yaquaholic · Senior Monitoring Simian · ✭✭✭✭✭

If I recall, the easiest way is to use the old legacy Report Writer, here is a good start to using it - Understanding Orion Report Writer Create the chart as a report, then from your chosen view (or a duplicate one), click Customize (top right if you have the correct rights) and add a resource called "Report from Orion…

Yes, I can see that it doesn't reflect the users online. Your are spot on with the AuditingEvents table, which contains far better data. And from this table, the AuditEventMessage also includes where they logged from as well. Leave it with me, I will get some time this afternoon to have a look at it.

Hi SuperFly99: We did open a ticket, but with many temporary faults, they are damn hard to troubleshoot. We agreed to close the call as despite screen shots and packet captures of the symptoms, as we never managed to see the problem as it was occurring. Unfortunately I no longer work in the environment where we had those…

Shaun, if you use the alert definition that I supplied, it uses the individual hosts CPU thresholds. I have upload my actual trigger condition.xml, if it will help.- CPU_critical_threshold_exceeded_condition.xml You can then import it into your alert trigger definition (look down at the bottom of the page) . Then just use…

Just checking, but does your trigger have an unmanaged exclusion? Try building a new Node Down alert, from scratch and see if the problem still occurs. If can recreate the issue with a new alert (with an unmanaged exclusion) you may well have a bug, have you raised a case?

Nickospot, We have ours as a virtual appliance, so we just installed, set up the IP address(es) and started using it. The URL for ours is http://<helpdesk hostname>/helpdesk/ (or http://<helpdesk hostname> - both work) and that takes you to the login prompt. Is your installed on Windows, Linux or a virtual appliance? Can…

There are samples scripts, for adding WMI and adding interfaces, on GitHub - solarwinds/OrionSDK: SDK for the SolarWinds Orion platform, including tools, documentation, and samples in Powe…

When you List Resources on the device, can you see the drives listed? Were the drives discovered with WMI, then you switched polling to SNMP? If so then it appears that your snmpd.conf isn't providing volume/disk information.

Hi Max, Okay, firstly the testdb1 and Transitsb mailboxes, I take it these show up in the report as the UserName field? If so, then I would add the following in bold, between the last JOIN and the ORDER BY: FROM Orion.APM.Exchange.Mailbox mb JOIN Orion.APM.Exchange.Database d ON d.Copies.IsActive = 1 AND d.ID =…

Nearly home time and some 7 hours later. Will it have finished by the morning (rhetorical)?

Okay, if the drop down boxes won;t cut it, SQL or SWQL is the way forward. Firstly, lets work out what you are looking at. Open your trigger definition and populate each of the variables into a single trigger condition, especially the two you want to compare, but add as many as you need. Next from the top right of the…

Nope, with NPM unlimited you can keep on adding APEs, the only restircition is the ~10,000 elements per APE I have heard of people with 10+ APEs.

We have customers looking at our Orion system, so we are running it as a dedicated VM. I personally wouldn't run it on the same system, unless you are in test&dev.

Slight off topic... We just had one of these, where even the tech couldn't reopen his own ticket, even though it was locked by the same tech account. I managed to resolve the ticket lock by getting him to logout, I then disabled the account, then re-enabled the account. When the tech logged back in, the ticket was unlocked…

Have you tried using ( t.TAG > 16386 AND t.Tag < 16990 ) ? SWQL: SELECT Nodes.Caption, Nodes.NodeID FROM Orion.Nodes LEFT JOIN Orion.Traps t ON nodes.caption = t.hostname LEFT JOIN Orion.TrapVarbinds tv ON t.TrapID = tv.TrapID WHERE t.TrapID IN ( SELECT tv.TrapID FROM Orion.TrapVarbinds tv WHERE tv.OIDValue='raised(1)' )…

Is your monitor set to Local or Remote Execution mode? Local mode executes on the Orion server, Remote secutes on the server (and should bypass this problem, though you'd need to adjust the script to run locally). Does the template or the monitor itself define the credentials used to poll? A quick look at w32tm, and it…

If you can't decide if it's a router/switch from the machine type, or the SNMP SytsObjectID (which is pretty unique across device types) then you're scuppered. Failing that, create a new Custom Property, against the Node, such as isRouter with True/False values or DeviceType with dropdowns such as router, switch and server…

* In the PowerShell Script Monitor, is it possible to get multiple output? If so, how? Have a look in your Powershell examples folder - Program Files (x86)\SolarWinds\Orion\APM\SampleScriptMonitors\PowerShellScript 2. Also, is it possible to assign value from the output of a PowerShell Script Monitor to a custom property…

Not all devices support the asset inventory, do you have the Linux flavour and versions? Are you running virtual of physical servers?

The easiest way to recreate the view you want will be with Network Atlas, once you have the desired component monitored, you will be able to display their statuses as an icons. It will then reflect the state of the component on a map. Drop in your black grid matrix thing as a background, each icon would occupy each square…

300 Have you seen Alex's post - How do you reference an application custom property in an alert. Quite a few of us have struggled to get these CP variables to work, and have ended up creating SQL queries to solve the problem.

dodo123​ thanks for the tip on nltest! I wrapped this into a Windows PowerShell monitor to retrieve this into Orion: $test = nltest /dsgetsite 2>$null if($LASTEXITCODE -eq 0) { $location = $test[0] Write-Host "Message: $location" Write-Host "Statistic: 1" } Now all I need I need to create a little report to display this on…

I am seeing similar things, I think I am going to raise a ticket, as even the out of the box definitions don't always work.

We have several customers using the Netscalers, so far we doing pretty simple SNMP monitoring of the devices, but it would be great to get more detailed info out of them, the Citrix team would love that.

Are you using a local database account or using the agent credentials to poll? We had similar issues, on one of three agented SQL servers. We had plenty of the AppInsight monitors were responding correctly, as they were using the user the agent was running as, but still the SQL queries failed as the agent user didn't have…

Just double checked it, runs in SQL Studio. Where are you trying to run it, or even what error do you get?

Yes, syslog is pretty standardised. Cisco kit certainly works, as does most kit that say that it can send syslogs. Linux systems can use rsyslogd, to forward and for Windows servers we use the FREE Event Log Forwarder for Windows | SolarWinds. There may be some exceptions, have a look at this page for manuals, release…

Thanks for the tip, but it's worked fine on one of our systems, but the other is still receiving the Multicast down events. From the database both look good.... SELECT TOP 1000 * FROM [dbo].[EventTypes] WHERE EventType = 605 Box 1 (event suppressed): 605Multicast traffic downFalse14474460Warn7FalseFalseNULLTrueNULLNULL Box…

Good to hear, that you are making progress

Many thanks!