sedmo

That's what I was thinking too. I've seen a case before where ping from a network monitoring application was blocked by an ACL that was meant to contain the spread of a virus but pings from the command line on the same server would work. The icmp packets created by the app were different than those created by the windows…

This post contained SQL for removing the domain names that I think could be adapted to your needs. ALWAYS make a backup of your database before executing SQL queries that are going to modify your database. The SQL query below will take the value that is in the SysName field, remove the domain name and then place this value…

You will need to add something like this after your select statement and before the WHERE clause from nodes join events on nodes.nodeid = events.networknode See the complete query I posted earlier for an example. Also, if you could post your complete query that would make troubleshooting easier.

Here is how I have specified this sort of thing in my queries. (DATEPART(weekday, DateTime) <> 7)AND (DATEPART(weekday, DateTime) <> 1) AND (CONVERT(Char, DateTime, 108) > '0800') AND (CONVERT(Char, DateTime, 108) < '1700')

If you want to test the SQL query in the alert remove https:// and leave just the SQL query. This will at least tell you if the query is working properly or not. So the query in your alert email should look like this: ${SQL:SELECT Remote_Management_IP FROM Nodes WHERE NodeID='${NodeID}'}

It looks like it is possible to match on the EventSource and EventDestination OID's. I have attached a picture of my rule that alerts when someone does a config terminal from the command line but does not alert when a config download is requested via snmp.

Try configuring your alert like the screenshot below. Also, do you have anything configured on the alert suppression tab?

Is your management traffic coming to the pix through the inside or outside interface? If it is arriving on the outside interface then you need to reflect this in the snmp-server host command.

Counter rollover is definitely not the problem if we are only talking T1 interfaces. Are you seeing utilization amounts way over 100%? Can you post a screenshot of a typical interface where you see this problem?

Since this is a report for interface information try using... interfaces.NodeID = ${NodeID} ${NodeID} is a variable that should contain the current NodeID.

Could you create a custom SQL report and then schedule the report to be emailed?

Right. That's what I was suggesting. See the screenshots posted above for an example.

If the emails are destined for users on that exchange server then they will be delivered. If you are trying to send to an external domain through the exchange server then you have to configure Exchange to allow relay for the Solarwinds server.

I could also really use the ability to send traps from advanced alerts.

Because of the way the suppression tab method works, I try to avoid using it unless the criteria is very straight forward and simple. Otherwise, it can be fairly easy to create suppression criteria that doesn't do what you think it will. I would definitely agree that custom properties are your friend when it comes to…

mdriskell, The query is already written to exclude devices with blank sysname.

Are you saying you only want to select the records where the LastBoot time was Monday - Saturday 6a.m. - 9p.m. ?

Are you only wanting an alert if all three field sites are down while the AP is up or do you want an alert when any one of the field sites are down while the AP is up?

The "FullName" field from the interfaces table that I used in the screenshot example contains both the node name and interface description so I think that one field will cover everything you need.

Could you post a screenshot of the view that is giving you problems?

Does the web server for your solarwinds site run on a server that is separate from you NPM polling server?

mrxinu, If I'm not mistaken your suggestion will have the same logic problem. The query created will say: select records where nodeA is up and NodeB is up Because the AND operator is used, no record in the nodes table can ever match this condition. One way I think this could be accomplished is to create a trigger condition…

Paul, Have you tried looking at the data in the TrapVarbinds table in the database? For these types of traps from my Cisco devices I see an oid of 1.3.6.1.4.1.9.9.43.2.0.1 I am not using real time change detection but I can get email alerts from the traps when I set the condtions to: SNMPv2-MIB:snmpTrapOID is equal to…

The logic can get a little fuzzy. In essence what you are saying is there are four criteria that must all be met for the alert to fire and the fourth criteria is that none of the node names can contain ABC.

What I posted earlier was just the WHERE clause portion of the query. You will also need to select the appropriate fields that you want the query to display. Here is one possible example of a complete query. select Nodes.caption, events.eventtime, events.message from nodes join events on nodes.nodeid = events.networknode…

I had the syntax backwards in the previous post so please ignore that one. try this: Nodes.NodeID = ${NodeID}

OK. Try this instead. NodeID = ${Nodes.NodeID}

the Node Warning Interval determines the length of time a node stays in the warning state. This is configured from the System Administrator Console File >>> Advanced Settings >>> Node Warning Interval

You can fix this by editing the file named integrationicons.ascx. by default it's located at c:\inetpub\solarwinds\orion\netperfmon\controls\integrationicons.ascx. Open the file with a text editor and search for "telnet:" to find the point in the code where you need to add the slashes.

John, Setting the service startup type in Windows to manual should keep it from starting on reboot. The Services administrative console can be found under the Windows Administrative Tools.