9 Replies Latest reply on Feb 6, 2017 9:38 AM by nick_scott

    Automatically ignore volume/interface types that are discovered via Network Sonar Discovery

    julrich

      I am beginning to implement Network Sonar Discovery in my Orion environment that already has 1,900+ Nodes. The plan is to use it to find systems that have slipped through the cracks and are not in Orion, and to discover new interfaces/volumes that are not being monitored yet.


      The problem I am having is there is lots of noise around things that Network Sonar has picked up, such as Loopback interfaces, and Removable media volumes. I need a way to automate adding such items to the ignore list.

      I have looked through the database, and the tables for the discovery do not make immediate sense. Can someone out there describe how items are put into the tables from a discovery, and how they are moved/copied to the ignore tables?

       

      Thanks

        • Re: Automatically ignore volume/interface types that are discovered via Network Sonar Discovery
          Nandish

          I don't think it is advisable to make changes via database directly.Could you open a support ticket to help further?Would you also post back the ticket# and the solution.

          • Re: Automatically ignore volume/interface types that are discovered via Network Sonar Discovery
            michael.fusco

            So here is how we automatically remove Volumes and Interfaces from the Discovery results, its NOT 100% but it works pretty good.

             

            Create an SQL Server Agent Jobs which runs on the Database Server: We called ours Solarwinds Network Discovery Ignore Rule

            You are going to make THREE (3) Steps, one for the Nodes, One for the Interfaces and One from the Volumes.

             

            Now I based these T-SQL commands based on what I WANT to auto ignore.  Examples: Virtual Interfaces which Windows generates with new indexes on every reboot.  CD-ROM, Floppy, Tape Drivers etc..

             

            Interface Type was a really big issue, so I went with the other way, If the Type IS Ethernet, FiberChannel, Virtual etc... then allow me to import, else null, VPN, yadada ignore... Also to be safe anything Admin Disabled (shutdown) as well as caption names.

             

            Volumes Types were an explicted list, IN list of Floppy, Cd-Rom, etc... BUT some items like Swap Files on Linux Boxes were not needed (always 100%) Printer Caches etc... so those were down by caption as well.

             

            I run it in the 0600 after all the midnight discoveries.. works pretty good. Always looking for improvement.

             

             

            Step 1: Name DiscoveryIgnoredNodes

             

            INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

            Select DISTINCT 2, IPAddress, DiscoveredNodes.SysName as Caption, 0, getDate() as DataAdded

            From DiscoveredNodes

            Left Join DiscoveredInterfaces

            On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

            where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

            and (NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1)

               or DiscoveredInterfaces.InterfaceName like '%QoS%'

               or DiscoveredInterfaces.InterfaceName like '%WFP%'

               or DiscoveredInterfaces.InterfaceName like '%WAN%'

               or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

               or DiscoveredInterfaces.AdminStatus = 2

             

            INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

            Select DISTINCT 2, IPAddress, DiscoveredNodes.SysName as Caption, 0, getDate() as DataAdded

            From DiscoveredNodes

            Left Join DiscoveredVolumes

            On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

            where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

            and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

               or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

               or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

               or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

               or DiscoveredVolumes.VolumeDescription like '%Page%'

               or DiscoveredVolumes.VolumeDescription like '%Printer HDD%'

               or DiscoveredVolumes.VolumeDescription like '%vmfs%')

             

            UPDATE DiscoveredNodes

            SET IgnoredNodeID = DiscoveryIgnoredNodes.ID

            FROM DiscoveryIgnoredNodes

            Where DiscoveryIgnoredNodes.IPAddress = DiscoveredNodes.IPAddress and DiscoveredNodes.IgnoredNodeID is Null

             

            Step (2) Name: DiscoveryIgnoredInterfaces

             

            INSERT INTO DiscoveryIgnoredInterfaces (IgnoredNodeID, PhysicalAddress, Description, Caption, Type, IfxName, DateAdded)

            Select DiscoveredNodes.IgnoredNodeID, DiscoveredInterfaces.PhysicalAddress, DiscoveredInterfaces.InterfaceName as Description, (DiscoveredInterfaces.InterfaceName + ' - ' + DiscoveredInterfaces.IfName) as Caption, DiscoveredInterfaces.InterfaceType as Type, DiscoveredInterfaces.IfName as IfxName, getdate() as DateAdded

            From DiscoveredNodes

            Left Join DiscoveredInterfaces

            On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

            where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredInterfaces.IgnoredInterfaceID is null

            and (NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1)

               or DiscoveredInterfaces.InterfaceName like '%QoS%'

               or DiscoveredInterfaces.InterfaceName like '%WFP%'

               or DiscoveredInterfaces.InterfaceName like '%WAN%'

               or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

               or DiscoveredInterfaces.AdminStatus = 2

             

             

            UPDATE DiscoveredInterfaces

            SET IgnoredInterfaceID = Source.IgnoredInterfaceID

            FROM

            (SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.InterfaceIndex, Di.InterfaceSubType, DII.ID as IgnoredInterfaceID

            FROM DiscoveryIgnoredInterfaces as DII

            JOIN DiscoveredNodes as DN

            ON DII.IgnoredNodeID = DN.IgnoredNodeID

            JOIN DiscoveredInterfaces as DI

            ON DII.IFxName= DI.IfName and DII.Description = DI.InterfaceName and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

            where DI.IgnoredInterfaceID is null) as Source

            WHERE DiscoveredInterfaces.ProfileID = Source.ProfileID

            and DiscoveredInterfaces.DiscoveredNodeID = Source.DiscoveredNodeID

            and DiscoveredInterfaces.InterfaceIndex = source.InterfaceIndex

            and DiscoveredInterfaces.InterfaceSubType = Source.InterfaceSubType

             

            Step (3) Name: DiscoveryIgnoredVolumes

             

            INSERT INTO DiscoveryIgnoredVolumes (IgnoredNodeID, Description, Type, DateAdded)

            Select DiscoveredNodes.IgnoredNodeID, DiscoveredVolumes.VolumeDescription as Description, DiscoveredVolumes.VolumeType as Type, getdate() as DateAdded

            From DiscoveredNodes

            Left Join DiscoveredVolumes

            On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

            where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredVolumes.IgnoredVolumeID is null

            and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

               or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

               or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

               or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

               or DiscoveredVolumes.VolumeDescription like '%Page%'

               or DiscoveredVolumes.VolumeDescription like '%Printer HDD%'

               or DiscoveredVolumes.VolumeDescription like '%vmfs%')

             

            UPDATE DiscoveredVolumes

            SET IgnoredVolumeID = Source.IgnoredVolumeID

            FROM

            (SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.VolumeIndex, DII.ID as IgnoredVolumeID

            FROM DiscoveryIgnoredVolumes as DII

            JOIN DiscoveredNodes as DN

            ON DII.IgnoredNodeID = DN.IgnoredNodeID

            JOIN DiscoveredVolumes as DI

            ON DII.Type = DI.VolumeType and DII.Description = DI.VolumeDescription and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

            where DI.IgnoredVolumeID is null) as Source

            WHERE DiscoveredVolumes.ProfileID = Source.ProfileID

            and DiscoveredVolumes.DiscoveredNodeID = Source.DiscoveredNodeID

            and DiscoveredVolumes.VolumeIndex = source.VolumeIndex

            1 of 1 people found this helpful
            • Re: Automatically ignore volume/interface types that are discovered via Network Sonar Discovery
              michael.fusco

              Updated this Scripted, works Great!!!

              After each Discovery Scan, make an SQL Job with these three Steps.

              IT will go thru the discovery results and automatically add interfaces and volumes to the "ignore list"

              leaving ONLY the NEW interfaces and volumes.

               

              Things to Change for YOUR database, EngineID (ours is 2, make yours based on Engine Table)

               

              If you want to Add/Remove Interface/Volume Types, then you need to update BOTH Steps 1 and Step 2 or 3 where clauses.

               

               

              Step1: Discovery Ignore Nodes

              INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

              select Distinct 2 as EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DataAdded

              From DiscoveredNodes

              Inner Join DiscoveredInterfaces

              On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

              Where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

              and NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1

              or (DiscoveredInterfaces.InterfaceName like '%QoS%'

                 or DiscoveredInterfaces.InterfaceName like '%WFP%'

                 or DiscoveredInterfaces.InterfaceName like '%WAN%'

                 or DiscoveredInterfaces.InterfaceName like '%NDIS VBD Client%'

                 or DiscoveredInterfaces.InterfaceName like '%Bluetooth Device%'

                 or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

                 or DiscoveredInterfaces.AdminStatus = 2

                 or DiscoveredInterfaces.InterfaceType = 24)

               

              INSERT INTO DiscoveryIgnoredNodes (EngineID,IPAddress,Caption,IsIgnored,DateAdded)

              Select DISTINCT 2 as EngineID, IPAddress, DiscoveredNodes.SysName as Caption, 0 as IsIgnored, getDate() as DataAdded

              From DiscoveredNodes

              Inner Join DiscoveredVolumes

              On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

              where Not IPAddress In (Select IPAddress from DiscoveryIgnoredNodes) and not DiscoveredNodes.SysName is null

              and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

                 or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

                 or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

                 or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

                 or DiscoveredVolumes.VolumeDescription like '%Page%'

                 or DiscoveredVolumes.VolumeDescription like '%Printer HDD%')

               

              UPDATE DiscoveredNodes

              SET IgnoredNodeID = DiscoveryIgnoredNodes.ID

              FROM DiscoveryIgnoredNodes

              Where DiscoveryIgnoredNodes.IPAddress = DiscoveredNodes.IPAddress and DiscoveredNodes.IgnoredNodeID is Null

               

              Step 2: Discovery Ignored Interfaces

              INSERT INTO DiscoveryIgnoredInterfaces (IgnoredNodeID, PhysicalAddress, Description, Caption, Type, IfxName, DateAdded)

              Select DiscoveredNodes.IgnoredNodeID, DiscoveredInterfaces.PhysicalAddress, DiscoveredInterfaces.InterfaceName as Description, (DiscoveredInterfaces.InterfaceName + ' - ' + DiscoveredInterfaces.IfName) as Caption, DiscoveredInterfaces.InterfaceType as Type, DiscoveredInterfaces.IfName as IfxName, getdate() as DateAdded

              From DiscoveredNodes

              Inner Join DiscoveredInterfaces

              On DiscoveredNodes.NodeID = DiscoveredInterfaces.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredInterfaces.ProfileID

              where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredInterfaces.IgnoredInterfaceID is null

              and NOT DiscoveredInterfaces.InterfaceType in (6,53,54,56,135,161,224,258) and DiscoveredInterfaces.Virtual = 1

              or (DiscoveredInterfaces.InterfaceName like '%QoS%'

                 or DiscoveredInterfaces.InterfaceName like '%WFP%'

                 or DiscoveredInterfaces.InterfaceName like '%WAN%'

                 or DiscoveredInterfaces.InterfaceName like '%NDIS VBD Client%'

                 or DiscoveredInterfaces.InterfaceName like '%Bluetooth Device%'

                 or DiscoveredInterfaces.InterfaceName like '%Lightweight Filter Driver%'

                 or DiscoveredInterfaces.AdminStatus = 2

                 or DiscoveredInterfaces.InterfaceType = 24)

               

              UPDATE DiscoveredInterfaces

              SET IgnoredInterfaceID = Source.IgnoredInterfaceID

              FROM

              (SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.InterfaceIndex, Di.InterfaceSubType, DII.ID as IgnoredInterfaceID

              FROM DiscoveryIgnoredInterfaces as DII

              JOIN DiscoveredNodes as DN

              ON DII.IgnoredNodeID = DN.IgnoredNodeID

              JOIN DiscoveredInterfaces as DI

              ON DII.IFxName= DI.IfName and DII.Description = DI.InterfaceName and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

              where DI.IgnoredInterfaceID is null) as Source

              WHERE DiscoveredInterfaces.ProfileID = Source.ProfileID

              and DiscoveredInterfaces.DiscoveredNodeID = Source.DiscoveredNodeID

              and DiscoveredInterfaces.InterfaceIndex = source.InterfaceIndex

              and DiscoveredInterfaces.InterfaceSubType = Source.InterfaceSubType

               

              Step 3: Discovery Ignored Volumes

              INSERT INTO DiscoveryIgnoredVolumes (IgnoredNodeID, Description, Type, DateAdded)

              Select DiscoveredNodes.IgnoredNodeID, DiscoveredVolumes.VolumeDescription as Description, DiscoveredVolumes.VolumeType as Type, getdate() as DateAdded

              From DiscoveredNodes

              Inner Join DiscoveredVolumes

              On DiscoveredNodes.NodeID = DiscoveredVolumes.DiscoveredNodeID and DiscoveredNodes.ProfileID = DiscoveredVolumes.ProfileID

              where not DiscoveredNodes.IgnoredNodeID is Null and DiscoveredVolumes.IgnoredVolumeID is null

              and ( DiscoveredVolumes.VolumeType IN (0,1,5,7)

                 or DiscoveredVolumes.VolumeDescription like '%Swap Space%'

                 or DiscoveredVolumes.VolumeDescription like '%Random Access Memory%'

                 or DiscoveredVolumes.VolumeDescription like '%Real Memory%'

                 or DiscoveredVolumes.VolumeDescription like '%Page%'

                 or DiscoveredVolumes.VolumeDescription like '%Printer HDD%')

               

              UPDATE DiscoveredVolumes

              SET IgnoredVolumeID = Source.IgnoredVolumeID

              FROM

              (SELECT DI.ProfileID, DI.DiscoveredNodeID, DI.VolumeIndex, DII.ID as IgnoredVolumeID

              FROM DiscoveryIgnoredVolumes as DII

              JOIN DiscoveredNodes as DN

              ON DII.IgnoredNodeID = DN.IgnoredNodeID

              JOIN DiscoveredVolumes as DI

              ON DII.Type = DI.VolumeType and DII.Description = DI.VolumeDescription and DN.ProfileID = DI.ProfileID and DN.NodeID= DI.DiscoveredNodeID

              where DI.IgnoredVolumeID is null) as Source

              WHERE DiscoveredVolumes.ProfileID = Source.ProfileID

              and DiscoveredVolumes.DiscoveredNodeID = Source.DiscoveredNodeID

              and DiscoveredVolumes.VolumeIndex = source.VolumeIndex

              1 of 1 people found this helpful
              • Re: Automatically ignore volume/interface types that are discovered via Network Sonar Discovery
                nick_scott

                Has anyone made any significant changes to these jobs ?  This looks like a game changer IMO.  So glad I found this article.  I'm getting ready to buy a few Monsters and knock this OUT!