sedmo

This query should give you a list of SNMP nodes that have no interfaces or volumes attached to them. select Nodes.Caption from Nodes Where Nodes.ObjectSubType = 'SNMP' AND not exists (select * from interfaces where Interfaces.NodeID = Nodes.NodeID) AND not exists (select * from volumes where volumes.NodeID = Nodes.NodeID)…

The sql created by the filter is working a little differently than what you might intuitively think. In your example of cpu load >= 50%, you would expect the query to average all of the cpu load records for a node and then only return nodes where the average cpu load was >= 50%. What the filter does is select the records…

I agree! I'm currently going through the exercise of trying to get the maintenance terms for all our products to expire on the same date. The ability to pro-rate maintenance for terms less than one year would be very helpful.

kweise, If I'm not mistaken configuring the alert conditions as you suggest will result in any node that has a down status matching the trigger condition regardless of it's name. The sql logic for this configuration would be: NodeStatus equals down and (NodeName does not equal REDBSNL-CAL OR NodeName does not equal…

qle really meant to say divide by 6000 to convert to minutes. timeticks / 100 = seconds timeticks / 6000 = minutes timeticks / 360000 = hours timeticks / 8640000 = days

Per this post: and based upon my experience, I was under the impression that the suppression was not related to the triggering object(s) and could be met if the condition is true for any object in the database.

Glad you were able to get your problem fixed. I've also found it useful to create a Solarwinds report that uses this query so that I can view the list of nodes with duplicate captions from my web site. To do this, use Report Writer to create a new Advanced SQL report and then paste the SQL query syntax into the SQL tab. 

If enclosing the whole command in quotes does not work then try enclsoing just the variables.

I have the same problem occassionally.

Try this. SELECT StartTime.EventTime, Nodes.Caption, Nodes.Location, StartTime.Message, DATEDIFF(Mi, StartTime.EventTime, (SELECT TOP 1 EventTime FROM Events AS Endtime WHERE EndTime.EventTime > StartTime.EventTime AND EndTime.EventType = 5 AND EndTime.NetObjectType = 'N' AND EndTime.NetworkNode = StartTime.NetworkNode…

Rediscover will poll the router for it's current hostname and update the SysName field in the Solarwinds database but it does not update the node name which is the Caption field.

The problem with your current condition is that it requires the nodeid to be both 732 AND 733 which can never be true. The only way I can think of to do this is with an alert suppression. Your trigger condition would say: Trigger Alert when all of the following apply. Nodeid is equal to 732 NodeStatus is equal to down Then…

See if this thread helps.

Peter, One method to use for Cirrus to modify the listed name is to slightly adjust the IP Address (i.e. 10.10.1.1 to 10.10.1.2) in the Device Details window, click outside the IP Address field, let Cirrus discover the new device, and then change the IP Address back to the appropriate IP. Cirrus should rediscover the…

When you use "any" in the alert trigger the query uses "OR" between your conditions. So with this configuration it would read... Full Name contains CTRX OR Full Name contains CTX OR Interface Status equals Down To make this work the way you want it to, you will need to flip your conditions like this. Trigger Alert when ALL…

I've seen errors like this after using the control to move conditions up and down in the list. The control will let you move conditions between condition groups but doing this seems to break the trigger. I would recommend deleting the "Trigger Alert when any of the following apply" condition group along with the two…

Since node additions and deletions are tracked in the event log, you can get what you need by creating an event log type of report with report writer. You can then configure the report filter to show node removed and node added event types. One thing to remember though, only use fields in the report from the events table.…

Try adding the NodeID field to your report. If you don't want to see this field in your report you can hide it by selecting Hidden Field on the Field Formatting tab. 

I am also experiencing a problem with config download jobs pegging the server cpu. In my case, the problem seems to be related to using SNMP to retrieve the configs from the devices. If I configure NCM to use telnet to download the configs then the jobs seem to run fine.

Actually, I believe this is a DNS issue. If I am not mistaken, the syslog server does a reverse lookup on the source ip in the syslog message. If it is able to resolve the ip to a name through DNS then it puts this in the hostname field in the syslog table. If the reverse DNS lookup is unsuccessful then it puts the ip…

You might check this thread and see if it is useful.

Try interfaces.status

The interface status information is not showing up correctly in your alert message because the table in the database is named interfaces (not interface). So, your alert message needs to say ${Interfaces.Status}. As for the rest of your problem, how are you testing the alert?

I think your problem is related to the way you are specifying the dates to be selected in your query. Your current code selects records from the availability table that have dates between two months prior to the current date and one month prior to the current date. This means if you run the query today it will select…

You can do this by using a condition group where "none of the following apply". See the screenshot for an example.

I seem to be seeing the same issue. I also see "System Out Of Memory Exception" errors in the Solarwinds event log.

The command I use on my ASA looks something like this: snmp-server host outside xxx.xxx.xxx.xxx poll community yyyyy where xxx = the npm servers ip address and yyyyy = your community string Here is a link to the cisco documentation http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/monitor.html

If I understand what you are trying to do; when you create the second "all" group you need to first click the condition at the top that says "any" and then create a new condition group. See if the screenshot below looks similar to what you are trying to do.

The device that is causing the authentication failures is listed in the Trap Details portion of the trap message. In this case it is 10.1.0.10. Since this is the same ip as the device that sent the trap message it means the device is trying to snmp itself. This commonly happens with the Dell or HP server management agents.…

I think the functionality you are looking for is already there. When you have the report open in report writer, select Report from the menu bar and look for Show SQL on the menu. Selecting this option will add a tab to the report that displays the SQL.