Orion SQL Cleanup Scripts.zip
PSA: Check your MIBs.cfg file if you've upgraded to NPM 12.0.1 (and maybe 12.0.0 too)
We have 3 Orion environments, 2 of which are in our Production environment and running on Win 2008 R2 servers and 1 is a Dev box for testing and general tomfoolery that is running on a Win 2012 box. All three had a Mibs.cfg file size of 1.3 GB. In case you don't know, this file is the SNMP OID Database SolarWinds uses for the Universal Device Poller application and the Manage Pollers page for polling CPU, Memory, Node Details, and custom SNMP polling. So when you are using their MIB Browser feature you are actually browsing this file.
Per the documentation it says that the latest MIBs.cfg file at the time of release should contained in each product upgrade. So typically just upgrading Orion should automatically update the Orion MIB database. Since NPM 12.0.1 was packaged and released on September 28, 2016, our MIBs.cfg file should have been current up to that time. Now, I'm not sure how much has been added to the Orion MIB database between Sep 28th and now, but the newest version of the MIBs.cfg file is nearly 1.9 GB in size once unzipped... That's almost a 50% increase in size (probably closer to 40%, but still) in just over a month's time... My guess is they didn't package up the newest MIBs.cfg file in the NPM 12 release. I would almost guess that they may have even put a substantially older MIBs.cfg file in there because an extra 600 MB worth of MIBs is a lot. That file has been around for years and years, so even if it gained 600 MB in 6 months I would be surprised.
In case you don't know this as well, SolarWinds updates the MIBs.cfg database file every two weeks based on customer support tickets, so instead of waiting for a product upgrade you can keep your MIB database up to date yourself. Usually this isn't necessary unless you have a node you're trying to apply custom SNMP monitoring to and Orion doesn't know about the OID's you are trying to poll. The file can be downloaded from your Customer Portal under "Helpful Links". You then simply unzip the downloaded file and replace the old file, located at "C:\ProgramData\Solarwinds\MIBs.cfg", with the new one. I recommend renaming the old one first to make a backup of it (I simply change its name to "MIBs.cfg.OLD_todaysDateHere") just in case. Then you restart all Orion Services and you should be good to go. If you have more than one polling engine then you will need to do this on your Primary Polling Engine and all Additional Polling Engines (I'm not sure about your Additional Web Server if you have one of those, but my guess is if that file is found in that spot then you should probably replace it).
CONCLUSION: The moral of this post is that you should check your MIBs.cfg file and see if it is anywhere close to the size of the new one (1,896 MB to be exact). I also recommend going into the MIB browser on your web console or into the UnDP application on your server and browsing the MIB library there to see if it works. I was getting an error in UnDP and just a blank page in the web's MIB Browser until I replaced the file and restarted the services. And yes, I did try restarting the services first before replacing the file and that didn't help. Only once I replaced the file and restarted the services did it help.
Also, please reply if you too notice this. I'd be curious to know how prevalent this issue is or isn't.
How to find out PoE output levels on a switch/port?
I have a slightly different kind of question for a change. If you wanted to find out how much power is being supplied by PoE ports on a Cisco Catalyst switch, how would it be done? I'd like to know the total amount that each switch is putting out and, if possible, how much each PoE port on the switch is putting out? I know I can keep plugging devices in until it won't power any more, but I'd like some method that will allow for better planning and not leave me looking like a complete nut. For the record, the switches are still running IOS 12 - with the exact version dependent upon the device, with one exception. One of the switches is running 16.3.1, because it was brand new this summer. Most of the switches are 2960's.
If the method is dependent upon an IOS version, I'd still like to hear the method and know which version of IOS supports the parts that allow it to work correctly. If the method requires custom pollers, I will have many more questions to ask and will not feel bad about looking somewhat dense, because I know others will learn from my questions and the answers to them.
Thanks in advance and I will be asking Cisco much the same kind of questions.
Tell us your "Unknown" devices!
Sometimes devices show up in Orion as "unknown". Those devices need to be added to our SysObjectID database. We know about lots of them, but we'd like to hear which items you need.
We need:
SysObjectID (which you can find in Node Details) in System Manager.
Vendor
Model
Transforming Results - Conditional statement
Hi everyone,
I am trying to transform the results on a UPS battery fault status.
Unfortunately, I am unable to get the regular expression formatting, but not for lack of trying!
Simply put, I'd like to transform =if(({upsmgBatteryFaultBattery}) = 1, "Fault", "Ok")
but in regex I can't seem to find the right way to say it.
I'd be thankful for any help on this!
Manage Nodes Link is missing
I was put in charge of our Orion server about a year ago. The server that I inherited was a giant mess with random resources/nodes/alerts thrown around everywhere. So I abandoned ship and set up a new server/DB with only our network devices. Now I'm trying to go back and clear out some stuff on the original Orion server, but I cannot find a way to remove/manage any of the nodes as the links to do so have disappeared. Screenshots below to better explain what I'm talking about.
^^^^^^Old Server^^^^^^
^^^^^^New Server^^^^^^
The only thing I can think of is that the licenses on the Old Server have expired. Does anyone know why I can't manage any nodes on the old server?
Netpath not establishing any connections
Within the last 2 weeks, all but one of our Netpaths have stopped displaying any data, just displaying the "No Data Found" message.
I deleted all of them and tried making new ones, but none of them are getting any data. I have them going from the main Solarwinds server as well as from remote agents.
It's even more strange that once path would keep working while all others stopped, and no new ones will establish.
I have done the recommended database cleanup, but no improvement.
Case #1073734 has been opened, but have not received a response yet.
Anyone else have a similar experience?
NPM 12 RC2 Manage Alerts Refresh Loop
Installed NPM 12 today and found I am only able to make one edit to any alert before the 'Manage Alert's > Alert Manager' display area goes into a refresh loop for about ninety seconds to three minutes and am unable to manage any of the alerts. The 'Action Manager' tab does not exhibit this behavior. Setting a different value on the 'Group By' dropdown seems to shorten the amount of time on the refreshes. We've also found using the search field before making any edits seems to prevent the refreshes from occurring.
How I reproduced it:
1.) Click Settings>Manage Alerts
2.) Select the first alert I see and click the 'Edit Alert' button.
3.) When the Alert wizard finishes loading, click the 'Cancel' button.
4.) Sit back and watch the refreshes fly.
What we did to try and fix it:
- Restarted all Solarwinds services and IIS
- Physically restarted the server.
- Run a database maintenance
- Ran configuration wizard selecting only website
- Ran configuration wizard selecting website and services
Any thoughts or suggestions would be appreciated.
Meraki v2
When you installed NPM, did you add Nodes manually or did you run discovery?
We would like to improve user experience and for such reason I'd like to better understand if our users prefers INITIALLY to add nodes manually or run product network discovery in order to import devices to NPM
Translating SNMP Traps into English
Has anyone been able to take a trap and make it actually look like the English Language? Is this even able to be transformed?
sysUpTime=381 days 17 hours 0 minutes 50.00 seconds
snmpTrapOID=DISMAN-EVENT-MIB:mteTriggerFired
mteHotTrigger=Gi0/0 interface threshold reached
mteHotTargetName=
mteHotContextName=
mteHotOID=DISMAN-EXPRESSION-MIB:expValueUnsigned32Val.9.115.105.110.103.108.101.95.118.102.5.71.105.48.47.48.0.
mteHotValue=99
ifHCInOctets.3=142591331080874
ifHCOutOctets.3=22321230731626
ifHighSpeed.3=100
entPhysicalName.16=Gi0/0
Detect Flapping Interfaces
I had the problem that I need a solution for detecting Interfaces. With some SQL commands is it very simple do alert on flapping Interfaces. Important for this is also how often you poll the Interface Status !!!
Trigger Condtion:
Set up on Interface
JOIN Events ON Interfaces.InterfaceID = Events.NetObjectID
where eventtime >dateadd(hour,-1,getdate()) AND EventType = '10'
group by EventType, InterfaceID,FullName, Message
having count(*)>=3
Reset condition:
where InterfaceLastChange < dateadd(hour,-1,getdate()) AND Status = '1'
As Example for a Email (html):
Interface ${Caption} on Node ${Node.Caption} is flapping.
<BR>
For more information click <a href="${InterfaceDetailsURL}">here</a>.
So when in one Hour a line is flapping three times down (=down,up,down,up,down) the alert will trigger.
When the Interface is ok since 1hour and up there will come the reset.
I need a definition of what "All alerts this object can Trigger: really means
When looking at a node summary
I see a Resource called "All alerts this object can trigger (7)"
It then list 7 alerts that the object can trigger. Is this a definitive list? or is the (7) a delimiter, which limits the display to only 7 of x alerts?
I am being told that it is an all inclusive and total list.
However directly under this resource in the Summary I see "Active Alerts on this Node" And this resource contains two active alerts, and the alert type is not listed in the All alerts this object can trigger resource..
This leads me to believe that it is not an all inclusive list.
Can anyone validate this for me?
What are the things that Solarwinds cannot do?
I am reading notes and watched videos about Network Performace usage by solarwinds and almost all, from mapping to interface levels can be monitored. Do you know guys whar are the things that Solarwinds cannot do? Disadvantages? Thank you.
Monitoring devices behind a firewall.
Is there a way to poll Devices that reside remotely behind a firewall. Is there a software tool that can be installed on a server in the DMZ that could collect all of the polling information and relay back to the main Solarwinds poller? We already know that we can purchase an extended poller. However the license is expensive and the return on investment would not be there. I am wondering what other companies are doing to address this issue.
Here is some more information on our setup:
- We currently have IP based Automation devices that reside within our manufacturing facilities. These manufacturing facilities are located all over the World.
- Our Solarwinds server is located in our data center in Denver.
- The automation devices reside behind a firewall and are only accessible through the DMZ at the manufacturing facility.
Where are the Printed instructions for integrating F5 and SolarWinds
All I can find is a video for setting up in F5. Are there written detailed instructions anywhere?
This is all I can locate.
Hardware Details in Report
Hi All,
I would like to create a report where we can get the below highlighted (Hardware) details against the node.
i used the below query to find the all hardware column in all DB table but unfortunately, i did not the same info in all table,
SELECT COLUMN_NAME, TABLE_NAME
FROM INFORMATION_SCHEMA.COLUMNS
WHERE COLUMN_NAME LIKE '%Hardware%'
Could you please anyone can help use so that we can make a good report, which helps we can understand how many node are physical and virtual and where same is hosted. because this tap is showing also info like, VM is hosted in which esxi or VM is hosted in which hyper-v node.
Thanks
k
WPM Player
Can you please let me know if there is a option to increase # of scripts running on a recorder server?
Thanks
David
Microsoft Teams Integration with Orion Alerts
With the new release of Microsoft Teams, I got a tad curious and went to see what integrations were available.
Much like Slack, PagerDuty, and a host of others; Teams gleefully accepts incoming webhooks as a native integration. Below is a summary of how to achieve this in your Teams environment.
Step 1:
As an administrator of your organization's Team software, login to your Teams desktop application and click on the Team that you wish to add your integration to, then select "Connectors"
Step 2:
Search for "Incoming Webhook" and click "Add"
Step 3:
Name your new Webhook, add an optional Icon, and click "Create"
Step 4:
Copy your URL to be used with your alert action in a moment
Step 5:
At this point, you should see that you have a newly configured Webhook in your Connectors list and you should also have a new message in your Team reflecting this addition as well
Step 6:
Configure an alert action (Send a GET or POST Request To A Web Server) and include your Webhook URL and associated payload (example below)
Step 7:
Enjoy your new feed of alerts!
Here's the payload snippet I am using in my action at present:
{ "title": "ALERT TRIGGER: ${N=SwisEntity;M=Caption} is currently ${N=SwisEntity;M=Status}", "text": "DEVICE: [${N=SwisEntity;M=Caption}](${N=SwisEntity;M=DetailsUrl}) IP ADDRESS: ${N=SwisEntity;M=IP_Address} VENDOR: ${N=SwisEntity;M=Vendor} MODEL: ${N=SwisEntity;M=MachineType} [ALERT DETAILS](${N=Alerting;M=AlertDetailsUrl}) [ACKNOWLEDGE THIS ALERT](${N=Alerting;M=AcknowledgeLink})" }
Please note that there is some good information to be found in the API Reference as well: Office 365 Connectors API Reference - Outlook Dev Center
Enjoy!
Loop1 Systems: SolarWinds Training and Professional Services
- LinkedIN: Loop1 Systems
- Facebook: Loop1 Systems
- Loop1 Twitter: @Loop1Systems
- ZackM Twitter: @ZackM
Alert overview count and detail node alert count
fellow thwacksters,
Want to share a problem > solution, what i wanted to know is how many alerts triggered on a specif day and then what nodes nodes triggered them alerts and how many times in that day that node triggered an alert the reason i wanted this report was to be in a position to review my thresholds and review problem areas with nodes causing noise, this report will also show me alert noise improving over time so i can keep track of alerting efficiency with the goal of getting the down which is necessary if the NOC is just ignoring alerts.
> Total Alerts Overview,i have grouped the total number alerts per day to give me the individual day total alert count
> Detailed Alert View: Here you can see how many times a node triggered an alert on that day (noise) having this information i can identify problem areas and introduce extra logic around alert triggers.now you have a single place to see noisy alerts and problem areas
Some final comments you can change the date ranges for report simply (default is 30 days)
Change the following:
Total Alerts report:
WHERE EventTypeWord = 'Triggered' AND DATEDIFF(DAY,TimeStamp, GETDATE()) < 30
Detail Alert view:
WHERE EventTypeWord = 'Triggered' AND DATEDIFF(DAY,TimeStamp, GETDATE()) < 30
cheers,
EGGS