wickedoz

It looks like the issue has to do with the IP being a varchar value and not having the ability to look at it numerically.

Yes. That would not work. Ultimately I have 24 subnets with 124 IPs on each subnet that I do not want a node with ‘PUB’ in the system name to be on. I could create a SWQL statement listing all 2,976 IPs.

I am testing in an alert. I do not have SWQL Studio.

I am just using the query ad-hoc for now, however I should put it in a custom report. It returns everything except current day.

Even if I remove the wildcard…. I used this as the SWQL: WHERE (SysName LIKE '%PUB%' ) AND (( IP_Address > '192.168.31.2' ) AND (IP_Address < '192.168.31.126' )) The SWQL does not find these: NLTPUBMG22CC6A – 192.168.31.89 NLTPUBMG22CCHX – 192.168.31.79 NLTPUBMH03GBGG – 192.168.31.77 It does not see the IPs as a range.

SELECT [SettingID] ,[Name] ,[Description] ,[Units] ,[Minimum] ,[Maximum] ,[CurrentValue] ,[DefaultValue] ,[Hint] FROM [CML_SolarwindsOrionDatabase].[dbo].[Settings] WHERE SettingID = 'NPM_Settings_ASA_RemoteAccess_RetainDownTunnels_Days' UPDATE [CML_SolarwindsOrionDatabase].[dbo].[Settings] SET [CurrentValue] = 90,…

I changed ours to 90. I also am using this query to create a report that will eliminate the duplicate handshakes from each connection. SELECT SessionID ,UserName ,IPAddress ,SessionGroup ,DATEADD(hh,-5,ConnectedTime) AS ConnectedTime ,DATEADD(hh,-5,DisconnectedTime) AS DisconnectedTime ,ClientInfo…

I was not aware of that. Thanks! However it appears that the SWQL still is not picking up the nodes in question. I used this as the SWQL: WHERE (SysName LIKE '%PUB%' ) AND (( IP_Address > '192.168.%.2' ) AND (IP_Address < '192.168.%.126' )) I currently have these nodes that I am trying to get the alert to trigger on.…

Can you run Orion on Unix? I thought it required Windows Server. I am not familiar with Unix.

The retention period needs to be changed in the settings table where the SettingsID = 'NPM_Settings_ASA_RemoteAccess_RetainDownTunnels_Days'.

It would be great if we can get the retention period to be longer, however we may end up looking at extracting the info from the ASA_RemoteAccessSessions table. We may be able to come up with a solution that could filter out the additional handshakes from the VPN sessions.

I do I build an alert using SWQL?

Thanks! That got me in the right direction. This is the query that I ended up coming up with: IF OBJECT_ID('tempdb..#Temp') IS NOT NULL BEGIN DROP TABLE #TEMP END SELECT * INTO #TEMP FROM ( SELECT NodesData.Caption AS 'Device', NodesData.IP_Address AS 'IP', CustomPollerAssignmentView.CustomPollerName,…

Here is what I ended up with: # This Script will Create a list of SolarWinds Windows machines matching name and IP criteria # Must have Orion SDK and Active Directory Tools Installed Add-PSSnapin SwisSnapin Import-Module ActiveDirectory # The line below will add credentials to an encrypted file # GET-CREDENTIAL –Credential…

# This Script will Create a list of SolarWinds Windows machines matching name and IP criteria # Must have Orion SDK and Active Directory Tools Installed Add-PSSnapin SwisSnapin Import-Module ActiveDirectory # The line below will add credentials to an encrypted file # GET-CREDENTIAL –Credential "SolarWinds” | EXPORT-CLIXML…

I opened a ticket with Solarwinds on this issue. It appears that the value is not manageable in the Polling Setting and is in the database with a value of 3. I am doing a remote session with them later this week to see if we can edit the value in hopes of getting longer retention. Hopefully they release a fix down the road…

I am trying to use the GUI and am trying to accomplish something like this: Where SysName contains 'PUB%' AND ( (IPAddress greater than '192.168.31.2' AND IPAddress less than '192.168.31.126') OR (IPAddress greater than '192.168.32.2' AND IPAddress less than '192.168.32.126') OR (IPAddress greater than '192.168.33.2' AND…

I have. The problem is that 192.168.31.2 is only including address where the last node of the IP begins with a 2. Therefore these examples: 192.168.31.7 or 192.168.31.62 or 192.168.31.11 are not in the range. It would be helpful if Node in IP Range was one of the conditions that could be set.

Do you know if the Orion.Node table is the only place that the Node needs to be deleted from?