Netpath alert to event log
RuckusVS100 Poller doesn't show connected clients... Can someone me Help!
I need to be able to see connected clients (just like Cisco) however the Solarwinds Supplied VS100 Poller doesn't seem to be able to collect that info. Has someone been able to crack this nut or can anyone offer some guidance?
Interface and description name separator.
There is a separator that is separating the interface name and its description on solarwinds, The alert string whcih comes is something like this "Interface GigabitEthernet1/0/11· # TO AP2(${NetObjectName}, or :{InterfaceName} # for node XYZ(node name) is Down", when this alert is being processed to create a ticket using SNOW(Service now), the ticket is getting encrypted due to a special character that is separating the interface name and description.
Example: this is the interface name and description-"Interface GigabitEthernet1/0/11· # TO AP2" and this is the operator "·" which is getting converted to this when it is reaching SNOW is  and the ticket is getting encrypted, but from the ticketing side all the exclusions have been applied.
Can anyone have a fix for this as this is a very serious issue for us.
Create 1 alert for all locations
Hi,
We basically have today 1 alert per city (more or less 70 locations) that trigger when node of the city goes down.
What I'm trying to do with no success is to have only one alert that trigger when a node goes down and then in the trigger actions, do "if the node is part of this city then send a mail to this mail".
So it basically becomes :
if the node goes down
if the node is in city A, send a mail to cityA@company.com
if the node is in city B, send a mail to cityB@company.com
Thanks in advance
NPM database creation
Can a domain account be used to create NPM database in SQL or does it have to be a local account?
Discovery has failed due to the following: Import Failed - License Exceeded
OK, this one is a puzzle. No details on WHICH license was exceeded, however, looking at all the current licenses used, none are maxed out. The closest is NCM at 99 out of 100, but the discovery did not include any devices to be managed by NCM. Orion Platform has 2100 of which there are 547 nodes and 1437 volumes. Do I add the two together, or is that 2100 nodes and 2100 volumes? NPM has 2000 interfaces and 1576 are in use, and the discovery showed only 4.
Where do I find the log that tells me which license was exceeded? The link under summary just refreshes the summary page.
Encrypt .pdf attachment on scheduled report
In an NPM 10.7 environment we have a report assembled that we'd like to e-mail however it contains sensitive information regarding our environment. Is there a way to encrypt the report .pdf file that's attached to the e-mail that gets distributed?
Orion Alert History Table Retention (Post NPM 11.5)
As confirmed by LadaVarga's response , there is no way to set a retention period for the Alert History table. And I specifically mean the table in the Orion database called AlertHistory, not the Active Alerts table in the web console. We have a ton of alerts and our Alert History table is HUGE. I can query it and get results from as long ago as 12/24/2015, which is a lot more than the 60 days our "Event Retention" setting is set at. I bring up the Event Retention because in LadaVarga's reply I to she mentions that the AlertHistory table uses the Event Retention time, which doesn't seem to be true since our Events table only has the last 60 days worth of events whereas our AlertHistory table has 9 months of events. I also find that 9 months is a pretty odd number of days since I don't see any setting in our Polling Settings where we have 270 days set as the retention period...
I see a Stored Procedure in the Orion database called dbm_AlertHistory_DeleteStale, but what process within the Orion software uses this procedure and how can we decide the datetime value to feed into this? Because of the AlertHistory table's size, a lot of our Orion web console views that display historical alert information take a really long time to load. Our SWISv3 logs are fully of "Query Took a Long Time to Execute" warnings and nearly every one of those queries causing the warning are against the AlertHistory table.
Is it safe for me to copy/paste the SQL from this stored procedure and manually run it with the datetime variable defined to a value of my choosing? I'm thinking anything older than 90 days needs to go. What effect will this have on the Alert Details views since they give a lot of historical info about the alerts, like how many times a particular object has triggered this alert for example?
Need to create Event report for Neighbor down
I can create a report for existing neighbors, but how do I make one that will show how many neighbor down events happen in a 7 day period? I would like to run it on a group of routers if possible.
QoE not discovering traffic for PCoIP and other applications
I have QoE setup as NPAS using a dedicated server and nic connected to a spanning port interface on the datacenter switch. I added the server that dedicated server as the Packet Analysis Sensor. I added all the applications I want to discover and collect for QoE. The dedicated server is discovering several applications but some other applications are not being discovered. Is there something I need to do in order for certain applications like PCoIP to be discovered?
Temperature sensor/thermometer that works with NPM
Wondering if anyone has monitored a dedicated temperature sensor/thermometer is Solarwinds, if so which vendor and model number?
Thanks!
NPM Installation on Server Running NCM
I have an NCM server running with a named instance instead of the default SQL Express instance. I am trying to add NPM to the same server and says:
service mssql sqlexpress was not found on computer
All I can find by way of support is that NPM should have been installed first, then NCM. Has anyone gotten the NPM installation to take utilizing a named instance of SQL? Is there a config file I can edit to make this point to the named instance instead of looking for the default?
Sending GET or POST URL as trigger action but variables are not consistently parsed
Hello
I am using the alert trigger action "Send a GET or POST request to a URL" trigger action to interface with other APIs. This is on NPM 11.5 and NPM 12
The request gets sent but the variables do not always get populated. Instead of the value of the variable being sent, only the variable name is sent.
It is as if it is not being parsed by the alert engine before getting sent.
For example
One of the URLs I am posting to is "https://events.pagerduty.com/generic/2010-04-15/create_event.json"
The payload is
{
"service_key": "~",
"event_type": "trigger",
"description": "An issue has been detected at ${N=Alerting;M=AlertTriggerTime;F=DateTime} on ${N=SwisEntity;M=MachineType} device named ${N=SwisEntity;M=Caption} (IP: ${N=SwisEntity;M=IP_Address}, DNS: ${N=SwisEntity;M=DNS})The Last Boot values are below: The old value is : ${SQL: SELECT PreviousValue FROM solarwinds.dbo.AlertValueChanges order by Changed desc} The new value is: ${SQL: SELECT NewValue FROM solarwinds.dbo.AlertValueChanges order by Changed desc} The change was detected at : ${SQL: SELECT Changed FROM solarwinds.dbo.AlertValueChanges order by Changed desc}",
"details": {},
"client": "Solarwinds Orion",
"client_url": "",
"contexts": []
}
The result actually sent to the URL is below. The variables that show up are in blue, the ones that do not are in red.
An issue has been detected at Never on symmetraUPS 16kVA device named 217-ServerRm-UPS 2 (IP: ##.###.###.###, DNS: )The Last Boot values are below: The old value is : ${SQL: SELECT PreviousValue FROM solarwinds.dbo.AlertValueChanges order by Changed desc} The new value is: ${SQL: SELECT NewValue FROM solarwinds.dbo.AlertValueChanges order by Changed desc} The change was detected at : ${SQL: SELECT Changed FROM solarwinds.dbo.AlertValueChanges order by Changed desc}
When this same payload is sent via email, all variables are parsed and populated with values.
Below is an actual email received from the email action earlier this week.
An issue has been detected at Monday, September 19, 2016 1:17 PM on symmetraUPS 16kVA device named 217-ServerRm-UPS 2 (IP: ##.###.###.###, DNS: )
This alert is triggered when the "Last Boot" value on the device changes. The implication is that the device has rebooted, but that may not be the case.
Please investigate.
The Last Boot values are below:
The old value is : Sep 19 2016 1:01PM
The new value is: Sep 19 2016 1:13PM
The change was detected at : 9/19/2016 1:17:24 PM
There is another API I have been testing with that puts this info in Splunk.
In that case not even the non SQL variables are parsed and show up as just the variable names.
{"solarwinds_event":{"key":"value","AlertMessage":"An issue has been detected at ${N=Alerting;M=AlertTriggerTime;F=DateTime} on ${N=SwisEntity;M=MachineType} device named ${N=SwisEntity;M=Caption} (IP: ${N=SwisEntity;M=IP_Address}, DNS: ${N=SwisEntity;M=DNS})","client":"Solarwinds NPM","client_url":""}}
I looked in the NPM admin guide https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/NPM_Administrator_Guide/0P0_Available_al…
to see if there was any info on escape chars, variable usage in the payload, or anything that might help but the information is very basic.
Has anyone figured out how to get variables to consistently populate using this action?
While I could use the run script or exe action and send the data that way, it would be nice if I could just use the built-in action seemingly created for this purpose.
Need Some Migration Help
Hi, we are planning on migrating our existing SolarWinds installation from server 2008 sp1 (NON-R2) to Server 2012 R2 before upgrading to NPM v12. I don’t quite understand everything that needs to be done, especially with NTA and its internal database. Any help is greatly appreciated.
Here is the current Setup:
- Orion01
- Server 2008 SP1
- Single (only) Poller
- Holds ALL roles except NTA database
- Receives all sylogs, traps, etc
- NPM, NCM, IPAM, NTA, FSM
- Orion02
- Holds NTA Storage Database
We want to migrate Orion01 to a new server (call it Orion001) with server 2012 R2
Here are the step that I think we are supposed to take, but I am not real comfortable with them:
- Stop all Orion Services on Orion01 and Orion02
- Backup the Orion database
- Restore the database to a different database server
- Install all components on Orion001 and connect to restored database
- Shutdown Orion01
- Rename and Re-IP Orion001 to Orion01
Cisco ASA 5505 VPN
I am trying to set up a universal poller to give me the username when a user connects via vpn to our companies asa5505. It is running the following version; Cisco Adaptive Security Appliance Software Version 8.0(4)28.
Report that list the number of concurrent logged in users with account id?
We currently have the concurrent logged in users report, I was wondering if its possible to see what user id's are currently logged into solarwinds web gui...?
Custom Graphs to display the Amount of Down devices, Events, Alerts, etc.
Having some trouble with this, but I was wondering if anyone knows how to create a Graph that displays the the Amount of Down Devices over a specified time frame... or the Amount of Alerts, etc. I basically need a Graph (not a table) that shows me how many nodes went down every minute over the last hour, or every hour over the last day... etc, etc.
Also, same thing but with Alerts or Events and how many have been triggered over a time frame.
Any help would be greatly appreciated,
Thanks,
NetPath not polling
I've created a NetPath to poll from a server to the vendor via their VPN connection. I get the "First Poll not yet complete." But when checking the firewall I never see an attempt from that server to the port that I've designated. I could use some diagnostic suggestions.
Upgrading all of our services to NPM 12
Hey folks, I'm doing a little bit of research about upgrading all of our services to the latest 12.0 release. I went to the upgrade advisor wizard and plugged everything in and here's what it recommended.
1 | Upgrade Network Performance Monitor from version 11.5.3 to version 12.0 |
2 | Upgrade Network Configuration Manager from version 7.4.1 to version 7.5.0 |
3 | Upgrade User Device Tracker from version 3.2.3 to version 3.2.4 |
4 | Upgrade Server & Application Monitor from version 6.2.3 to version 6.2.4 |
Now at the bottom of SW we also have DPA 10.0.1, VNQM 4.2.3, 2.1.1, & QOE 2.0, I couldn't find these in the wizard, are these just components of the major ones or do these have another name in the wizard that doesn't follow the abbreviations? And lastly, are there any recommendations for the upgrade other than installing them in order?Just trying to get as much info as I can before we make the jump. Thanks
Splitting Discoveries
Some background:
My organization uses 2 sets of class A networks internally, one legacy and one the new standard. For this post I will call the Legacy 20.0.0.0/8 and the new 10.0.0.0. We have remote sites grouped in the 20.1.0.0 - 20.128.255.255 range with and equivalent on the 10.0.0.0 side along with a few class B subnets for datacenters and the like.. Not all device have the new 10.0.0.0 network yet so what I do for one I have to do for the other.
The Issue:
There has never been a good way of tracking network equipment implemented and I am trying to correct that but it seems ever few weeks someone is telling me about something that wasn't on any list or was previously down for so long that it never made it into a SolarWinds import. I would like to schedule discoveries to try to correct this. They would be primarily SNMP discoveries with testing for NCM. No WMI, vmware, or any of that fun. I would like to have some suggestions as to how I should carve up this massive IP space into something manageable by a discovery process. I am open to any suggestions (except doing it by each class C because I think the shear volume of discoveries would be a problem then, not to mention going through them all).