rmarshall

The last suggestion ${Node.IP_Address} worked. Thank you.

Nope, ${IP_Address} did not work either. I got an alert this morning and it says ${IP_Address} instead of providing the actual IP address, same as before with ${IP}. Also, my rule says alert if greater that 80, but I am getting an alert when the threashold hits 9.

Is there a way to update or delete entries in the Content Exchange? If not, can someone please delete the first upload of my files and just keep the second?

Solution has been cleaned up with comments, and settings section at top of each script and uploaded as tgz to the Content Exchange here:

Yes, Splunk is on Red Hat Enterprise Linux ES release 4. Give me some time to cleanup the scripts and then I will upload them as a solution with a readme.

OK, I have successfully completed my Solarwinds Orion monitoring enhancements so that the following have been accomplished: * If a core switch fails, instead of getting hundreds of Node Down alerts we get one email with 100 alerts in it. * We can acknowledge all of the alerts by replying to the email with "ack" in the…

This is my latest test (notice I am trying to figure out how to use several macros here and none of them work): ALERT: There are more than 10 instances of surgientagent running on host EMC - SGP1REC19S08 ${Node.NodeID} ${TriggeredValue} ${Property} ${CustomPollerStatus.Rate} ${CustomPollerStatus.Status}…

The temporary solution you provided me did the trick. Thank you Brandon.

Never mind. I discovered that I was confusing the alert GUID with the Node ID. The Node ID is available with variable ${NodeID}. Using the Python script above (corrected to use the NodeID instead of AlertGUID as input) I am able to acknowledge Orion alerts from my Splunk server. I believe I have everything I need now. I…

Support determined that the issue occured because I deleted the host before deleting the application monitoring on that host. The solution was to stop the Solarwinds services and manually edit the Applications table in the database and delete the rows containing entries for my deleted hosts. For example, I ran a query that…

BTW, here is the Python script that acknowledges an alert by posting to the Orion web page: #!/usr/bin/env python import sys import httplib def extractcookies(response): cookies = '' allcookies = response.getheader('Set-Cookie') if allcookies != None and len(allcookies) > 0: if allcookies.find(', '): cookie =…

This is still an issue. I am unable to indicate the IP address of the host experiencing the issue in the alert message I am sending out.

I have a python script now that works for acknowledging an alert, but I just discovered that I don't have a way to get the GUID for my alert sent out through syslog using the Orion macros/variables. Is there any way to get Orion to send out a syslog message/email with the GUID for the specific AlertType and Ack GUIDs? If I…

The hosts have been deleted from the system. The alert became active before the hosts were deleted because we had turned them off. Now I can't get rid of the alert.

I have a rule that says NodeID is not equal to 0 (can't do NodeID equal to NodeID). I am still not getting the IP address. Instead it just prints the macro name in the message. Any other suggestions?

Absolutely, yes. I have confirmed that I have the application processes listed under Applications when I expand the tree for the nodes.

I ran the SQL and it returned 0 rows affected. The alerts did not disappear. I then used the console to remove the alerts yesterday and they just appeared again today, 15 hours later. Help!

Would you be willing to give me an estimate of when this fix might be available? The guys here are hoping I can get this fixed soon.

Changing the poller to be a rate poller and changing the alert to alert on a rate greater than 80 has worked. This is an acceptable solution. Thank you for your support. I'm am glad I was able to share this dialogue in the forum for the benefit of others. I will upgrade to 8.5 after it has been out for a few weeks. Just…

Yes, I am able to receive a test alert email. There are no alert supressions set either. Just a simple rule that says if the Node Name is empty alert. I tried other options too, like if the IP Address or SNMP Version or even CPU Load is empty, but I get nothing. If I set it to say alert me if the Last boot is empty I get…

Oh, I see now. That makes sense... duh. Can we forget this thread ever happened?

Crickets.

Using the Database Manager, I created a SQL script that said: DELETE FROM AlertStatus WHERE AlertDefID='{GUID for Alert Here}' and this removed the alert from the list (after clicking Refresh - not very intuitive), but then a little while later I got an email that said "Alert: IIS is not running on host [blank]" with no…

No, that thread did not help, but thank you. It discusses basic alerts and it suggests same macros I already tried. This alert is an advanced alert for an application monitoring rule. Any other suggestions?

I'm sorry, I meant to say Process Name. I have done it with Application Name as well and it does not trigger. I have also tried using the Running Copies is equal to 0.

When do you expect to have port monitoring included in Orion? Also, when will the Advanced alert actions include posting to a web page?

Right... You refered me to my own posting. I guess I should be a little more specific. I have a heartbeat message that occurs every day that is a Basic alert monitoring for changes in CPU Utilization and resetting on changes in CPU utilization. The issue I have is that if I make the window for the alert too large, we get…

Thank you for the document. Is there any additional information I need to know if our plan is to migrate to a new host with a new hostname, but then change the IP address of the host so that the Solarwinds IP address remains the same? In other words, we expect to take the old solarwinds host offline and change the IP…

Running database maintenance has not fixed this problem. 

Step 1) Create a script that produces the numeric response you are seeking. I called mine vmfsspace.specific. I actually found it online by Googling it. This may help: Place the script somewhere logical like /usr/sbin/vmfsspace.specific Give the file execute permissions (chmod 777 /usr/sbin/vmfsspace.specific) Step 2) Edit…