zackm ✭✭✭✭✭

NPM is only going to show you generic metrics based on ICMP and SNMP data. To get to the granularity you are requesting, you need Flow data. NTA would be your most effective means of drilling down to the level you desire, while staying in the Orion family of products.

Once you are on NPM 11.5 or later, the traditional Nodes table is split up into 3 different tables in the database (NodesCustomProperties, NodesData, and NodesStatistics). These 3 tables are combined into the dbo.Nodes view in order to retain functionality for everyone who has been historically using the Nodes table for…

*Edited to add hours column with more granularity* Ok, so this is going to be a long one, but it should end up getting you the results you want. First off, you're going to want to ditch the SQL query and get down on some SWQL!!! In line with that, you're going to want to use the 'Custom Query' resource, instead of a…

generally this occurs when the query you're using is too complex to return data within the default timeout window (30s or 60s if I recall) the work around would likely be one of the following options * validate that this isn't a network issue by testing the query(ies) directly on your Orion server * remove mathematical…

Love it! Pro-tip I found along the way these past years, the Metadata entities are perfect for the "Where is that thing?/What can I do?" -type questions. Finding entity names: SELECT FullName ,Name ,Namespace FROM Metadata.Entity WHERE Name LIKE '%CustomProp%' Finding all columns for a given entity, or the entities a…

My initial thought would be to check your WSUS subscriptions to ensure that you are setup to pull down .NET. IIRC, you would need to enable the "Feature Packs" classification. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

Up/Down is a status dictated by ICMP response (by default). Have you tried to RDP to your SolarWinds server and then ping the "down" device from there? What you are describing sounds like a network issue, usually a problem with an ACL blocking ICMP packets or a routing issue. -ZackM Loop1 Systems: SolarWinds Training and…

Is there a solid breakdown of 32-bit versus 64-bit? The only thing I have seen is that 32-bit users will not have the new DB and granularity improvements. Can someone confirm exactly what is in the 32-bit version of NTA 4.0 that is not in NTA 3.11?

Are you sure that is the alert that is sending emails? There are a number of OOB alerts with pretty generic emails. I would try to look at my Active Alerts resource, or even my historical event log in the Message Center, to see if I could correlate the email times with any alert trigger times. You could also run this in…

page 160 of the NPM Admin Guide Views by Device Type There are vast differences among network objects and the statistics they report, but the Orion Web Console can make it easier to view network data by displaying object details by device type, giving you the ability to have a different view for each unique type of device…

you'd need to copy all of the defaults yourself, and then put them into a unique report limitation and give that group report admin rights for that limitation only. this can be done via the API using the Orion.Report DuplicateReport and UpdateReport verbs.

Assuming NPM is involved: * Create a Universal Device Poller: Create custom poller alert - SolarWinds Worldwide, LLC. Help and Support * Create an alert: Create custom poller alert - SolarWinds Worldwide, LLC. Help and Support Assuming SAM is involved: * Create an SNMP Component Monitor and associated alert: Monitor SNMP…

I don't have a way to test the theory at present; but there is a known issue with Cisco ASAs doing the same thing, the fix is to add a `terminal width` command to the device template if I remember correctly. You can verify by comparing the default "Cisco IOS" device template to the "Adaptive Security Appliance" one.

In the scope of your alert, set it to something like this: VolumeType BEGINS WITH Fixed The full enumeration is actually "Fixed Disk" but there is a known issue where certain vendors will use "FixedDisk" instead of "Fixed Disk" (same thing happens with "Network Disk" btw) Hope that helps!!! -ZackM Loop1 Systems: SolarWinds…

Not natively, but you can create a report using SWQL that should meet your needs: SWQL - Active Alerts Report To limit by severity to only Critical alerts, try this: (note the addition of line 19) SELECT o.AlertConfigurations.Name AS [ALERT NAME] ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' +…

Depending on what you're trying to accomplish, I've had some solid success using Report Writer to "clone" Details-view resources. Just create the report in the legacy report writer, them embed them in a summary page. (Report from Report Writer Resource) -ZackM Loop1 Systems: SolarWinds Training and Professional Services *…

You should be able to look at the VolumeUsage view in the database and generate a SQL query that will get the current usage and then the same metric for (GetDate()-30) and then subtract to get the difference. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1…

there's a few tables in the database, depending on what specifically you're after really.

Right now, you will need to edit the email templates using the 'Advanced Alert Manager' on your primary server. (Network Performance Monitor Training #7: Alerts - YouTube) However, very soon we will be able to do all of this in your web console! What We're Working On: New Alerting Engine Hope this helps get your in the…

without digging into the nitty gritty, my initial thought would be to replace the "Custom Table" resource in your report with a "Custom Query" resource.

You should be creating a Hardware Sensor-type alert with the Advanced Alert Manager. From there, the current value of the selected temperature sensor can be shown with: ${SensorValue} -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter:…

First point: you need to limit your query to TOP 10 since SAM will only accept 10 pairs of Statistics/Messages Second, I usually see that error when I forget to test the script output in the "Edit Script Body" popup. Testing the output in that section defines your statistics for the component and populates the thresholds…

This would be better suited in the Kiwi Syslog forum. But, to answer your question, yes you can. http://www.kiwisyslog.com/help/syslog/index.html?action_send_syslog_message.htm Hope that helps!!! -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Loop1…

I haven't really attacked this in depth yet, but to my knowledge it is not possible to get icons or links with SQL and the new web report engine. You could use SWQL and get them if I am not mistaken. (I know for a fact it works with links, 90% sure with icons) Depending on your report, it may be fairly simple to migrate it…

Try this (just un-comment the section you want to use < Line 6 or 8 >): SELECT NodeName, T1.DownTime AS HoursDownFROM (SELECT COUNT(EventTime) AS DownTime, NetObjectID, NetworkNodeFROM Orion.EventsWHERE (EventType=1)--1 day--AND EventTime > DATEADD(day,-1,GETDATE())-- 1 hour--AND EventTime > DATEADD(hh,-1,GETDATE())GROUP…

Check your account settings. Edit buttons disappearing usually means you lost privileges.

Big Thanks to Steven Klassen for cleaning this up! Here is a combined report if you don't want them separated: select *from ( select max(e.eventtime) eventtime, n.nodeid, n.caption nodename, null interfaceid, null interfacename, e.message, e.acknowledged from nodes n join events e on n.nodeid = e.netobjectid and…

For Nodes: SELECT MAX(EVENTTIME) AS "EVENT TIME", n.Caption AS 'DEVICE', MESSAGE, n.NODEIDFROM EVENTSJOIN Nodes n ON n.NodeID = NetworkNodeWHERE NETWORKNODE IS NOT NULLAND ACKNOWLEDGED = 0GROUP BY n.CAPTION, MESSAGE, n.NODEIDORDER BY "EVENT TIME" DESC For Interfaces: SELECT MAX(e.EVENTTIME) AS "EVENT TIME", i.FullName AS…

Interesting topic. I think it's fairly obvious that the granular rights approach is the most effective to date. However, this really doesn't fix the problem of password sharing for the users who feel they need more rights, no matter what anyone says. Nor does it fix the more universal problem, that we (IT) share more…

ctrader wrote: an alert that is monitoring the "routing neighbors" property. That's the key right there. When you create alerts based on the 'Routing Neighbors' type, you are not pulling any interface information into your query. You are really pulling your information out of the NPM_RoutingNeighbor_V view. So your options…