ms52390

I am shocked that this doesn't have more votes. How to people formulate meaningful reports when off business hours can so severely skew metrics?

Your guess of my script is correct. 1. Made the change. 2. Yes, WinRM is set. 3. I think this showed me the problem. A quick whoamI in the script revealed that SW was executing with the local system account. I believe I read this in other threads yet still missed it, my apologies. If I could mark all your answers to this…

Thanks, I tried this: \\servername\C$\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "C:\Scripts\swpstest.ps1 '${N=SwisEntity;M=Caption}'" and \\servername\C$\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "C:\Scripts\swpstest.ps1 -ComputerName '${N=SwisEntity;M=Caption}'" unfortunately…

Thank god its Friday....my issue all along was that i was using the test feature not knowing it doesn't run a test against the trigger conditions. I would make changes then run the test on a particular node expecting certain results and not getting them. I set my conditions back to my first example and enabled the alert,…

Hmm, actually I am not. SWQL Studio I am using my creds, local admin on the server. PowerShell is using a service account, also local admin. DOH...I figured it out. The service account has a view limitation of just that single node it was returning above . Sorry for totally wasting your time haha. I appreciate the help…

I see what your saying. Basically I want the alert to look like this: Alert if any of these occur: Hardware Sensor Original Status = Degraded Hardware Sensor Original Status = Failed Hardware sensor status = Critical Hardware sensor status = Warning AND Don't alert if the following occur: Node name = blur AND Hardware type…

I did have some NULL values for a handful of nodes regarding my "device_type" custom property. I cleaned those up and will retest my alert. I do not think this was the cause though as I have many other alerts that use a different "device_type" category, and alert just fine. 

So I actually tested this by commenting out the entire script just leaving the parts to grab the parameter: param( [string]$machine ) #$CustObj = @() #Enter-PSSession -ComputerName $machine #$HighProcPids = Get-WmiObject Win32_PerfFormattedData_PerfProc_Process -ComputerName $machine | ?{(($_.percentprocessortime -ne 0)…

Haha yea, I really like what you did with that rule I might have to duplicate that and give it a test. I feel it would be nice if LEM had a rule/action that triggered when the agent enters a "offline" state and simply just attempted at a restart of the agent's service (kind of like the MSSQL service restart rule). This…

No I am not acknowledging it. But I left the alert enabled over night and did get some later alerts so it appears to be working now I guess haha. mharvey and janene16 thank you for the assistance, I really appreciate it!

SELECT NodeID FROM Orion.Nodes: '890' (NodeID for that one node showing above) SWQL Studio: SELECT Uri FROM Orion.Nodes -Returns a bunch of nodes SELECT NodeID FROM Orion.Nodes -Returns a bunch of nodes So, direct query works. My issue is something with the PowerShell snap in? Or perhaps the SDK itself?

Here is how I set it. Even with this setup, it still only spits out emails to me once, shortly after I change and save the alert. Any other ideas?

Up Voted. Thank you for the response curtisi and Nicole!

So this is what I have now. With this configuration, like you said...sends thousands of alerts. Isn't it due to my node name=blurred and my hardware type=fan not being linked together?

Orion Platform 2015.1.2 and SAM v6.2.1

Thank you for the response. I have read that article but for some reason continue to get something wrong on the script side. Should I be assigning a variable to ${NodeName}? Or using one of my parameter methods above?

That crazy rule is pretty sweet, I like how you made a work around. I was also going to look into using the Auditing policy in Windows and see if that could give me a solution. I am surprised that solarwinds doesn't have some kind of direct solution for this. If the agent's service is killed it renders auditing useless for…

After testing the alert, I am still seeing only two emails come in after I save the alert. I have cleaned up my NULL values in some of my nodes for that custom property; at this point I am out any other ideas.

I just tossed 0 in there for a value, but i have been trying all integers up to 10. My CPU load averages around 20-30% so It should fire an alert constantly until I do something to stop it. I only can get the alert to fire if I edit it and then save changes.

Jonathan, please see below for what my current config looks like. (I blurred out the Node Name for security reasons). When i test the alert against that said node it alerts me with a Fan alert with a status of Running.

Thanks for the info...that aside, wouldn't a query like that return the Uri data for all nodes vs just the one I am getting?

Any Idea how I can make a custom graph like that?

I did not realize this was available. Thank you!

janene16 Thank you for that suggestion, I originally had tried that as well. mharvey I think something else is going on. I have several nodes that fit into that "device_type" custom component with the type name containing "core". It fires twice, one email each for two separate nodes (after the alert is saved). It should…

How do I effectively insert a "and" type of condition in between Node name=blurred and hardware type=fan to tie them together?