zackm ✭✭✭✭✭

If you are using a core module (like NPM or SAM), then you would want your alert to be based on Audit Events. There is an event type for node deleted in there. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

You're going to want to know your OperationID to target specific Operations, but this is a good starting point. Also, this query counts the total polls for your so you do not have to guess at how many happened in the last 30 days (to account for different polling intervals) SELECT o.OperationName ,o.OperationType…

Just to add some insight to this thread, there a couple of things to remember when thinking about the ICMP polling intervals. * The default for all alert definitions is to only query the database every 60 seconds to look for new alerts/resets. * The default warning interval for all node down events is 120 seconds. So, for…

Disclaimer, this is from the airport on my phone, so I am not 100% as I am doing this from memory, but try this: SELECT Nodes.NodeCaption AS 'Node', ConfigArchive.ConfigType, MAX(ConfigArchive.DownloadTime) FROM [ConfigMgmt].[dbo].[Nodes] JOIN [ConfigMgmt].[dbo].[ConfigArchive] ON Nodes.NodeID=ConfigArchive.NodeID GROUP BY…

Is the account a local Orion account or one from Active Directory? I've seen issues before with the SDK passing permissions using AD accounts, typically creating a local Orion account with a strong password has been my work-around.

1) Create a group summary page 2) Customize page 3) Select View Limitations 4) Select your limitation category. (Group of Groups allows you to select groups via check boxes. The Group Name Pattern option selects groups by matching a string you define using % as a wildcard) -ZackM http://www.loop1systems.com

Can you send a screenshot of the alert trigger screen? It sounds like you're missing a join. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

Are you using the new web alert engine or the older Advanced Alert Manager application on your server? -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

In Filters/nDepth/Rules, the Threat Intelligence Feed options are (should be) True/False drop down options as such: I just tested this in my lab with LEM 6.2.0 installed and every section looked the same with the WebTrafficAudit event type used. -ZackM Loop1 Systems: SolarWinds Training and Professional Services *…

you were so close! After you select your content, then click on Edit Resource, which will open a page where you can add time limits and edit the types of events in your report. -ZackM http://www.loop1systems.com

Try the built-in 'Login Information for Each Device' report in NCM reports. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

My initial thought would be to set the task to restart itself (Properties > Settings > "If the task fails, restart every____" Otherwise you could look at the SCHTASKS options in PowerShell: http://technet.microsoft.com/en-us/library/cc725744.aspx#BKMK_run -ZackM Loop1 Systems: SolarWinds Training and Professional Services…

try this to find your historical data: select * from dbo.APM_StatisticsUsagewhere componentid in (select componentid from apm_sqlbbcomponentalertsdata where componentname like 'Transaction%') -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter:…

* Other than troubleshooting, how do you make use of your flow data? * How often do you look at flow data summaries, and in what form (on-demand via HTML form, automated reporting, CLI top-talkers, etc.)? * Summaries have the side effect of masking more granular data, i.e. smaller flows that might be interesting. In your…

can you paste your results and OID here?

I've done this using syslog. set the alert to fire a syslog message. set a rule in syslog viewer to send an email after XX messages with XX time period.

XtremIO are monitored through API http://www.solarwinds.com/documentation/en/flarehelp/srm/content/srm-emc-xtremio.htm?cshid=SRMHGHowToConfigureXtremIO -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Loop1 Twitter: @Loop1Systems * ZackM Twitter:…

This should get you pointed in the right direction if you really want to use SQL (but I would HIGHLY recommend just making this in the web report writer). Note that it may not be 100% perfect, my test DB is down for maintenance right now. To answer you 2nd question, you should be able to chart the devices in a line chart…

what are you going to use as your source? Is the new name of the component stored inside of SolarWinds SAM as well, or do you need to provide that data from an external source? as for the SolarWinds portion, what you're looking for is the Set-SwisObject cmdlet PowerShell · solarwinds/OrionSDK Wiki · GitHub If the data is…

The problem you're going to run into is your event log retention (which also happens to be the alert log retention) is defaulted to 30 days. If you edit this, then the answer is yes. -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter:…

you can run this against your database to get that: SELECTCaption, IP_Address, Vendor, MachineTypeFROM NodesWHERE NodeID NOT IN (SELECT CoreNodeID FROM NCM_NodeProperties) -ZackM Loop1 Systems: SolarWinds Training and Professional Services * LinkedIN: Loop1 Systems * Facebook: Loop1 Systems * Twitter: @Loop1Systems

This is one that can be accomplished in the GUI, no need for custom SQL/SWQL Go to the Manage Reports section and start building a new report using a 'Custom Table' resource. Make sure you select "Component" as the object you want to report on; then create whatever type of filter you need to find the component(s) you're…

Here you go Top_XX_Routing_Flaps.OrionReport

if you know the specific time, you should be able to achieve something like this with a count of the records meeting your expectations. assuming a default 10min statistic polling interval; you'll have 288 records (+/- 1 record) in a 48 hour window. SELECT NodeID ,COUNT(1) FROM Orion.CPULoad WHERE AvgLoad = 28 AND DateTime…

Did you setup a reset condition? It should be the tab right next to the trigger condition and you can set it up like this: Once you have a reset condition, you should be able to test your reset action successfully. If you are still having issues, I would use the "Copy Actions to Reset" button on the "Trigger Actions" tab…

The polling rate is a representation of the load on your server based primarily on your ICMP/SNMP/WMI polls from NPM and the physical capabilities of the actual server. Generally speaking, this rate is fine until it hits 90%. At that point, you would definitely want to make some changes. However, if it is something that…

Your database has not been updated in over 8 days. I would try running the configuration wizard to see if you can repair the connection. Otherwise, you will need to open a ticket with SolarWinds Support. Have there been any recent changes to your polling engine, database, or firewalls between the two? -ZackM Loop1 Systems:…

You need to limit the highlighted area. (or just remove it entirely as the UCSStatus will only apply to UCS devices, which is what I assume you want)

Cisco IOS IP Service Level Agreements User Guide [IP Application Services] - Cisco Systems TCP ports and Microsoft Exchange: In-depth discussion I would probably just setup a TCP Connect Operation from the router to the endpoint in question. I'm curious though, why not just setup your endpoint in NPM and get response times…

The only way to do that would be by using a Custom Property called "DeviceType" (or something similar) and then using that to group your report. There is not a native field in Orion that shows the "type" of device. The next closest would be using the native fields of "Vendor" and "MachineType" (model); but there are a…