Have you tried the Orion Global Search technical preview?

Yes.  We installed OGS.  I like where OGS is headed, but this introduced a significant load on the primary polling engine - primarily sourcing from the elasticsearch-service-x64.exe process.

Hi Joe,

A couple of questions:

1) Did you work with our Engineering or Support Teams on this? If so, do you have a case number I can follow-up on?

2) Did the significant load persist after initial indexing was complete? There is some expectation that initial "offline indexing", which is responsible for indexing your historical data, will take cycles from CPU and an increased memory load, but that should significantly drop off after the initial indexing is finished and only "real-time" indexing is occurring.

3) About how big is your environment in terms of # of nodes, syslogs, traps?

To your overall point, the team is looking at a deployment option that would allow deploying the search service to another machine to avoid exactly this problem for environments where the Main Poller is resource constrained.

I am trying OGS, installed it last weekend, and it is still indexing my SNMP Traps and a few other resources. Does it take up some CPU Cycles "It sure does, and has maxed out my main polling server. I'm starting to think OSG would belong possible on it's own Orion Indexing server in larger environments.

When looking at the indexing status page it has been saying 2 minutes and 24 seconds for a while now. It has even lost some ground. Below is a good idea of where my OSG is stuck.

Hi Paul,

Thanks for the feedback! I'd like to have Engineering take a look at your system to see what's going on as this is not expected. Can you file a ticket with Support and then post your case number back here? Submit a Case | SolarWinds Customer Portal

We are definitely looking at options to offload indexing to another system (off the main poller) to address this type of situation.

Thanks!

I'm just posting this up - had some conversations with the product team - been using the global search for a few weeks, its an excellent addition.

So i'd had a few issues - replies are in line:

1) If I search for a mailbox by username  this is shown in the results, but clicking the resulting link takes me to the Exchange databases page, rather than the user mailbox page.

  a.   This is a known issue from the Tech Preview build. It will be fixed in an upcoming Beta build.

2) Is it possible to define the default number of results? It is currently 10, which I would like to increase

  a.       No, this is not currently possible.

3) The +more in the results – again any idea if this can be expanded by default?

a. No, this is not currently possible.

4) If I search for a node – I can see 2 results for the same node, basically the node – which links to node page, then what looks like a VM with no link. Is this because I don’t have the virtualisation manager? Just a little confusing to see both, when essentially they are the same thing (understand you can change this using the filter)

a. This is a known issue and will be fixed in an upcoming Beta build.

5)  Clicking create advanced query kills my browser with ‘not implemented’ messages – guessing you know this one !

a.       This is a known issue and will be fixed in an upcoming Beta build.

6) We have 100s of custom views, would live these to be searchable

a.       There is not currently a “view entity” that we can index and search. This is a valid feature request, but I’m not sure if/when it will happen as it expands the scope of the current implementation in a new direction.

7)  Is user device tracker being implemented into the GS? That would also be great to be able to return the user information from UDT in the search results.

a.       This is on the backlog to be delivered in a future release.

I think not being able to change the amount of result is a bit of a pain, with the amount of nodes and interfaces i have, (which isnt lots compared to others) 10 results per page is too small. I understand the point is to filter and search more efficiently, but 9/10 times i'm searching from the home page, so no type ahead. 10 doesnt event cover the entire page.

Can see why views are not included in search - but there has to be a better way to manage views and dashboards.

Being able to search syslog events would also be a massive plus as we currently use this for accounting auditing (i.e. user account lock outs) - would be nice to be able to search that.

All in all, top work chaps.

Thanks for the feedback Selspiero!

A couple of questions on your points of feedback:

• I think not being able to change the amount of result is a bit of a pain, with the amount of nodes and interfaces i have, (which isnt lots compared to others) 10 results per page is too small. I understand the point is to filter and search more efficiently, but 9/10 times i'm searching from the home page, so no type ahead. 10 doesnt event cover the entire page.

Are you finding that the item you were searching for is not in the top results? Are you searching for a specific entity type? In that case, you could search for Orion.Node.Name:"blah" for example instead of just searching for "blah." That might help filter out the irrelevant results.

• Being able to search syslog events would also be a massive plus as we currently use this for accounting auditing (i.e. user account lock outs) - would be nice to be able to search that.

You should be able to search syslogs that are being sent to your Orion server. Are you not able to do so (or not seeing that) in the Tech Preview build?

hi mate,

Yep - agree that the most relevant result is at the top - but like i said it is basically just me being lazy. A quick rough search from the search box brings back results, but i would prefer to see more. Sure, if it doesnt show me what i want i can just refine the search, but having a definable return results would be useful. This isn't a major issue - and mainly just how i search, which is probably the issue!

For syslogs - it doesn't seem to search the content of the syslog. So example would be an windows event log forwarder on our DCs. We forward specific events to syslog on the orion server, which then trigger an alert for the service desk guys if an account is locked out. In the syslog details there will the username of the account, the machine it was locked out from etc (we pass this in the notification email using the ${MESSAGE} variable. I can see from the indexing page that it has indexed the syslogs - but i guess it doesn't search the content.

This isn't a massive issue at all - but would be pretty cool to be able to look at a specific account and how many times its locked out over the last week if there was an issue.

scratch that - default time period is 24 hours, and there were no matching syslogs from that time. Changing to 7 days shows exactly what i need

Hi Selspiero,

Good to hear you were able to find the issue with the syslogs. :-)

On the search results, definitely a valid feature request. I'll see what we can do with schedules, etc. to see if that can be accommodated in a more customizable manner. As a potential workaround in the meantime, even though the default number of results per page is not user configurable [such that it always displays the same number of results every time you use OGS] – the user can change the number of results per browser session – it’s at the bottom of the page.

Please, add the "Export to CSV" feature to the Global Search.  Exporting to PDF has very limited use, and it includes the banner which is not good.  Also, the Advance Search button is still not working.  I would like to check it out when it is released.

Thanks!