Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 13

Show us a NOC view and (don't ) get 500 thwack points (we still want to see, points no longer awarded)

The User Experience group wants to see how you've customized your Orion to create your own NOC view, or NOC views you like and are using from other products.  What do you like about your NOC view? What challenges, frustrations or issues do you have with it?--Show us your NOC view either here OR email it directly to me at and share your NOC view stories by August 10 and we'll award you 500 thwack points for sharing.

UPDATE: we're no longer awarding points for this, but it's become a really popular post.  Please continue to share how you create NOC views, pictures of them, etc with each other as there has been clear value to users in seeing what other users do, but UX can no longer award points for this.

Message was edited by: Kellie Mecham

357 Replies

Its simple:  if stuff is broke then it is displayed as broke.  If it isn't, then it isn't.

I have a system of reports - eg I have a report sent to me with the days most used space.  At the moment I am doing this manually, but HOPEFULLY I can get a more detailed representative of what is using storage, CPU, memory ect and then have the relevant parties sent an email so that I have less work to do.

Our stuff just works. The only two issues I am having is oracle not polling (which I am aware about) and esxl hardware not polling.  Again, these two are slowly getting fixed.

When these are all online and polling I would have 100% up on everything.

I love uniformity.  There should be no orange, red, grey, blue or any other colour, other than green.

People hate the lack of content on the front screen and you have to actively tunnel through pages to view them.  But no one bothered to turn up to any technical meetings, so if you can't spare 30 minutes of your time to design what it will look like, then simply there will only be my creative input.

I like and love very little detail, so that's what we have.

@ the dog comment.  With a series of overly complicated scripts, filters and some applications, I see only what I want to see.  Eg - I don't have a dog, so I won't see dog food.

I like PC's and all PC related things, so I see that.

The rest is remembering things such as an IP address/website or, allowing that content to be filtered.

I will take a screenshot of my home desktop and youtube and post them here for everyone to laugh at.  That's even more minimal.

0 Kudos

P.S. I still don't understand why your top 10 is empty though

With Gratitude,
Alex Soul
0 Kudos

As funny as it all sounds, with some elements of sarcasm as well , I am 100% with you. You have extremely valid points. There should be nothing, but green. Besides, there should be as few greens as possible. Instead of displaying 100s green dots for every server - consolidate them into one dot, that's it. It goes hand in hand with my monitoring philosophy as well - less is more! As a matter of fact, all my deployments so far have been hugely focused on that exact thing - if you don't have issues, then you have "empty" dashboard. So, I salute your approach. Honestly, well done!

However, even with such mind-set there is still huge degree for improvement around ability to see overall status across your entire infrastructure on a single screen. Check this out - this screen includes thousands of elements, nodes, interfaces, volumes, apps - everything aggregated into one view with just few blobs. I am actually even considering getting rid of bottom two rows and leaving only service-related icons instead (those cloud-shape icons above). That's it!


With Gratitude,
Alex Soul


Really, please, please, please for the sake of my OCD make them all the same symbol.  Just something simple like a blob, or a square, or IDK anything.

With my environment and my groupings I can drill down:


Server farm 1

  -- Customer 1

  -- Customer 2

  -- Customer 3

      -- Servers

          -- Applications

And so forth.  I designed it in how I live my life:  The very top level is very basic and as you drill down you can then pick and choose where you want to view and go.  The groupings are what makes my environment up.  I have considerably a very large custom groups that fit everything together and eventually I want the solarwinds database to then interact with the hardware within service-now.  So that when a node is deleted/unmanaged, it will change within service-now and record this information.

Basically it's a top 10 list of nodes that are down/packet loss.  If my nodes aren't down then nothing is wrong.

0 Kudos

Ye, your are right. I will make them all same in new deployment. Actually, this question is being asked all the time - why they are different My answer - bla-bla-bla... well, there is an answer, but you know what - it is irrelevant. Thinking about it now - I would give it a go and make them all the same. Tanks for pointing this one out

1. OK, top 10 is not actually "top 10" really. It is just a list of down nodes. Well, on occasion some alive nodes would pop in there with some packet loss as well. I would not call it "top 10" though.

This is what I have on dashboard:

When there are down nodes - you see this


when there is nothing down - it shows nothing:


2. With your grouping - how would you know from the top level view if your disk space has breached warning/critical threshold?

With Gratitude,
Alex Soul

I would know and do know from reporting.

I have a report that is sent to me everyday at 8am and it will show a list of disks that have only 10% storage left.

If the disk breaks the 5% threshold then an alert is sent out.  We have a maybe small estate (1,000 ish nodes) so it's not a massive amount of work.

I am guessing that if I have 100,000 + nodes then I would have to approach it a different way.  But for the level of servers and workstations that we have, it just works for us.

Though I am still massively unhappy with it.  I want to do more with it in the lines of automation.

0 Kudos
Level 13

What if I don't have one because I hate clutter and lots of little things around me?
And for example, I have simply done lots of groups to represent my estate?

0 Kudos

Hahaha... you made me laugh

When I find someone selling a dog food online I usually just ignore - simply because I don't have a dog in the first place.

"- Hey Mr. Chow Chow, I have noticed that you are selling a dog food online, but what if I don't have one, because I hate their smell and I don't have the time to walk them. I simply have a cat - less maintenance."

I wonder what he would reply.... lol

With Gratitude,
Alex Soul
0 Kudos
Level 13

orion noc view.png

NOC screens CalHse.jpg

Some application topology, summary screens and network topology. Some screens roll with multiple views and all are driven by Chrome & the Revolver extension. Screens 2 & 3 have columns of interest eg AD servers,  SAN fabric, WAN facing interfaces, etc where the big blob is the up/down status followed by a list of down then a list of muted (known down, but being fixed) and a few have other info under these widgets too. All the relevant resources are selected with custom properties, dynamic groups and some with the filter within each widget. The blobs are created with maps.

Make it big & simple & in their face.

Beautiful! "big & simple & in their face" - exactly what's needed Nice work!

With Gratitude,
Alex Soul
0 Kudos
Level 11

Keeping the NOC views simple is the best route for escalation.

I created a duplicated Alerts View resource and filter specific alerts to be viewed by NOC, in this case, my alert is called "Critical" (See swql code)

I used custom properties on each node to identify if the server is in production, and trigger the "escalation" support contact from the alerts message.

The same concept is also used on the Production-App Alerts as well.

(SWQL Code below)



  o.AlertConfigurations.Name AS [ALERT NAME] 

    ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]


WHEN o.AlertConfigurations.Severity = '0' THEN ('/Orion/images/ActiveAlerts/Serious.png')

WHEN o.AlertConfigurations.Severity = '1' THEN ('/Orion/images/ActiveAlerts/Warning.png')

WHEN o.AlertConfigurations.Severity = '2' THEN ('/Orion/images/ActiveAlerts/Critical.png')

WHEN o.AlertConfigurations.Severity = '3' THEN ('/Orion/images/ActiveAlerts/InformationalAlert.png')

WHEN o.AlertConfigurations.Severity = '4' THEN ('/Orion/images/ActiveAlerts/Notice.png')

End as [_IconFor_ALERT NAME]

  ,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE] 

  ,o.EntityCaption AS [ALERT OBJECT] 

  ,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]

,CASE WHEN o.AlertActive.TriggeredDateTime IS NULL THEN NULL ELSE (

    TOSTRING(FLOOR(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0)) + 'h ' +

    TOSTRING(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())%60) + 'm'


    ,o.RelatedNodeCaption AS [RELATED NODE] 

,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE] 

FROM Orion.AlertObjects o 

WHERE o.AlertActive.TriggeredMessage <> '' and o.AlertConfigurations.Name = 'Critical'

ORDER by o.AlertActive.TriggeredDateTime

Level 8

Emailed you directly

Level 9

Let me share our NOC screen:



Alex, I really like this. It gets right to the point and is actually something I am trying to do in my own shop.

Level 11


Level 11

Here is our typical NOC view where we use Summary, Map, Active Alerts, HW Health, End of Support and Last 25 events.


Level 13

Here is my  NOC page   meech


Level 8

I like the map in the middle and how you added clocks for the parts of the world you care about.  Thanks for sharing

0 Kudos