rharland2012

When you deleted the WMI-managed server from NPM, I assume you had to rebuild the SAM monitor as well. Correct?

What the 'hop' language here means - if I recall correctly - is the discovery process, when locating a router that responds to SNMP, will also attempt to discover assets connected to the interfaces of that router to a number of 'x' hops.

Ah, got it. Cool. Can you try something that sounds silly for me? Logout of Orion and back in as the domain admin account you used to install the agent. Are your results any different?

You don't? Well, okay. Thanks!

Excellent! Glad to be of assistance.

Is netflow enabled on all interfaces on this router? I've seen a condition where an interface not exporting can skew results as well. Craig's suggestions are right on - take a look there as well.

Okay, I have your answer. On the 'Discovery Settings' step of sonar discovery, do you see the hop count slider? You've got it set to 1, I'll bet. Set it to 0. If this works and you found it helpful/correct, please mark as such. Thanks.

Excellent!

Okay. The manual process of re-adding the nodes as WMI-managed objects worked normally - but didn't give you all the resources? If I've read this right, that's two separate issues. One, agent doesn't work. Two, even via WMI you're not getting all the info you need. Do I have this correct, or did I misunderstand?

!!!!!!!.....MIND BLOWN

Okay - looks good. There should also be some global Netflow commands on the router that I would verify if I was troubleshooting this on my own network. Can you verify with your network engineer what the settings are for these? ip flow-cache timeout active ip flow-cache timeout inactive

Petr, thanks. I verify what you're seeing. However, I can't possibly be the only customer that is attempting to poll processes with a command switch qualifier in SAM with a 2008R2 target box. Support's advice is to contact MS if SNMP agent reinstall doesn't fix it (which it certainly doesn't sound like it will).

Stay patient - just trying to help you here, Andrew. If it were me trying to better identify this traffic, I would increase the sampling and port monitoring. With sFlow, the load is not invasive - and I use Procurves with all ports monitored in some instances with no hiccups. Based on your descriptions of your remote…

No problem at all! Glad I could assist. It's a real shame - especially since this is a code issue only! If it was just the limitation to a single exporter, I wouldn't mind at all. The inability to simply configure it via the CLI easily as with the 54xx series and others is the sore spot in my opinion.

Got it, cool. Historically, I only run SNMP scans. Let's do one more test with our small subnet. Edit the discovery to not look at ICMP stuff and see if the discovery completes more quickly.

Characterized by their fondness for tea, frowning, and constantly hassling all of the fun people, grownups are a rapidly-growing minority that really can bum everyone else out.

No you should NOT keep your opinion to yourself.....you're vetted in this 'basic' user's book!

I did open a case and Petr's method was their recommendation. All's working now. Thank you.

So after you deleted these nodes from Orion completely and then ran a network discovery specifically to rediscover them, they couldn't be found via discovery?

Understood. A good start may be to check the latest VMAN KBs @ http://knowledgebase.solarwinds.com/kb/categories/Virtualization+Manager+%28VMan%29/?CMPSource=THW&CMP=DIRECT Also, are you polling the host/cluster nodes directly in addition to importation of VMAN info?

Excellent points! Now THERE's a feature request - and as you said, probably much more doable.

Are you positive that those subnets are seeing broadcast traffic? Are all ports being monitored for flows?

Yes, all instances are running under the same account. We're using SNMP. It's been isolated to an SNMP problem, as a WMI poll will return successfully for the problem instances. Working with support and will update when I get this resolved.

Thank you. So you're expecting performance improvements for NTA under SQL 2016 - nice.

Found out what was going on......some functions *were* moved off this server back in September and two CPUs were indeed removed. Thank you for the assistance in investigating this!

It's cool - I didn't intend to ask you for a link, sir. All set.

The closest I could get was to use the DeviceID variable, since UDT uses different variables than NPM for some things. However, the DeviceID variable just reports a number - not a name. The alert email looks like this: A new MAC address was found on node 18 Not exactly useful, that. If you get a satisfactory conclusion,…

Pre-NCM, how did you typically download your configs? TFTP?

Thanks for that info! Was your server a combo web/poller box, or were these separate entities for you?

First time in my life.... Thank you!