njoylif ✭✭✭✭✭

when I wrote this report, I had the raw statistics being saved for 7 days, which means the stats were averaged into 5 min intervals (my understanding of 5 min stat polling interval of router and how the system crunches that info). If your settings are to compress raw after an hour or day, then it would be based on 15 min…

awesome, glad to hear. Great Job.

depending on your IP Scheme, you might be able to filter based on that and just create alerts per IP super/sub nets...something like that.

nothing in the <a href .....> section will show up. if you click on the "Documents:" though, that should take you to your original link "\\shared\drive\path\etc" look at W3Schools Online Web Tutorials This is a great place to quickly get html running. look at linking sections for this type of link.

great, and thanks for posting results!

I'm running 10.1.1 sp1. Basically, if I start syslog service in Orion and point my main firewall to it, my Orion infrastructure suffers. I'll start getting missed polls, web response time goes up even though no one is hitting the primary NPM web and it is not polling ANYTHING. I have 2 addt'l web servers that are load…

SW, can you please update the docs (or post here) to include specifically what the functions of the field formatting tab does -> more specifically in my case, if numeric data is selected -> what are my options for format string? I've tried * and / and using macros, documentation would be good so I know what I can do. I'd…

had to read original again... As long as all your pollers are reporting to the same DB instance of NPM, and all reports are on all servers (especially on the primary NPM server where the report writer is), then the report just hits the DB and all information should be available, same for the web resource report.

here are basically the ones I created: here is a link on how to create them: hope that helps

That's an excellent site. I didn't know that part was there! Thanks Mark.

no worries; they said to offload the syslog collector and put an agent on that server. This would reduce the overhead on the LEM, give you your raw logging retention for compliance (if a concern) and allow LEM to only get in the "massaged" alerting info or whatever subset of info it gets. I'm waiting for our syslog server…

I LOVE the RSS feeds, I pull them into a local folder and it allows me to keep up with thwack forums very quickly and efficiently! let me know if you have any questions.

This is what I've done in the past to test new versions RCs and betas without having to re-add a bunch of junk. then I just delete a good bit of the environment if needed for load. keep it on the same DATABASE SERVER but copy to different name like NetPerfMonBETA or something. you can not have two implementations talking…

such is life. If I want it bad enough, I'll keep uncompressed for 15 min as you initially stated rather than 4 hours and just be 15 min delay. I know the SQL Query for that. Thanks for the responses!

Thank you derhally I thought I read somewhere that the user that does the encryption is the only one that can decrypt that; do you know if that's correct?...I didn't get a good sense of it from that article. I'll test this...we will be using service accounts, so may have to dance around security to be able to log in as…

Awesome, thanks for the efforts Diner​

Brandon, did this make 10? if not, where does this fall on the roadmap? I'd be looking for changes in color on the link line for the different status options... see attached. thanks much!

thanks for response. I figured...

I think, basically, you'd use concat...see below CONCAT('https://[your URL]/Orion/',${NodeID},'/Orion/View.aspx?NetObject=N:',${[objectID macro]}) as DetailsURL

worked like a champ for me too for apps...specifically SSL Cert check apps... ,'/Orion/APM/ApplicationDetails.aspx?NetObject=AA:'+CAST(a.id as varchar(32)) as 'DetailsURL'

That wouldn't do it for our purposes because these are "head end" devices connecting many tunnels/remotes into our extranet. thanks though.

yea, that sounds like it would do the job! thanks

I think this has to be done with custom SQL, based on what you wanted...because you have to join the two tables to get the poller name. If you just wanted a report that had nodes assigned to the engineID, you could do it via gui as the nodes table has that assignment in there. But, then, that's not very user friendly :)…

I've always imagined the thwack theme song to be Stricken by Disturbed, most especially the part where he chants "oooaah ah ah ah ah". just put thwack streached out there. 

I personally like the single installer MUCH better, just need to know that is the one install to run on the addt'l web engines too (or addt'l pollers) as appropriate. thanks!

anyone open a ticket on this? I just had happen and wanted to ensure SW had tracking ability

odd. Thanks for checking it out! I knew there was more than the one.

assuming interface based resource... Status<>10 or interfaces.status<>10

I'd recommend reviewing the SDK (SWQL/SWIS) schema documentation on github We need to start with the context of the alert (I'm going to assume the trigger is based off VIM_Hosts table) so you'd go to that section of the schema and look at the bottom section that has links to other schemas...there is one called "Node" that…

Personally, I've resorted to using filters on the top 10 pages. My example is firewall interfaces showing ACL denys as discarded packets so Millions of drops - thus, firewall interfaces were all that would ever show up and that was expected behavior. For this, I went low-tech and enter criteria in Filter Interfaces. click…