or backups of the main NetPerfMon database) or if you move to another server you are going to want them also. Exactly. They spread the tables out into separate files to get a handle on…

Taking the next wild stab - try changing the user that runs your alert engine to the same that's able to run that command successfully.

You're welcome. I didn't quite understand the bit about "disk volume giff" but you can use 'VolumeType is equal to Fixed Disk' in order to make sure you're getting what you typically think of as a disk volume instead of memory.

Thanks Marie!

As a follow-up, the issue he was seeing cleared when we disabled a transaction that was having issues reaching an internal site. The first series of steps logs into a local web proxy which should allow the access (and did, when the transaction was first recorded). We disabled the transaction, noted the errors had stopped,…

Fix your signature, Morgolis. *bonk*

That would just create individual alerts on the down nodes, right? It doesn't cover the requirement of ">= 50% of the nodes are down"?

I read through it. I'm not seeing any more detail aside from what they're called: "Whereas properties that are inherited are display as green cubes:"

Yes, what said: how are you getting the swap space? Once we know that we can help you tie the rest together.

200 alerts in 24 hour period. I don't know if this is high number or not. Seems high. Anyone have an idea what kind of rate they are running? (number nodes = 1575) I guess it would depend on the number/type of alerts. If everything's quiet, I wouldn't expect any alerts to be going off. If you've got some turbulence in your…