rjnicholson

Yes, I would turn on the "log" option on your access list. access-list 101 permit ip host 10.110.10.179 any log That is what you want the access list to look like. Once you have done this use the "term mon" command if you aren't connected to the Console port for access and you are using a VTY session. This command will…

I see you have 2 IP's listed on the Server and the one for Lan3 is what you have an access list bult for. Can you verify that this is the IP that NCM is using to poll out and connect to your Cisco gear? Is NCM built on the same server as your NPM installation? I would also check the syslog messages if you are trapping…

Ya.. I don't always paint the best picture with my words.. I'm a visual learner so it makes sense that I'm better at showing someone what I mean instead of trying to say it. Sometimes I say things and they make perfect sense... Then I read it a few hours later and I'm thinking... Hmmm.. That just sounds like I have no clue…

Sorry for slow response, but yes this is what I was mentioning. Since you tie the application and it's components to a node it understands the variable and what information to populate it with.

Is it the code that is not allowing you to run those commands since they are not recognized in the older code version? (odd if true since you shouldn't be running anything older than 12.4 in my opinion on an ISR router, but there is old enough code out there that can do this to you.) Or do you think you have a…

Just went back and looked in my event log. This happened on the 9/26 so on Wednesday between 11:50 to 11:56am CST. The interfaces were all from my primary poller only. We are running 10.3.1 as well.

I don't think it's a written out statement, but more or less a verbal warning and caution. I know you weren't calling me out I just wanted to clarify I wasn't trying to deter anyone, but merely what I had heard from different conversations over the years about SW with techs and the support teams. Just be sure you fully…

To help you track alerts in the Future this is what I would recommend when building alerts. I always have my customers go through and Give ID numbers to the Alert at the beginning of the Alert name. IE. ID:10 - Node Down Then in the email action or whatever action you choose at the end of the message and variables you…

I see.. This would be awesome if it could. I see your point. Wasn't looking at it that way since my DR site isn't back monitoring the HQ only the link between them and all the systems at the DR. With HA scenarios getting more popular each passing day I bet we will see this at some point. Also, having to do 1 poller at a…

I thought I was out of my mind, but my server has done this once last week. My event log shows I removed 2199 interfaces and added them back shortly.

You can't monitor services with NPM. That would be with SAM. But yes once you monitor them you can build an alert that executes a function/script that can restart services or bounce them. You can search the site for information on this. I know there are plenty of threads out there that discuss this and give examples from…

At the top of the Thwack forum there is a Ideas & Features request tab. Click it and go to the NPM section. Here you can create a Feature Request to be voted on, and the top ones get higher priority to be looked at by the Dev team and place it in a logical line of where they think it would make sense to roll out a new…

No problem. Hope it works out for you and provides the desired results!

Box is a HP DL380 G7 2 X5660 Xeons @ 2.80Ghz 48GB RAM Win 2008 R2 64bit I have it set up as a Raid 1+0 on 4 15k SAS Drives with 546GB of space only using about 70GB for the Database stoarge.. (overkill )

It logged over 83 million in that single hour. My biggest question (which is for myself) Where did all those errors come from!!? But yes, when I have it log that many I am seeing the formatting error.

I take it that this is an interface on that router then. That name is being pulled from the interface description set in the IOS config. I would find that interface and drill into it now. That is where you will find the interface events easily. The interface could be also going into warning from reaching errors/discards…

Tak, Yes, we currently are finishing a POC with Riverbed Cascade at our site, and Boeing who we are owned by runs Lancope. Both in my opinion blow NTA out of the water for the amount of flows we receive (I have run NTA in a much smaller environment with less emphasis on security and it was a Great product) , and allow you…

Here is the link. I saved them all to 1 UnDP file. If this gives you issues let me know, and I will upload each separate poller. http://thwack.solarwinds.com/docs/DOC-167487

Not what I was trying to do by any means. If the environment is right then it can be a great situation, but even SolarWinds has been known not to out right recommend it. I would assume the reason is because a SAN from one company to the next can very greatly.. Not only on performance, but on traffic the SAN sees as well.…

Ran across this same issue and was banging my head on the wall for about 2 days until I realized this same thing. We also had NCM Integration break (see cause below) and cause all kinds of havoc in the Web Administration. We learned the hard way when I took over the project and the guy that was managing SW before me had…

I can understand that, but I as well am an Enterprise customer and we have a Change Control maintenance window for all our Infrastructure. How do you not have one for server maintenance for all your production/test/dev systems? I know you don't just take them down at anytime for maintenance? Surely not in an enterprise…

If an Application is on a node and the node becomes down/unmanaged I believe it is a known dependency that the application can't function and should go into an Unreachable status. This could be why your suppression didn't seem to work. In theory you shouldn't have to supress application alerts that are caused by the Parent…

Hah.. In my hasty reading I skipped this post and answer from Matthew. Good point. I have what I call a to quick to assume problem I was assuming that an Admin account was being used to manage the Alerts and Orion. Makes since when you jump from a specific user account to another.

I honestly haven't ever seen Syslog be a flaky way to monitor. It's actually more precise since it's coming directly from the system that the even occured on. Not only are you not having to poll for this information changes generate events that will notify you're listening service right away. Now where I have seen Syslog…

Are those server IPs built with pointer records on the DNS Server SW is using and possibly not the DNS server they are hosted on, and that VCenter is using. Seems like when polling the VCenter it is using the DNS you have built in VCenter, and not the DNS that is built in SW.. It's a long shot, but really the only thing…

SNMP like stated above will give you Interface statistics, but the biggest value in my opinion is that it's much lighter than WMI and not dependant on as many other Windows services to function properly, and you aren't having to pass credentials to login and poll WMI through RPC.

Well I didn't explain it the best since Interfaces aren't technically polled with ICMP at least I can't see how they would be since they aren't Layer 3 devices and don't adhere to any Layer 3 routing on the port. My statement should have said nodes or Layer 3 devices with IP addresses for the example I gave.. I would…

This goes back to the logic of the alerting engine.. You need to be looking at the node I would imagine for this to work since the CP value is attached to the node and not the Group.. CP Values only can be placed on Node, Interfaces, Volumes as of now. 

The alert may be able to pull the ${NodeContact} field. I don't see why it couldn't since the Application is attached to the said Node where that information would be. I haven't done this though, so someone may need to chime in before I lead you down the path thinking it will work. But as for attaching a CP Value to the…

Currently you can't add a custom property to an Application only Nodes, Interfaces, Volumes. So you are limited when it comes to Application Monitors on this. I should be more clear. You can if you wish have 1 alert for Nodes, and use CP values to send alerts out. Application monitors you either chain the alerts and have…