Is there a quick and easy way to stop my daily sonar discovery from telling me that there are tons and tons of newly found interfaces and volumes? There are hundreds of useless "WAN Miniport" interfaces and optical drives that I don't want in my daily discovery results. Is there an easier way to get rid of those without manually selecting each one and adding it to the ignore list?

We've recreated the Capacity View from here - http://oriondemo.solarwinds.com/Orion/SummaryView.aspx?ViewID=519 but as most are aware and you can tell from this pic, out of the box Orion still doesn't know the difference between a storage volume and real, physical, virtual memory.  So we like to exclude reporting them in Top 5 Volume Capacity.  However, the normal filter we use doesn't apply here.

Volumes.Caption<>'Cached memory' AND Volumes.Caption<>'Physical memory' AND Volumes.Caption<>'Virtual memory' AND Volumes.Caption<>'Real Memory'

So I''m assuming we need to use one of the available Forecast Properties.  Does anyone know which of the Forecast Capacity or ForcastMetrics properties we should be looking at the filter them?  Is there an easy way to pull up an object and see it's list or properties and their values?

Can someone explain polling engines and the number of them? Why would a company have 9??

I've only ever seen setups with single engines and single instances of NPM deployed.

I know there are folks out there that want to change the header logo and background image on their SolarWinds Orion instance to reflect the look and feel of your own company.

I want to share with everyone how to do this.  I am currently running Orion v11.5.2.

Changing the Logo in the header:

1. The file to edit is: inetpub\SolarWinds\Orion\Controls\PageHeader.ascx
2. Open the file with your favorite text editor. (The one I prefer is vi so I use gvim)
3. For changing the logo, find the line that looks like this:
   
4. Replace the <%= SiteLogoUri %> with the url or location for your logo.  examples: http:/mycompany.com/mycompanylogo.png
5. The image can also be put in the inetpub of Orion, in this case you would place the file in 'inetpub/SolarWinds/Orion/images/mycompanylogo.png'
6. The new line would like like this:Find the Style type named .sw-mainnav-branding, the section will look something like this:
   

               NOTE: the logo height is set to 55 pixels.

Changing the Header background image:

1. The file to edit is: inetpub\SolarWinds\Orion\Controls\PageHeader.ascx
2. Open the file with your favorite text editor. (The one I prefer is vi so I use gvim)
3. Find the style section named .sw-mainnav-branding
4. Change the background image URL to the desired image.  The image can be placed in the inetpub/SolarWinds/Orion/images/mybackground.png
5. The new section would look something like this:

.sw-mainnav-branding {    background-color: #FFFFFF ! important;    background-image: URL('/Orion/images/mybackground.png') ! important;    background-repeat: no-repeat;    background-position: top right;    height: 95px ! important;
}

Here is what ours looks like after the changes:

Post yours here to show off any cool options.

Hope this helps those that need it.

Deltona I hope this helps.

I'm building out a profile for our core 3925 router, looking for input on what you have on your core Router page.

For instance, I have a config tab, I display packet loss and response time graphs, vlans and CPU charts.

Any gems out there?

Hi Guys,

I think this is more of a design problem probably (or maybe bug).

I have noticed that Top XX Capacity Problem resource is missing ability to filter by Node's custom properties. They do not show up in example section either. When trying to filter by Node's custom properties I get error "A query to the SolarWinds Information Service failed"

Anyone experiencing same?

Within the Network tab, our Routing Table shows the error "This device's routing table has more entries than can be displayed in the table below. The data below is incomplete"  We have made the config file change mentioned in in the link in the error and restarted all services, but to no avail.

To top it off, there are dozens (hundreds?) of host entries (/32 subnet mask). This doesn't remotely resemble what show ip route returns on the Nexus 7000 -- that listing is about 50 lines at most. Showing thousands of host route entries is pointless.

How can we get the Routing Table section to look like what is returned in show ip route ?

When is 'PROD' = 'Prod'?  That answer, of course, is in T-SQL.  By default, SQL server does not use case sensitivity when executing queries.  If you want to perform a case-sensitive query in SQL server you need to do something like:

SELECT Caption FROM Nodes WHERE Caption = 'MYSQL' COLLATE SQL_Latin1_General_CP1_CS_AS

That COLLATE statement tells SQL server to look for MYSQL not MySQL or any other variation of that value.  Why is this important?  Here's my story.

While playing in my environment a few months ago I noticed that one of our custom properties for nodes (PROD_STATE) included what looked like duplicate entries.  At least I knew that they were the same -- PROD and Prod.  "Hmm, that's odd!" I thought to myself.  I did a query against our DB (SELECT Caption, Prod_State FROM Nodes WHERE Prod_State = 'Prod' COLLATE SQL_Latin1_General_CP1_CS_AS) knowing that our standard was to use the PROD value.  I found a few nodes that had used the 'Prod' value and I fixed them up.  "No big deal," I thought, "I'll just remove the 'Prod' value from the Prod_State custom property."  Then I remembered that ciulei told me that SQL was case insensitive.  That was a problem.  Would the delete function delete just the 'Prod' value or, because almost everything under the covers of Orion is a SQL query, would is delete both 'Prod' and 'PROD'?  To the test lab!

The first thing we have to know is that where a custom property has a list value (you've made is a drop-down selection) that those values appear in the dbo.CustomPropertyValues table in your DB.  The second thing you have to know is that the dbo.CustomPropertyValues.Value is set to SQL_Latin1_General_CP1_CI_AS.  That would be CI (case-insensitive) and AS (accent sensitive).  Third, the dbo.CustomPropertyValues table has no primary key.  The TargetTable column tells you where the custom property is going to apply, the Name column tells you the name of the custom property and the Value column tells you the discrete values for the custom property.  It is because of this that you can have both PROD and Prod in the same list.

(This screenshot is from a system running NPM 11.5 and Orion 2015.1.2 but the same condition existed in NPM 11.0.x and Orion 2014.x)

To test whether or not deleting the value from the Prod_State custom property via the UI would cause a problem I jumped into the Database Manager on our primary poller and ran this query:

SELECT TOP 1000 * FROM [dbo].[CustomPropertyValues]

WHERE Name = 'Prod_State'

AND Value = 'Prod'

Both rows (PROD and Prod) were returned. OK.  Time to delete this via the UI.  I flipped back to the Orion UI and went to Edit Custom Property for Prod_State and clicked next to the 'Prod' value.  Uh-oh!

(For posterity purposes, in NPM 11.0.x and Orion 2014.x you do not get a prompt -- you just can't delete the value.  This prompt is part of the Orion 2015.1.2 framework -- a welcome addition!)

I know that I don't have any nodes using the 'Prod' value but I do have 2 test nodes using the 'PROD' value.  This confirms that the query being used to delete the values is not using the COLLATE SQL_Latin1_General_CP1_CS_AS.  I confirmed that by jumping back to the Database Manager and running

DELETE FROM [dbo].[CustomPropertyValues]

WHERE Name = 'Prod_State'

AND Value = 'Prod'

It returns '2 row(s) affected'

So how do you delete the extraneous 'Prod' from the custom property list if you can't run a SQL query or use the UI?  Well, you CAN use the UI but you have to know the secret.  Remember when I said that the CustomPropertyValues table only contains values when the custom property is set to drop-down list?  That is the key! 

First, make sure that there are no nodes that are using the Prod_State = 'Prod' value by running the first query in this article:

SELECT Caption, Prod_State FROM Nodes WHERE Prod_State = 'Prod' COLLATE SQL_Latin1_General_CP1_CS_AS

If you find any, change them.  This *very* important.  You cannot have any nodes using the custom property value that you want to eliminate.

Second, go to Manage Custom Properties, select your custom property and click edit.  You should see the offending duplicate values.  Uncheck the 'Create a drop-down list of value for this property' check box and click submit.

This is a non-destructive change.  You are not modifying the assigned values in the Nodes (Orion 2014) or NodesCustomProperties (Orion 2015) table at all you are simply removing the reference to CustomPropertyValues table.  You can confirm that by running a query similar to the one below.

SELECT * FROM CustomPropertyValues WHERE Name = 'Prod_State'

Third, since we want to have a drop-down list to control the values in this custom property we need to go back to the Manage Custom Properties page, select our 'Prod_State' custom property, click edit, re-check the 'Create a drop-down list of values for this property' check box and click submit.

As this point you can either re-run the query above or edit the custom property again.  Not only will the 'Prod' value be gone but so will any other 'Prod_State' value that was not assigned to node.

Here's what happened behind the scenes.  When you check the 'Create a drop-down list...' checkbox Orion executes one of two queries (depending on the version of the Orion UI you are running):

SELECT DISTINCT(Prod_State) FROM Nodes 

SELECT DISTINCT(Prod_State) FROM NodeCustomProperties

That query produces a list of unique values that are currently assigned to nodes.  Now that you understand how the drop-down list works you can see it can be both extremely useful (clean up extraneous entries with "duplicate" names!) and a little dangerous too.  (Did you pre-populate your list with 1000 assignment group names for incident routing then uncheck the box by accident?  Bye-bye values.)

Hopefully our experience will help you understand more about how SQL works (by default), how Orion works and how you can leverage some of those idiosyncrasies to help you in your administrative duties.

Good luck and query safely!

What sorts of charts, graphs and info do you have on your NPM Summary page? Looking for suggestions outside of what I have.

Thanks!

I enabled the High Receive Percent Utilization with Top Talkers alert some time ago.  It emailed a web page listing the top talkers.  It worked fine for years.  After upgrading to NPM 11.5, this alert no longer emails a web page.  It's as if the syntax is no longer recognized.

I didn't change the value in the "Enter or Paste the Web Page URL" field.  I click preview URL and the URL doesn't display.

Any ideas on a fix?

When we upgraded to 11.5, one alert specifically has stood out so far with having some corruption.  We have over 500 alerts so it is going to take quite some time to weed through them all.  This one alert was triggering on an interface being down.  What we once had was the ${NodeName} within the text of the alert notifications but found after the migration that it no longer worked.  I found by replacing it with ${N=SwisEntity;M=Node.DisplayName} it now gives me the node of which the failed interface it on which is much needed when alerting on.  I'm hoping that this may be an oversight in coding but feel attention needs to be brought to it as it concerns me about all the other alerts I and Nap have spent a GREAT deal of time in creating.  This as well concerns me as I don't have any backup other than the db backup to go to look to compare to ensure that the converted alerts are converted correctly. Hey, I can remember most of the alerts I created but over 500 configurations, I'm not that good.  Also in the Reset Condition tab of the Alert, it says The actual trigger condition: Trigger Alert when... I believe it should be Trigger RESET when.  causes a bit less confusion as well as it's what causes the reset not the alert trigger.  I'm sure I'll have more things to share and frustrations.  I realize all can't be perfect but it has to come pretty darn close when our company relies on this software and my job security somewhat depends on it.  Now back to finding what else could be jacked up with my baby (Orion).

During the installation of Additional WEB Server, it ends with the following error: "Error Updating Database" "The database schema version does not match You need to upgrade your database from the main Orion server first."

The database is SQL2012SP1 and the version of AdditionalWebsite-6/10/2015

One would have any idea what to Database need to migrate?

Would migrate to SQL SP2?

There are times when the clients' device stops polling for whatever reason.  This could be an issue with the device or a change in credentials.  Almost all clients I have been involved with are not aware that the polling has stopped.

There is a simple way of noticing this, which is by looking at the timestamp of the CPU polling.  If it is more than 35 minutes from the current time, the node is having issue.

Here is the report for it:

SELECTn.CaptionasNode_Name,n.ip_addressasIP_Address,n.ObjectSubTypeasPoll_Type

,Cast(DateDiff(day,MAX(c.datetime),getdate())asvarchar)+' Day(s) '+convert(char(8),dateadd(second,DateDiff(second,MAX(c.datetime),getdate()),0),14)as Duration

,DateDiff(mi,MAX(c.datetime),getdate())minutes_since

FROM Nodes n

InnerjoinCPUload c onc.NodeID=n.NodeID

WHEREn.status= 1 and(n.ObjectSubType='wmi'orn.ObjectSubType='snmp')

GROUPBYn.Caption,n.StatusDescription,  n.ip_address,n.ObjectSubType

HavingDateDiff(mi,MAX(c.datetime),getdate())> 35

ORDERBYminutes_sincedesc

Reporting is nice, but a better way to notice this is by creating an alert for it - so it can be resolved in a timely manner.  For the alert, you would need to use a custom sql:

SELECTnodes.NodeID,nodes.captionFROM Nodes

InnerjoinCPUload c onc.NodeID=nodes.NodeID

WHEREnodes.status= 1 and(nodes.ObjectSubType='wmi'ornodes.ObjectSubType='snmp')

GROUPBYnodes.Caption,nodes.nodeid

HavingDateDiff(mi,MAX(c.datetime),getdate())>35

Using both the report and alert will make sure you are getting data from all nodes and avoid the embarrassing situation when a server crashes due to high CPU and the boss comments - "I thought that SolarWinds was monitoring this".

Thanks

Amit Shah

Loop1 Systems

Hi,

I am searching for the logfile which records all the audit trail of logon failures and authentication in Orion NPM v11.5.2

I used to access this directory few years ago but Somehow I cant remember the directory. Can you please share the path of the directory where the user logon audit logs are stored?

Thank you in advance

Hi all,

As per http://knowledgebase.solarwinds.com/kb/questions/6204/Misleading+license+information+notification+in+the+Orion+web+console.

I presume this is incorrect....

And my IVIM 2.0.0 should definitely not be in evaluation mode ?

Is it possible to increase the retention policy for detailed statistics for specific interfaces?  For example, all my routers' WAN ports have an interface custom property named isCircuit.  I want to keep detailed stats for these interfaces for 40 days.  Is this possible?

I'm aware of the setting in poll settings.  You can specify the duration for detailed statistics retention, however it is for all elements and I'm looking to modify the retention for a targeted set of elements.

I have been troubleshooting false alerts on checkpoint devices for quite a while.   Hopefully someone here can help out some.

This is our configuration. 

• Orion Platform 2014.2.1, IPAM 4.2, NCM 7.3.2, NPM 11.0.1, NTA 4.1.0, UDT 3.1.0, IVIM 1.10.0, VNQM 4.2
  • Everything except for our Neflow server are on virtual servers.
  • We have two pollers.
  • All SW Servers are located in the same datacenter.
  • Checkpoints are across the country.

When we get a false alert: (they are random and not consistent)

• If you log into the Poller that device is assigned to, you can't ping or trace route to that device.   However if  you log into the other poller or from your desktop you can ping and trace route without issues.   This happens more often on our primary poller, but has happened on our secondary poller.
• The false alerts many times bounce (show down, up, down, up about every 10 or so minutes)

I have:

• Had our server team look at the servers and they have not located any issues.
• Restarted the servers
• Firewall team (responsible for the checkpoints) do not show issues or blocks
• Updated the SW MIBS file
• This is happening ONLY on Checkpoint devices.  Other monitored devices are not giving false alerts.

Any other suggestions would be appreciated.

Does anyone have a workaround or idea for this:

- We have many devices (many of all the same device)  that do not have MIB-2 installed, and the vendor is not going to install it.

- We added the devices, as IP addresses (they are not in DNS) via "ICMP only, then switched the polling method to "ICMP + SNMP" because Orion will not allow you to add them via SNMP if MIB-2 is not on the target device.

- We were then able to create custom pollers to pull the vendor specific OID data we need.

but...

The device is  flapping down, then up, then down again.  We have device polling set to 3 minutes, so it appears to be changing status every poll....I'm wildly guessing that in one poll SNMP is used (down), then for the next poll ICMP is used (up).

I've tried setting the custom node overrides for packet loss and response time to WARN > 99%, CRITICAL > 100%, but it has not helped.

The "down" event has this text: "<IP ADDRESS> has stopped responding (No Such Name)"

Any ideas on getting it to show "up" and stop flapping?  I'm open to trying anything but I don't have the power to set up some sort of odd routing rules to route some SNMP request to bounce a false "up", or to manually patch + install MIB-2 on the device by myself.  My scope of influence is limited making changes to NPM.

I have 2 Cisco Switches which is "indirectly" connected via Remote Optical Network.

Both Interfaces are reflected as "Line Up, Protocol Up" on the console view.

Setup

Switch 1 <----- dark fibre -----> Switch 2

However from "Interface Downtime" view, only Switch 1 shows interface as up, while another endpoint Switch 2 still shows as down.

But on the interface view of Switch 2, the "Interface Detail" Status however is reflected as "Up". Just that "Interface Downtime" still shows as down.

Any idea how NPM or what data NPM uses to poll the data?

Hello,

I have created the following feature request http://thwack.solarwinds.com/ideas/3810

There is only the ability to set a single threshold against errors and discards.  I believe there is a requirement to have these two entities as separate values.

Thanks

Stuart