smargh

Tried ${Node.CustomerName} etc?

Firstly, if you intend to use vanilla 2008, you won't be able to reliably use the APM module in the future due to inherent problems with WMI in 2008. Search the forums for "2008 lsass" for reports of the problems - Solarwinds doesn't recommend it. As for 'clusters' (I presume you mean failover in the event of engine/poller…

Multiple IPs on monitored hosts (or the Orion poller itself) can cause issues with either firewall settings or the SNMP config of monitored hosts. This can also cause multiple DNS entries for the same host. There's a hotfix & a "skipassource" flag for netsh for a couple of Windows versions:…

I use two custom SQL alerts for this. I have two node custom properties - one is for inputting the active IP for that node, and the other is for the standby units where I put in the standby IP. The alerts basically check whether the active or standby IP is correct for the current state of the poller for that node. This…

Include this in the email body, assuming your UDP is named the default of upsBasicIdentModel: ${SQL:SELECT CustomPollerStatus.Status FROM CustomPollerAssignment INNER JOIN CustomPollers ON CustomPollerAssignment.CustomPollerID = CustomPollers.CustomPollerID INNER JOIN CustomPollerStatus ON…

It will do that if the "VolumePercentUsedWarning" custom property isn't the right type, i.e. integer vs. text. Of course, you'll also need a third alert, too, to alert if free space reaches a minimum default level. By the way, it is possible to set things up so that it alerts based on a custom property of…

This seems to be a difficult thing to check, because there are several different bits of the logon process which can freeze. Just checking port 3389 is totally insufficient. Nagios has a Python check_x224 script to check the early parts of the login process - I've used it (with Nagios) with varying levels of success for a…

[edit: I just realised that this only does a drive letter substring, not available disk space. I've always found this to be perfectly fine for my uses though - it always looks aesthetically okay.] I use this as the subject of disk space alert emails: *** WARNING: ${NodeName} ${SQL:Select Substring ('${Caption}',1,2) AS…

Don't do it. Search Thwack for 2008 lsass for reports of other experiences.

I use evntcmd.exe for this: evntcmd.exe -v 10 events.cnf -s hostnameHere where events.cnf contains this to add a trap destination: #pragma ADD_TRAP_DEST YourCommunityNameHere 123.123.123.123 You can obviously do various scripting around this, and my events.cnf is very long - I send a lot of event logs traps to Orion this…

On Windows systems I also alert on "% pagefile used > 80%". The only way I've found to get that figure is on our HP ProLiant servers with the HP management agents. I've found that percentage of pagefile used does highlight memory usage issues better than the default Windows reporting, as it excludes the high memory usage…

It cannot be done. If it actually can, then please someone correct me. I spent a long time looking in to this, and I got fed up of trying to figure out the correct syntax to get ${SQL: } lookups working within alert text. An alert based upon a universal device poller - called P_Disk_Condition for you - can only alert if…

Do you have duplicate IPs in your Nodes table? SELECT COUNT(IP_Address) AS IP_Count, IP_Address, Caption FROM Nodes GROUP BY IP_Address, Caption HAVING (COUNT(IP_Address) > 1)

I wanted to do the same. You can't put anything larger than 2147483648 bytes (2GB) into a custom property of type "integer", which is what it needs to be for the comparison to be successful. You can manually insert the trigger & reset SQL into the AlertDefinitions table. However, you must never edit *anything* in the GUI…

Are these events based on alerts which were previously acknowledged? If so, there is a bug where acknowledged alerts will be 'removed' after 10 days and be triggered afresh, with corresponding email alerts & events etc, and will need acknowledging again. The 10 days can be changed to about a month, but it will still happen.

You're looking for Nagios-style parent & child hosts. This is on the NPM todo list. The only efficient way I can think of doing it is... Have two custom properties: ParentNodeID (type int) and ParentIsDown (type boolean). How to manage and validate these these relationships (to avoid "loops") is up to you - it would…

You will need to delete the dodgy volume via Manage Nodes - expand the node to reveal the volumes, then delete the old one. Solarwinds support has twice indicated that this is a feature of Orion & didn't comprehend that a simple volume rename shouldn't cause it to silently stop being monitored. So, every time you rename a…

Buy more RAM for caching, use a SAN with dedupe.

If a device reboots while Orion has it as "unmanaged", it won't alert for a reboot. That's what I've found anyway. It might depend on whether you're using your own alert criterla - I use "lastboot changed", I think.

I currently have case ref 208394 open since last Friday (17 Dec) for this problem. Orion is hosted on a decent 2008 R2 box. The problem did not exist on 10.0 SP1, but does on 10.1.1 with both hotfixes, but it's a bit awkward to say specifically that 10.1.1 is at fault because we only started sending a large number of…

This is something which would be massively useful. I have recently considered implementing a DIY email template solution, as I now have about 90 email bodies to edit when I want to add something to most alerts. This is complicated by the weird method in which the body seems to be stored in the database - I can't see any…

I think OP means the lsass.exe + WMI bug with Server 2008 (non-R2) which MS might perhaps consider to be a feature.

5) Oooooooooooooooooooooooooh yes yes yes. Table-based alerts do need improvement - it's very awkward at the moment. Alerting based on other values for that row in a different column would be awesome, but we would also need to be able to use other row values in the alert emails/actions. I'm not particularly bothered about…

This is more of an NPM questoin. This happens when a volume label is changed on the server itself. Has someone renamed it? Orion loses track of the volume when it's renamed. You're welcome to try and get SolarWinds to fix this behavour; I've never been able to. Forget about what the web interface says - have a look at the…

You can do this with NPM and SNMP traps. Configure all domain controllers - which is where the lockout event is logged - with evntwin.exe to send Security event ID 644 as a trap. NOTE: Server 2008+ domain controllers may log a different event ID than Server 2003 - I haven't checked. You will also need to configure the SNMP…

I don't know if this will work for 10.1.1 - we're on 10.0 SP1 right now. I noticed that alerts were resetting by themselves after being active for exactly 10 days, even though I wanted to have them active forever. Support offered the following workaround - note that the maximum reset interval is 28800 minutes (20 days). I…

Add a boolean node custom property called something like "Disable_Alerts". Add criteria to your alert(s): Disable_Alerts is equal to No This will allow you to disable alerting for a given host via the web UI. You can get more complicated if you want, but this is one of the things custom properties can be used for.

You probably need to install the HP management software - look on the HP site. People often use the SmartStart CD. The HP OIDs I use are... 1.3.6.1.4.1.232.3.2.2.2.1.5 - RAID accelerator status 1.3.6.1.4.1.232.3.2.5.1.1.37 - drive condition 1.3.6.1.4.1.232.6.2.6.7.1.6 - fan speed (high = "oh no! server is probably going to…

Either I am, or you are, confused. SP2 for Server 2008 was released in 2009. NPM is supported on that, under the condition that Server 2008 (not R2) has big problems with WMI and should never really be used if at all avoidable - the APM module can use WMI a lot. SP1 for Server 2008 R2 was released at the beginning of last…

Do you have anything in the reset & supression tabs? I would look at the Nodes table and look at the SysName value directly, and also check the SQL to look for any spelling weirdness. Perhaps there are non-standard chars, or spaces somewhere etc.