Do you have a need to detect rogue APs connected to your network?

With the explosion of smart mobile devices, both tablets and phones and end users wanting to connect them for email, remote access (VPN), wireless etc. How are you handling this?  Does your organization even see this as a problem?  What level of control are you looking for?  Do you care if they have apps like DropBox are installed on them and uploading corporate files without your knowledge?

When I talk about Mobile Device Management I mean specifically things like:

• Remotely manage and setup end users mobile devices (i.e. Google Android or Apple iOS) with the settings for service such as email access, wireless, VPN etc.
• Enforce corporate security standards and best practices such as ensuring a pass-code is set or disabling certain feature or functions on the device like the camera
• Ability to remotely wipe a device if lost or stolen
• Report on types of devices, the hardware and software installed on them in your environment
• Track users or stolen devices via GPS

We have had Solarwinds for many moons now, but we are now trying to push forward and test what other features it provides.

Recently, I have incorporated the Solarwinds Toolset Integration and customized the sessions to use SecureCRT as that is our primary terminal tool.

I have also tampered with Switch Port Mapper to try and streamline that process but was unfortunately halted due to a limitation and forced to submit a feature request (Switch Port Mapper - Layer 3 Argument with Browser Integration).

I understand that the tools are specific to the business and their needs, but what tools have you guys found useful, or would you recommend reviewing further?  (NPM, NCM, IPAM, Virtualization)

Here's a couple examples.  Recently I found this when looking at a UPS:

Um, it's not September anymore. So what is happening is that Orion is no longer getting data back when polling this node.  Am I getting an error?  Does the Node have a red flashing box?  Am I getting a daily report that something is amiss?  No on all counts. This is frustrating beyond my ability to express it.

So, how many nodes have this issue? According to tech support, there is no way to run a report to find out. I suppose I could just pull up all 2000 of my nodes one at a time to check.  Seriously.

Last night I had another issue that is along the same vein but somewhat different. There was some amount of service stopping and starting on my main server, and several nodes just stopped being polled.  How many?  Again, no way to know.  They just appear green, but there are no statistics being collected. No Application stats in SAM.    No CPU.  No Memory.  No Disk.  No network stats including latency, which leads me to believe no polling (not even ping) was occurring.  Error?  Down or unknown node?  Nope.  All happy green.  Nothing wrong here.  *SIGH*  Rebooting an additional poller fixed the issue, but I was just lucky to stumble upon it before the Thanksgiving holiday.

So there's the rant.  Now let's talk solutions:

For UnDP issues, Orion should 1) Change the Node graphic to have a flashing red box like an interface was down (or make it a global check box option), and 2) Create a report to show Top 10/All node that have UnDP that have not updated in 12 hours or some other arbitrary value.

For the times when Orion mysteriously stops polling, I'm open to suggestions. Maybe each poller should have a separate process that checks all nodes on all pollers to be sure data is populating. Run in every hour, once a day, whatever. It's not complicated, just check and see if there is SOMETHING from a node in the last hour or so.

Am I alone in seeing these issues?

By using below UnDP, we can get Cisco UCS Active Hardware Alerts in Solarwinds.

Hello,

When the ORION CONFIGURATION WIZARD finishes the procedures, he returns the following message: WEBSITE CONFIGURATION FAILED: WEB REQUEST FOR Orion/Login.aspx FAILED - THE REMOTE SERVER RETURNED AN ERROR: (500) INTERNAL SERVER ERROR.

The IIS error is: HTTP Error 500.19, HRESULT 0x8007007e

Server: Windows Server 2008 R2 Standard 64bit

SQL: SQL server 2008 R2 version 10.52.4000.0

IIS: 7.5

On the same server(SERVER A) there are already two more sites installed using the same IIS.

We installed Orion NPM on a different server(SERVER B) with the same characteristics (Windows Server 2008 R2 Standard 64bit) but with a fresh IIS installation and the whole setup competed successfully.

Is there any idea to overcome the problem and install Orion NPM on SERVER A?

Thank you.

HI,

I am about to upgrade to V10.3.1 from NPM V10.1.1. however I was just reading release notes of V10.3.1 and it is mentioned "Discovery profiles from older Orion NPM versions are not retained through upgrades to this Orion NPM version. If you want to retain a discovery profile, prior to starting your upgrade, externally record the configuration of the profiles you want to retain."

wondering if this will be the case in my upgrade as well? if so, what is the way around this?

I will really appreciate you help on this.

Regards,

Qasim

I've used custom views to show clients and my Team many different things that NPM monitors, and those folks really appreciate the service.  You can be a rock star in their eyes when you give them something that helps them improve how they and their clients understand their systems and their performance.

Here's how to build a custom View that shows current and recent WAN interface utilization between routers connecting six different data centers.  Remember, your new View doesn't have to be of just interfaces on the same switch, or on the same router.

You can build this kind of report for as many interfaces as you'd like, from any switch or router or device interface that's monitored by your NPM.  This one shows a single WAN interface on six different routers that connect into the same MPLS cloud:

Here's how to do it:

Create the view:

1. From NPM, go to Settings > Manage Views > Add

2. Customize the new view:

• Name it intuitively
• Select Summary (there are MANY types of views.  Read up on them, test some to get a feel for the extreme versatility of NPM)
• Click Submit

3. Edit the View.

• You can change its name if you want.
• I chose not to enable Left Navigation--this will be simple, and won't load a lot of info.
• I added a Custom HTML Resource to Column 1, then cloned it three times.  Next I moved one instance into Column 2, and then cloned that one twice.  I ended up with three Custom HTML Resources in each column.
• I set the width to 500 px for each
• I set No View Limitation (but you can add one in if you need it)
• Click Done or Preview.  Preview lets you see it right away, without assigning it to any Menu Bar.  Plus, you can edit those custom HTML fields.

4. Here's the sweet spot to make you rock in the eyes of your boss & peers because it gives you the power to make a really useful view:

• Open a second browser window to your NPM
• Browse to a router node and open it
• Open the interface that faces the WAN
• Look at the URL bar and note the NetObject= section.   Example:
• http://your_server_name_here/Orion/Interfaces/InterfaceDetails.aspx?NetObject=I:XXXXX&view=InterfaceDetails
• Copy or write or memorize the NetObject number for use in the next step

5. Edit your new View in Preview, or assign it to a Menu Bar and open it

• Click Edit in the top left Custom HTML window
• Give it an intuitive Title
• Fill in the Subtitle if that helps you better identify the interface or feature you're displaying
• Copy and paste this into the html window:

<img src="/Orion/Netperfmon/Chart.aspx?ChartName=MMAvgBps&Title=&SubTitle=&SubTitle2=&Width=640&Height=0&NetObject=I:XXXX&CustomPollerID=&SampleSize=1H&Period=Last 10 Days&FontSize=1&NetObjectPrefix=I&SubsetColor=&RYSubsetColor=&Printable=true&ShowTrend=True&ResourceID=27" />

• Where I've put in the X's, remove them and enter in the NetObject ID number you wrote down from the previous step
• Click Submit

The new page should open, but this time the top left window won't say Custom HTML, it'll show the bandwidth used by that router's WAN interface for the last 10 days:

Now repeat this for every Custom HTML entry you've made, but change the NodeID info to the Node ID that's shown in the Interface Details page URL for new/different WAN routers and interfaces.

OK, you've made a new View.  But your team can't access it easily until you assign your new View to the Menu Bar they use.  If you don't know how to do that . . .

Here's how to define a new View to add to a Menu Bar:

1. Go to NPM > Settings > Customize Menu Bars
2. Edit the Menu Bar you or your team will use to access your new View
3. Find your new View in the Available Items column on the left
4. Drag it to the right column, drop it in where you want it.

If you can't find your new View, you'll need to discover its URL.  Follow this process:

1. Open a second browser window and Edit the View by clicking the Preview open
2. Copy the URL for the new View when you're previewing it
3. Go back to the original browser window from step 3 and click Add
4. Type in the Name of your View, paste in the URL address, give it a good Description
5. I clicked the option to Open in a New Window.  It's your choice.
6. Click OK

Now go back to NPM's Home Page, find the new View in the Menu Bar, and click on it.

Voila!

Tweaking and tuning:

If you're not afraid of a little keyboard editing of html, you can easily change the 10 days to show the last 7 days or last 23 hours or last 17 minutes or last pretty-much-anything.  Here's how:

Look for "SampleSize" and "Period" in the code you copied & pasted

<img src="/Orion/Netperfmon/Chart.aspx?ChartName=MMAvgBps&Title=&SubTitle=&SubTitle2=&Width=640&Height=0&NetObject=I:XXXX&CustomPollerID=&SampleSize=1H&Period=Last 10 Days&FontSize=1&NetObjectPrefix=I&SubsetColor=&RYSubsetColor=&Printable=true&ShowTrend=True&ResourceID=27" />

Note the SampleSize is 1H, or One Hour.

Node the Period is the Last 10 Days

Edit each window in your view and change the SampleSize and Period to whatever works best for you.  Keep in mind that some combinations of SampleSize and Period don't go well together (e.g.:  SampleSize=1M and Period=Last 10 Months) because NPM needs to have you be reasonable.  If you want a graph showing changes every 1 minute, you have to be polling & collecting the data pretty frequently.  Pick a Period that's reasonable for seeing good granularity of 1 minute points, like Last 20 Minutes.  If you just see points instead of a line in the chart, you've picked a combination of sample size & period that's too granular for what your NPM has polled.  Adjust until you've got something that meets your needs.

Remember to keep the spacing in the html code exactly the same as the example I show above.  If you add a space between words, or remove one, you risk breaking the pretty graph output.

Some examples:

Show the Last 3 Hours, in 10-minute increments uses this code:

<img src="/Orion/Netperfmon/Chart.aspx?ChartName=MMAvgBps&Title=&SubTitle=&SubTitle2=&Width=640&Height=0&NetObject=I:XXXX&CustomPollerID=&SampleSize=10M&Period=Last 3 Hours&FontSize=1&NetObjectPrefix=I&SubsetColor=&RYSubsetColor=&Printable=true&ShowTrend=True&ResourceID=27" />

Note how the graph automatically changed "Last 10 Days" to "Last 3 Hours" in the title.  Sweet!

Suppose you like the 10 minute samples, but want to show the last 24 hours.  Just change "Last 10 Hours" to "Last 24 Hours":

<img src="/Orion/Netperfmon/Chart.aspx?ChartName=MMAvgBps&Title=&SubTitle=&SubTitle2=&Width=640&Height=0&NetObject=I:25091&CustomPollerID=&SampleSize=10M&Period=Last 24 Hours&FontSize=1&NetObjectPrefix=I&SubsetColor=&RYSubsetColor=&Printable=true&ShowTrend=True&ResourceID=27" />

If it looks great, fire off an e-mail to your Team or your Boss and show off the new functionality you've provided to the organization.

If it doesn't look great, spend a little time fixing it up.  Look for typos, fix spelling & punctuation--this is your baby, and folks will judge you by your work.

Swift Packets!

Rick Schroeder

I've been digging through the Orion 2015 DB schema to try and find the values presented when using dynamic baseline thresholds and I can't seem to find them.  It seems odd that there isn't a table for them somewhere, or at least one that I can readily find, as the values are used in a number of our alerts, etc. 

Any help?  Does anyone know the SQL tables where the node and interface values for ${USE_BASELINE_WARNING} and ${USE_BASELINE_CRITICAL} can be found?

Is there a way NPM can be tied in with SPACE?  We have SPACE monitoring and pulling configurations off the Juniper gear, but we also monitor the Juniper gear with NPM.   I noticed something that can be done with Dell for thresholds, and want to do something similar with SPACE if possible.

Changing Threshold Values

One of the reasons, under Environment, the Routing Engine is reporting the CPU value for temperature, which made us go into a small panic mode to discover why it was so high.  There is no way to change that name for that value that I can see. I also can't tell what the values are for alerting, but I can through SPACE.  Would much rather use Orion for everything and not have to go through different systems to look at these values.

Hi All,

Over the last few weeks we have had Solarwinds/Orion installed (NPM,SAM,vMAN).

Now we are setting up Alerts notification, however my SMTP Relay team are asking if the Orion email client supports the following:

"Does the application platform in question (Solarwinds) have an internal email process which has the capability to queue and retry messages if the message is not relayed to our gateways?"

I do not see any settings in 'Advanced Alert Manager' to manage send retries, in the event that a message fails to be relayed by our SMTP gateways.

Am I missing something, or is there no support to manage this type of requirement?

TIA

Daniel

I have been trying to figure out how to poll the Eaton UPS to see battery levels, load, etc. I found the MIBs on their site, example

xupsOutputVoltage OBJECT-TYPE

    SYNTAX INTEGER (0..2147483647)  -- UNITS RMS Volts

    ACCESS read-only

    STATUS mandatory

    DESCRIPTION

    "The measured output voltage from the UPS metering in volts."

    ::= {xupsOutputEntry 2}

xupsOutputCurrent OBJECT-TYPE

    SYNTAX INTEGER (0..2147483647)  -- UNITS RMS Amp

    ACCESS read-only

    STATUS mandatory

    DESCRIPTION

    "The measured UPS output current in amps."

    ::= {xupsOutputEntry 3}

xupsOutputWatts OBJECT-TYPE

    SYNTAX INTEGER (0..2147483647)  -- UNITS Watts

    ACCESS read-only

    STATUS mandatory

    DESCRIPTION

    "The measured real output power in watts."

    ::= {xupsOutputEntry 4}

So how do I get Orion to use the correct poller so that I can see this information?   Do these mibs need to be added to the database?

I have thins alerting going, and it works like a charm, however, one fault it has, the neighbor IP is not a node IP, so it wont tell us who the neighbor that down is. Will Orion do a PTR on that IP, so if I have reverse pointers created for those IP's will  it then do a lookup and report the node name?

Morning all...

I've been migrating all of our alerts to use the Orion General Thresholds so that we could do tweaking of thresholds on the nodes themselves as opposed to maintaining a huge list of exclusions or what not. I've done it on CPU and Memory with no trouble so far.

But I'm stumped for Disk use.

I'm trying to cut alerts, but I can't seem to find the Warning or Critical Value Reached event under Volumes. I'm sure that I'm a moron and have just missed it somewhere, or I have a huge fundamental issue with understanding how this all works... Either way, anyone else been able to figure this out?

Cheers,

Wil

Orion Platform 2015.1.0 - NPM 11.5

Hi All,

Ever since i upgraded my NPM to 11.5.2, when ever i restart the Orion Services some of my very old alerts gets re-triggered and i am getting lot of incident / Emails.

Is anyone facing similar issue? Please help!!

Thanks,

Reuben

I am curious how other folks out there are managing their alerts in a NOC environment?

I need a way to do the following...

• Present my alerts in such a way that they are obvious to my NOC Techs
• Provide a way to track how the alert was handled
• Provide a way to track who handled the alert for accountability
  

I know that NPM has an Alarm acknowledgment mechanism but that only accounts for Advanced Alerts, not alerts generated by Syslog and Traps.  I would prefer a consolidated "ALARM" interface through which to aggregate all alerts and manage then in once place that provides all of the things listed above on my bullet list.  I am considering sending all of my alerts to our ticketing system to achiveve this.

What are other folks out there doing to accomplish this, I would love to hear from you!

I am trying to set up "dashboards" for some of our customer base.  We are a state agency, so I would like to set stuff up where certain divisions see only their servers or network nodes, and I have found that limitations allow me to set that up.  The snag I have encountered is that this limitation is not reflected in the state map that shows all our server and network nodes.  I thought that since everything was linked that if I set up a limitation to show only servers in group A, then the maps would reflect that view as well, but that is not the case.  What I am trying to do is see if I can use the same map for all the restricted groups and it shows what they are restricted to viewing instead of having to create multiple maps.  These maps contain a lot of information and to recreate X number of maps is going to be extremely time consuming.  So far the maps I have already created have taken a long time, and my supervisor doesn't want to have our customer base have to wait months until I get all these done because of the maps.  Is there any way I can manipulate the maps to reflect the restricted views?  Thanks.

I'm having difficulty monitoring b/w usage for an ASA on our network.  Our Solarwinds monitor is on 172.16.x.x and the device is 172.20.x.x.  I've config'd the community string, snmp-server host, snmp-server enable, etc... but still can't get past the community string polling test screen.

From what I understand, it allows snmp when you configure the snmp-server on the ASA

Thanks

Here's a couple examples.  Recently I found this when looking at a UPS:

Um, it's not September anymore. So what is happening is that Orion is no longer getting data back when polling this node.  Am I getting an error?  Does the Node have a red flashing box?  Am I getting a daily report that something is amiss?  No on all counts. This is frustrating beyond my ability to express it.

So, how many nodes have this issue? According to tech support, there is no way to run a report to find out. I suppose I could just pull up all 2000 of my nodes one at a time to check.  Seriously.

Last night I had another issue that is along the same vein but somewhat different. There was some amount of service stopping and starting on my main server, and several nodes just stopped being polled.  How many?  Again, no way to know.  They just appear green, but there are no statistics being collected. No Application stats in SAM.    No CPU.  No Memory.  No Disk.  No network stats including latency, which leads me to believe no polling (not even ping) was occurring.  Error?  Down or unknown node?  Nope.  All happy green.  Nothing wrong here.  *SIGH*  Rebooting an additional poller fixed the issue, but I was just lucky to stumble upon it before the Thanksgiving holiday.

So there's the rant.  Now let's talk solutions:

For UnDP issues, Orion should 1) Change the Node graphic to have a flashing red box like an interface was down (or make it a global check box option), and 2) Create a report to show Top 10/All node that have UnDP that have not updated in 12 hours or some other arbitrary value.

For the times when Orion mysteriously stops polling, I'm open to suggestions. Maybe each poller should have a separate process that checks all nodes on all pollers to be sure data is populating. Run in every hour, once a day, whatever. It's not complicated, just check and see if there is SOMETHING from a node in the last hour or so.

Am I alone in seeing these issues?