netlogix

you could do a custom sql and use where Nodes.NodeID = <PUTORIONNODEIDHERE> and (select COUNT(*) from Nodes where nodes.Vendor = 'Cisco' and [Status] <> 1) > 4 and that should do what you want. Not very pretty, cause the alert is on the orion server (or some other node). Oh, if you don't put a node in there and just clear…

I had that issue once and had like 200+ days detailed statistics (instead of 14 days where I had it set) because the roll ups broke, look in "\ProgramData\Solarwinds\Logs\Orion\swdebugMaintenance.log" for "] Error ". Might not be your cause but that might be why the poller detail is so large.

I have a custom Property called StopAlerts and all my alert make sure StopAlerts <> 'Yes'. I saw someone else had N_Mute and did the same thing. When you un-manage, you don't poll any longer. If you want to disable all advanced alerts, either stop the service "SolarWindsAlertingEngine" or check the check box "Disable all…

Thank you, I have another application that I use for event log monitoring and have already added it to an email event. Also, I could convert it to syslog message and have a syslog alert on it, but I don't want to wait till the pool is already empty. I was hoping to find a counter that I could use to find servers that have…

If you add the users individual AD user, it takes preference over and AD group and still does the auto logon. As I stated above, you can also run "delete FROM [WebUserSettings] where AccountID = '<USERNAME>'" to force them to log off. Heck, you could truncate the entire table and all user preferences will be reset to…

From what I have seen it is an ordered operation, like a network access list. As soon as a match occurs, it gets that access. So if a user is part of the first group then he gets all the right given to the first group. But it first checks if a specific user is added directly, then orion never checks any group membership.…

There is the post I was trying to find, I couldn't find it, thank you byrona! I marked it as a favorite now.

python, did that work?

@Miron - "nobody seemed to care" - kinda like: There was an important job to be done and Everybody was sure that Somebody would do it. Anybody could have done it, but Nobody did it. Somebody got angry about that because it was Everybody's job. Everybody thought that Anybody could do it, but Nobody realized that Everybody…

I am also a SW customer and I have very few issues with my SW applications. They can take a bit of time to get everything the way you want, but I think it is worth it to be able to keep that good of an eye on hundreds of systems (some people even have thousands). My biggest issue was an OS problem. When running sfc, and…

will do.

I just chugged my way through it muttering under my breath the whole time, but after it was done, I haven't had to go back. I only had 50 sites, so you'd prolly end up cursing out loud by the time you get to site 130 or so. :(

I have RC and don't get false reboots anymore. I will say 10.1.2 fixed it.

Netflow may be the right answer, but I think byrona is on the right track. With the router (just because that is the worst choke point), are you monitoring it with SNMP? Can you see CPU statistics? (If not, and it is cisco, you can use "show proc cpu history") How is the processor at that time? (I had a 100mb circuit…

usually 514 UDP is syslog and 162 UDP is snmptrap, did it get mixed up?

what you could do is set multiple actions, one that fires every 20 minutes to call the tech till it get acknowledged, the second with an action that is delayed 60 minutes (third call) that calls tier 2 till it get acknowledged repeating x minutes, and the third that is delayed 60 + x * tier 2 iterations, etc. making sure…

One workaround you can do for netflows with a cisco router is set the source IP for the flows. I have it come from my loopback address "ip flow-export source Loopback0"

another possibility could be, if there is an interface for the dialer, then add that to orion, make it unplugable and set up an alert for when interface name = dialer and is up and reset when not true. I don't have any dialer interfaces, so i can't test this.

that should work. What do you get when you use just Select ServiceTag from APM_HardwareAlertData where NodeId = ${NodeId} then putting it in a SQL Server Manager query window?

are you using a HTML email (You changed the inner { / } to @ which is right for HTML emails only. What do you get if you use "Select ServiceTag from APM_HardwareAlertData where NodeId = ${NodeId}", then copy/paste that into a SQL query editor, what do you get there? If you get nothing, then that information doesn't exist…

That should work in any alert, I pull all sorts of data through the ${SQL: ... }, even info from other database locally or through linked servers.

isn't 137 a name resolution protocol? Could something be trying to resolve the ip to a name?

I don't think the issue on this is anything that Solarwinds can fix. It is a IIS issue. If IIS won't authenticate the User, the NPM can't piggy back on that. Get IIS to auth the user and you should be good to go.

Can I ask for this as a feature enhancement? It would be very nice if we could get data any data out of the database - note.name node.customproperty1 Or you could give us the ability to give monitors custom properties and then we could use them in scripts... or alerts.

oh, woa! APM can exist without NPM with version 4! I was looking through this forum to see what I should expect with my upgrade to 4, and I found out APM can work without NPM now! I wouldn't do that though if you have NPM already. I don't know what you would need to do to combine the databases back together... or the…

10.4 beta is running now and moving the custom properties editing is part of it.

The node, is it the ESX/ESXi server? Or a guest? Have you looked at any of the charts in vCenter? If it was an ESX/i node, then maybe some heavy server v-Mo'd off that Node to a different one. Did you recently apply any ESX/i patches?

I have the same need for an MFA use. If page contains "Father's Middle Name", type in text box "April", if page Contains, "Mother's Middle Name", type in text box "Carl", etc. Fortunately my app currently allow the same answer, but I have a feeling auditors will see this and have it restricted to not allow the same answer.

NPM doesn't auto update the Caption, there is a DNS name and system name fields, are those what you expect?

Also check to see is anything else is listening on UDP 161 (Kiwi syslog, NCM syslog, some other syslog service, etc)