yaquaholic · Senior Monitoring Simian · ✭✭✭✭✭

Have you tried GROUP BY? Select N.Caption, N.UnManageFrom, N.UnManageUntil, AE.TimeLoggedUtc, AE.AccountID, N.Node.DisplayName, note.Note, note.NodeID, AddHour(-7,note.TimeStamp) as [LastNoteTime] from orion.npm.interfaces N LEFT JOIN Orion.AuditingEvents AE ON N.NodeID = AE.NetworkNode LEFT JOIN orion.NodeNotes note ON…

Or even https://solarwinds.github.io/OrionSDK/2020.2/schema/index.html 

Have a look at their SDK site solarwinds.github.io/.../Orion.ContainerStatus.html

Have you tried the IP or the hostname? If that doesn't work I'd raise a support call, and get them to assist you in reinstalling the Kiwi Web Server.

Hi Alex From what I've found about the unit you'll need a Modbus/TCP server, it does not appear to support SNMP or method of polling it directly. Maybe somebody else can help further? yaquaholic 

Hmmmm... You'll want to filter with ADDDATE then... Select Top 25 E.EventType, ET.Name, E.Message, count(E.EventType) AS Total From Orion.Events AS E INNER JOIN Orion.EventTypes AS ET on E.EventType = ET.EventType WHERE E.EventTime > ADDDATE('DAY', -7, GETDATE()) Group by EventType, Name, message Order by Total desc

Dear WinterSoldier A quick and dirty SWQL answer for you: select top 25 EventType, Message, count(EventType) AS Total from Orion.Events group by EventType, message order by Total desc It should be fairly easy to re-apply this to Orion.AuditingEvents on ActionTypeID. Hope it helps ;) yaquaholic 

Hi Dave, Did you fix this? It all depends how you generate the alert originally, but SQL and SWQL support the ROUND function. yaquaholic

Hi Robert, What's the OID and I will have a look? Rich

Hi Nato, Test that the aligned SNMP credentials still work on the device, this is the most common problem. yaquaholic

Hi Brian, You can set the forwarder to retain the original IP addresses. Have a look at: https://documentation.solarwinds.com/en/success_center/kss/content/kss_adminguide_action_to_forward_to_host.htm In the Rules optional values you'll find: Retain the original source address of the message Normally, the syslog protocol…

Try SELECT str.text, vtm.displayname AS VTM-DisplayName, ap.DisplayName, ap.Node.NodeID

Hi Shocko, Yes, and here's a guide to help: https://documentation.solarwinds.com/en/success_center/nta/content/nta-hp-sflow-configuration-sw2005.htm yaquaholic 

Hi mbaker_wv, Use the SAM monitor to get the status of the print spooler and then use an alert to perform any actions. You might find this handy. https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-creating-new-alerts-sw989.htm Hope it helps, yaquaholic

Hi Jake, Here's a little SWQL to get you started.... SELECT N.NodeID, N.IPAddress, N.Caption, CL.AvgLoad, CL.AvgMemoryUsed FROM Orion.Nodes N INNER JOIN Orion.CPULoad CL ON N.NodeID = CL.NodeID WHERE N.CustomProperties.<CP Name> LIKE '<CP value>' AND CL.DateTime >=AddDay(-30,getdate())) The above SWQL code, once you add…

If there server's operating system supports SNMP (most do), then yes you can. 

No, that text would be added to the original alert. Though if you are not seeing those variables then that isn't going to work. Our CDP alerting is SNMP trap based, which we then process using some custom SQL to retrieve the details, and alert from there. Also we have no CDP on/from our WLCs, so I can't replicate your…

Try removing the last ".0" from the OID.

Hi fmoghimi, We added this to the alert message: ${N=SwisEntity;M=Router.Nodes.Caption} has reported its ${N=SwisEntity;M=ProtocolName} neighbour ${N=SwisEntity;M=NeighborIP} as down. Hope it helps, Rich

Hi boey007, Have a look at Orion.NPM.SwitchStack and Orion.NPM.SwitchStackMember

On the alert actions, you can add SWQL code to the message/subject that will allow you to pull the primary/secondary information you need into the subject/message body. Have a look at @BobMarley's post - thwack.solarwinds.com/.../how-to-create-and-use-your-own-define-sql-swql-variable-advanced-within-an-alert

Hi Deepukumar, Do you have data in any other widgets for other SAM monitored applications or devices?

For the alert trigger you won't need to return the Primary or Secondary Pano connected values, just to know that they are not connected will be enough. You can then pull the Primary or Secondary Pano connected values into the alert subject or message, using the "Define SQL/SWQL Variable (Advanced)" option.

Hi AK, Have you seen the "Migrate the SolarWinds platform database to a new server" KB article? https://documentation.solarwinds.com/en/success_center/orionplatform/content/migrate_the_solarwinds_orion_sql_database_to_a_new_server.htm Hope it helps, Yaquaholic 

Hi Octane13, I would start by doing a SNMPwalk of both devices and see if you're seeing the same difference in their output. And are both devices on the same versions (of firmware/OS/etc)? Are the devices in any sort of HA relationship, could one device be reporting for two (or more) pieces of physical hardware? Do all of…

Can you supply a screenshot, or a little more info please? 

Yes, that what i was thinking, but I've been having issues pulling data from that table using SWQL to extract the job result, as mine keep timing out. Hence why I asked @KMSigma but I am also struggling to get the @mention working correctly. SWQL is very similar to SQL, but if the data is in the SWQL API it will also be in…

Hi rjrothwell, We had a similar issue, where one of many CPUs would max out, and caused all sorts of issues. But the average CPU polling did not reflect this. So we added a SNMP poller to poll for the individual CPU utilisation, and alerted when any core alone went above 95%. @KMsigma if he were to set this up as a…

Hi Shakaxl07, PowerShell is you friend! Here is a script that should do what you want. You will need to change $old_events_folder (from 'C:\' to your folder of choice) and $folder to match your own environment (my Kiwi was in Program File (x86) ), but other wise it should be good to go. I will require to be run as elevated…