rharland2012

I believe thwack was really chosen because it has no anagrams and cannot be re-engineered into NSFW catchphrases.

It's an acronym.

You can leverage Universal Device Pollers to get a richer set of information pulled from the UPS. Click on the 'Content Exchange' tab at the top of the Thwack page, choose Universal Device Pollers, and search for 'APC'. I think you'll find something you can populate your node details page with that will also allow you to…

Andrew, are you looking to see how much local broadcast traffic is occurring on that remote site's LAN, or looking to see how much broadcast traffic is coming out of the WAN pipe? In either case, you can start - if you want - by simply searching on a broadcast address as 'Endpoint IP' on your NTA dashboard.

Yes, it is possible. You'll have to enable netflow in the CLI, define your collector node (NTA box), and enable per-interface. Taken from Fortinet KB: Configuring the Netflow collector IP: config system netflow set collector-ip <ipv4_addr> set collector-port <port_int> end Enabling Netflow on the Interface: config system…

Has anyone deployed their gratis server sensor on a busier/production box? I'm trying to decide where I want the sensor to live to see how it really works and I was thinking SQL, but I don't want to impact performance on the box or have to reboot. Thanks for any info.

Rob, wanted to clarify here - do the core/1GB usage numbers apply to server and network sensors? In other words, if I have a webserver, decide to install a sensor on it, and deploy - one core and one GB on that server are immediately set aside for the sensor, correct?

Interesting topic. In all honesty, I'm relieved I don't have to reach out to support more often. Not from any specific negative experience, but more from the tales of woe I occasionally read here. That said, I know most of you are utilizing the products in more specialized ways than I and may require support more often.…

As with many others, I'm looking forward to seeing the new functionality in operation. While I'm a bit dismayed to hear that you'll be charging for this added functionality of the core product, I guess I'm not surprised. As a company, you've done so many acquisitions over the past few years that it makes sense to try and…

Is this functionality separate from SAM application monitoring? It looks as if it is, but wanted to confirm.

Thanks for the confirm. Can anyone SolarWinds Community Team bring any more info to the table? I wouldn't ask, but since the site doesn't indicate a known issue or other problems, we have no information.

Had to restart services on the poller and suddenly we're back in business. I should have started there..whatta maroon.

Do these users require more elevated permissions in other modules and only a restricted set in UDT, or is it possible to give all their access the read-only level?

I'm having this same problem and can get a pcap together if you'd like. I see the same things that networkingkool sees - some packets going out the interface, visible on wireshark, nothing in Solarwinds.

What port do you have the Fortigate configured to send the flows over? Does that port match on the NTA side?

I can see the items, but I noticed I did not show a new item indicator in the top right when I had a reply to a thread I had started.

I was doing it the other way - asking for the engine to check for two things before it triggered the alert.

Need to amend that - smaller maps are not, in fact, okay. Column maps in the first (primary) tab display normally in NOC view. It's when the maps are located in a non-primary tab that they break. I can replicate the problem on second or third tab.

I had no issues, and rarely have with updates of the NPM platform. Take a DB backup as others have said and proceed. It's a streamlined and low-click process when it works as it should.

IIRC, at least the Nexus 6k does sampled Netflow. Perhaps that's the case with the others as well? You might want to move this thread to the NTA forum to get more responses.

I'm not positive on the answer to this, but are your multiple domains in one forest?

Isn't Gartner's Magic Quadrant a pay-to-play situation? Your comment is trollworthy.

What is the sample time period that gives you these traffic amounts? If it's a few minutes, that's not really a tremendous amount of data. If the data delivery from your pollers is robust and this is a good-sized sample, then it's not impossible that the SQL server's side of the TCP conversation might add up a bit over…

Customization of reports native to DPA seems very limited, so I haven't found a way to neatly do what you're after. I can drill down and associate a high-CPU wait to a user, but there's no tidy method I've yet found to tie user>cpu>wait. Perhaps other DPA users can shed some light on this. Good luck.

I've seen this issue as well....specifically MPLS WAN connections. I also have sFlow happening from switches at either end - and still can't see the conversation in question. It doesn't always happen and seems limited to a certain site, but it's a puzzler. Please share if you get to the bottom of this. Thanks!

Have you successfully polled and/or gotten perf counters or other data from any monitored nodes on the new poller? Are these machines on the same subnet or does a firewall separate them? If the answer to the above includes a firewall, do the ACLs on said firewall restrict WMI or other polling methods in any way - say, from…

3750s do not support Netflow, unfortunately.

That's a weird one, Daniel. I can't replicate your symptoms and I use dynamic queries to populate my groups as well. Are there any commonalities to the nodes you cannot click on? For example, are they common to a specific poller, polling method, etc.?

Well, I got too curious and had to try it! Works as advertised for me. Good luck! PS - you'll have to enable complex conditions on the alert itself (bottom of the first page when editing the alert). You don't need any reset actions. You'll have to amend the text of the email to your preference. Other than that, fun!

I would try the following: Once navigating to Manage Alerts, I would duplicate and edit the 'Alert me when a new MAC address appears on network' alert. I would add a secondary section to alert on node and make sure that secondary section is set to 'And'. To cover all of my switches, I would set the node vendor equal to the…