cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 11

Automatically ignore volume/interface types that are discovered via Network Sonar Discovery

I am beginning to implement Network Sonar Discovery in my Orion environment that already has 1,900+ Nodes. The plan is to use it to find systems that have slipped through the cracks and are not in Orion, and to discover new interfaces/volumes that are not being monitored yet.


The problem I am having is there is lots of noise around things that Network Sonar has picked up, such as Loopback interfaces, and Removable media volumes. I need a way to automate adding such items to the ignore list.

I have looked through the database, and the tables for the discovery do not make immediate sense. Can someone out there describe how items are put into the tables from a discovery, and how they are moved/copied to the ignore tables?

 

Thanks

9 Replies
Level 12

Has anyone made any significant changes to these jobs ?  This looks like a game changer IMO.  So glad I found this article.  I'm getting ready to buy a few Monsters and knock this OUT!

0 Kudos

Updated this Scripted, works Great!!!

After each Discovery Scan, make an SQL Job with these three Steps.

IT will go thru the discovery results and automatically add interfaces and volumes to the "ignore list"

leaving ONLY the NEW interfaces and volumes.

Things to Change for YOUR database, EngineID (ours is 2, make yours based on Engine Table)

If you want to Add/Remove Interface/Volume Types, then you need to update BOTH Steps 1 and Step 2 or 3 where clauses.

Step1: Discovery Ignore Nodes

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

select Distinct 2 as EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DataAdded

From DiscoveredNodes

Inner Join DiscoveredInterfaces

On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

Where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

and NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1

or (DiscoveredInterfaces.InterfaceName like '%QoS%'

   or DiscoveredInterfaces.InterfaceName like '%WFP%'

   or DiscoveredInterfaces.InterfaceName like '%WAN%'

   or DiscoveredInterfaces.InterfaceName like '%NDIS VBD Client%'

   or DiscoveredInterfaces.InterfaceName like '%Bluetooth Device%'

   or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

   or DiscoveredInterfaces.AdminStatus = 2

   or DiscoveredInterfaces.InterfaceType = 24)

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

Select DISTINCT 2 as EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DataAdded

From DiscoveredNodes

Inner Join DiscoveredVolumes

On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

   or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

   or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Page%'

   or DiscoveredVolumes.VolumeDescription like '%Printer HDD%')

UPDATE DiscoveredNodes

SET IgnoredNodeID = DiscoveryIgnoredNodes.ID

FROM DiscoveryIgnoredNodes

Where DiscoveryIgnoredNodes.IPAddress = DiscoveredNodes.IPAddress and DiscoveredNodes.IgnoredNodeID is Null

Step 2: Discovery Ignored Interfaces

INSERT INTO DiscoveryIgnoredInterfaces (IgnoredNodeID, PhysicalAddress, Description, Caption, Type, IfxName, DateAdded)

Select DiscoveredNodes.IgnoredNodeID, DiscoveredInterfaces.PhysicalAddress, DiscoveredInterfaces.InterfaceName as Description, (DiscoveredInterfaces.InterfaceName + ' - ' + DiscoveredInterfaces.IfName) as Caption, DiscoveredInterfaces.InterfaceType as Type, DiscoveredInterfaces.IfName as IfxName, getdate() as DateAdded

From DiscoveredNodes

Inner Join DiscoveredInterfaces

On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredInterfaces.IgnoredInterfaceID is null

and NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1

or (DiscoveredInterfaces.InterfaceName like '%QoS%'

   or DiscoveredInterfaces.InterfaceName like '%WFP%'

   or DiscoveredInterfaces.InterfaceName like '%WAN%'

   or DiscoveredInterfaces.InterfaceName like '%NDIS VBD Client%'

   or DiscoveredInterfaces.InterfaceName like '%Bluetooth Device%'

   or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

   or DiscoveredInterfaces.AdminStatus = 2

   or DiscoveredInterfaces.InterfaceType = 24)

UPDATE DiscoveredInterfaces

SET IgnoredInterfaceID = Source.IgnoredInterfaceID

FROM

(SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.InterfaceIndex, Di.InterfaceSubType, DII.ID as IgnoredInterfaceID

FROM DiscoveryIgnoredInterfaces as DII

JOIN DiscoveredNodes as DN

ON DII.IgnoredNodeID = DN.IgnoredNodeID

JOIN DiscoveredInterfaces as DI

ON DII.IFxName= DI.IfName and DII.Description = DI.InterfaceName and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

where DI.IgnoredInterfaceID is null) as Source

WHERE DiscoveredInterfaces.ProfileID = Source.ProfileID

and DiscoveredInterfaces.DiscoveredNodeID = Source.DiscoveredNodeID

and DiscoveredInterfaces.InterfaceIndex = source.InterfaceIndex

and DiscoveredInterfaces.InterfaceSubType = Source.InterfaceSubType

Step 3: Discovery Ignored Volumes

INSERT INTO DiscoveryIgnoredVolumes (IgnoredNodeID, Description, Type, DateAdded)

Select DiscoveredNodes.IgnoredNodeID, DiscoveredVolumes.VolumeDescription as Description, DiscoveredVolumes.VolumeType as Type, getdate() as DateAdded

From DiscoveredNodes

Inner Join DiscoveredVolumes

On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredVolumes.IgnoredVolumeID is null

and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

   or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

   or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Page%'

   or DiscoveredVolumes.VolumeDescription like '%Printer HDD%')

UPDATE DiscoveredVolumes

SET IgnoredVolumeID = Source.IgnoredVolumeID

FROM

(SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.VolumeIndex, DII.ID as IgnoredVolumeID

FROM DiscoveryIgnoredVolumes as DII

JOIN DiscoveredNodes as DN

ON DII.IgnoredNodeID = DN.IgnoredNodeID

JOIN DiscoveredVolumes as DI

ON DII.Type = DI.VolumeType and DII.Description = DI.VolumeDescription and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

where DI.IgnoredVolumeID is null) as Source

WHERE DiscoveredVolumes.ProfileID = Source.ProfileID

and DiscoveredVolumes.DiscoveredNodeID = Source.DiscoveredNodeID

and DiscoveredVolumes.VolumeIndex = source.VolumeIndex

thankyou Micheal for your post, i want to use it, Please guide me to this

0 Kudos

This helped tremendously.  While this script was more involved than what I wanted, I was able to use it as a template and get to exactly where I wanted to be. 

One note, since I have so many polling engines, I set this up to be dynamic instead of hard-coded as it is in the query above - this pulls the EngineID from the polling engine assigned in the Discovery Profile that is set up for each job:

Instead of:

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

select Distinct 2 as EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DataAdded

From DiscoveredNodes

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

select EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DateAdded

From DiscoveredNodes

JOIN DiscoveryProfiles

on DiscoveryProfiles.ProfileID=DiscoveredNodes.ProfileID

...<rest of query>

So here is how we automatically remove Volumes and Interfaces from the Discovery results, its NOT 100% but it works pretty good.

Create an SQL Server Agent Jobs which runs on the Database Server: We called ours Solarwinds Network Discovery Ignore Rule

You are going to make THREE (3) Steps, one for the Nodes, One for the Interfaces and One from the Volumes.

Now I based these T-SQL commands based on what I WANT to auto ignore.  Examples: Virtual Interfaces which Windows generates with new indexes on every reboot.  CD-ROM, Floppy, Tape Drivers etc..

Interface Type was a really big issue, so I went with the other way, If the Type IS Ethernet, FiberChannel, Virtual etc... then allow me to import, else null, VPN, yadada ignore... Also to be safe anything Admin Disabled (shutdown) as well as caption names.

Volumes Types were an explicted list, IN list of Floppy, Cd-Rom, etc... BUT some items like Swap Files on Linux Boxes were not needed (always 100%) Printer Caches etc... so those were down by caption as well.

I run it in the 0600 after all the midnight discoveries.. works pretty good. Always looking for improvement.

Step 1: Name DiscoveryIgnoredNodes

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

Select DISTINCT 2, IPAddress, DiscoveredNodes.SysName as Caption, 0, getDate() as DataAdded

From DiscoveredNodes

Left Join DiscoveredInterfaces

On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

and (NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1)

   or DiscoveredInterfaces.InterfaceName like '%QoS%'

   or DiscoveredInterfaces.InterfaceName like '%WFP%'

   or DiscoveredInterfaces.InterfaceName like '%WAN%'

   or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

   or DiscoveredInterfaces.AdminStatus = 2

INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

Select DISTINCT 2, IPAddress, DiscoveredNodes.SysName as Caption, 0, getDate() as DataAdded

From DiscoveredNodes

Left Join DiscoveredVolumes

On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

   or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

   or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Page%'

   or DiscoveredVolumes.VolumeDescription like '%Printer HDD%'

   or DiscoveredVolumes.VolumeDescription like '%vmfs%')

UPDATE DiscoveredNodes

SET IgnoredNodeID = DiscoveryIgnoredNodes.ID

FROM DiscoveryIgnoredNodes

Where DiscoveryIgnoredNodes.IPAddress = DiscoveredNodes.IPAddress and DiscoveredNodes.IgnoredNodeID is Null

Step (2) Name: DiscoveryIgnoredInterfaces

INSERT INTO DiscoveryIgnoredInterfaces (IgnoredNodeID, PhysicalAddress, Description, Caption, Type, IfxName, DateAdded)

Select DiscoveredNodes.IgnoredNodeID, DiscoveredInterfaces.PhysicalAddress, DiscoveredInterfaces.InterfaceName as Description, (DiscoveredInterfaces.InterfaceName + ' - ' + DiscoveredInterfaces.IfName) as Caption, DiscoveredInterfaces.InterfaceType as Type, DiscoveredInterfaces.IfName as IfxName, getdate() as DateAdded

From DiscoveredNodes

Left Join DiscoveredInterfaces

On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredInterfaces.IgnoredInterfaceID is null

and (NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1)

   or DiscoveredInterfaces.InterfaceName like '%QoS%'

   or DiscoveredInterfaces.InterfaceName like '%WFP%'

   or DiscoveredInterfaces.InterfaceName like '%WAN%'

   or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

   or DiscoveredInterfaces.AdminStatus = 2

UPDATE DiscoveredInterfaces

SET IgnoredInterfaceID = Source.IgnoredInterfaceID

FROM

(SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.InterfaceIndex, Di.InterfaceSubType, DII.ID as IgnoredInterfaceID

FROM DiscoveryIgnoredInterfaces as DII

JOIN DiscoveredNodes as DN

ON DII.IgnoredNodeID = DN.IgnoredNodeID

JOIN DiscoveredInterfaces as DI

ON DII.IFxName= DI.IfName and DII.Description = DI.InterfaceName and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

where DI.IgnoredInterfaceID is null) as Source

WHERE DiscoveredInterfaces.ProfileID = Source.ProfileID

and DiscoveredInterfaces.DiscoveredNodeID = Source.DiscoveredNodeID

and DiscoveredInterfaces.InterfaceIndex = source.InterfaceIndex

and DiscoveredInterfaces.InterfaceSubType = Source.InterfaceSubType

Step (3) Name: DiscoveryIgnoredVolumes

INSERT INTO DiscoveryIgnoredVolumes (IgnoredNodeID, Description, Type, DateAdded)

Select DiscoveredNodes.IgnoredNodeID, DiscoveredVolumes.VolumeDescription as Description, DiscoveredVolumes.VolumeType as Type, getdate() as DateAdded

From DiscoveredNodes

Left Join DiscoveredVolumes

On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredVolumes.IgnoredVolumeID is null

and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

   or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

   or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

   or DiscoveredVolumes.VolumeDescription like '%Page%'

   or DiscoveredVolumes.VolumeDescription like '%Printer HDD%'

   or DiscoveredVolumes.VolumeDescription like '%vmfs%')

UPDATE DiscoveredVolumes

SET IgnoredVolumeID = Source.IgnoredVolumeID

FROM

(SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.VolumeIndex, DII.ID as IgnoredVolumeID

FROM DiscoveryIgnoredVolumes as DII

JOIN DiscoveredNodes as DN

ON DII.IgnoredNodeID = DN.IgnoredNodeID

JOIN DiscoveredVolumes as DI

ON DII.Type = DI.VolumeType and DII.Description = DI.VolumeDescription and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

where DI.IgnoredVolumeID is null) as Source

WHERE DiscoveredVolumes.ProfileID = Source.ProfileID

and DiscoveredVolumes.DiscoveredNodeID = Source.DiscoveredNodeID

and DiscoveredVolumes.VolumeIndex = source.VolumeIndex

This is amazing!!  Works as advertised!!

Honestly this is one of the most helpful posts I have come across!

0 Kudos
Level 13

I don't think it is advisable to make changes via database directly.Could you open a support ticket to help further?Would you also post back the ticket# and the solution.

0 Kudos

julrich,

Have you seen this post information on the content exchange? It should help you. Also, you could use the API to add nodes and interfaces. For more information about the SDK and how to access the API, see this post.

Mav

0 Kudos

Nandish, I already attempted to open a ticket, but they directed me here to get this information first.

 

mavturner, The API looks like nothing more than just a front end for creating SQL queries. What I am looking for is an understanding of how the process goes when an interfaces is added to the ignore list so I can create a SQL query to accomplish this task.

Example: Do the interfaces get added to DiscoveryPhysicalInterfaces when they are discovered, then moved to DiscoveryIgnoredInterfaces, or are they copied there...

0 Kudos